[jim80net]

Summary

Land named-ref agent/on-error-readable-core-6086c496 (4c67896) onto adapter main.

This SHA is already the live firing binary (/home/jim/go/bin/claude-gatekeeper, version 4c67896, SHA-256 b20b37bbbff6e4f0034c62c28b22728c1b374aea01be1ec700fd650cfb71b452). Adapter origin/main is still 619bf09. This PR closes that split; it is not a live install.

What changed

Pin gatekeeper-core to 6086c496 (issue-11 invocation matching). Core LoadFile now validates rules, so a parseable on_error = "deny" file whose regex does not compile used to make GlobalOnError abstain. Recover the knob from a TOML-only decode of the first-present global file. Do not re-admit the invalid rules.

Files: on_error_readable.go + test, main.go pin, go.mod/go.sum.

Out of scope

• Plugin-cache 1.7.0 vs live 4c67896 (separate deploy; default doctor still exits 1).
• Doctor named-ref dd65737 (selected-root still uninstalled).
• Closing issue 11 or issue 70.
• Leftover e2f3080 / d033d1b.

Review / merge

Independent review: ventures-xo. Do not merge on cubic/Grok alone. Do not squash-merge until that gate is clean.

Base: main (619bf09). Head: agent/on-error-readable-core-6086c496 (4c67896). One commit.

---

Summary by cubic

Honor on_error=deny when core rejects invalid rules during LoadFile. Previously, a parseable global config with on_error="deny" and an invalid regex resulted in Abstain; now the adapter reads on_error from the global TOML and denies while still rejecting the invalid rules.

• Pin gatekeeper-core to a version that validates rules during LoadFile.
• Replace the fallback to config.GlobalOnError() with onErrorAfterLoadFailure(), which TOML-decodes only the first present global file to read on_error and returns Deny only when it is "deny".
• Add on_error_readable.go and tests to lock behavior; no changes to user config or rule loading beyond this fallback.

^{Written for commit 4c67896. Summary will update on new commits.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	github.com/​jim80net/​gatekeeper-core@​v0.0.0-20260710233536-240fe2fad09c ⏵ v0.1.1-0.20260819054358-6086c49669be

View full report

[cubic-dev-ai]

No issues found across 5 files

_{Re-trigger cubic}

[jim80net]

Independent review (ventures-xo) — PASS

Pinned head 4c6789697453fbdecf0bda1d5d7a9b2613e5044f (agent/on-error-readable-core-6086c496) vs origin/main 619bf09. One commit. Inspected with git show / git diff only. Cubic / Grok exact-head are not this gate. ci SUCCESS at this head.

Holds

• Core pin v0.1.1-0.20260819054358-6086c49669be = 6086c49669beaa0110ce4085fad286654586d447.
• Core LoadFile (config/config.go:268-296 at that SHA) validates rules; GlobalOnError (config/config.go:71-80) abstains on that failure.
• Adapter load-error path cmd/claude-gatekeeper/main.go:367 uses onErrorAfterLoadFailure() then returns errVerdict (main.go:369) without evaluating the rejected rules.
• Recovery cmd/claude-gatekeeper/on_error_readable.go:17-42 recovers on_error via a TOML-only decode of a struct that has no [[rules]] field.
• Tests: on_error_readable_test.go:10-18; harness_test.go:147-148 (TestOnErrorMatrix badregex/deny through run()).

Residual, not FAIL: main.go:349 (unparseable stdin) still calls config.GlobalOnError(). Combined malformed stdin + invalid-rule global is untested.

Merge-forward: only open PR is 77. git merge-tree --write-tree origin/main origin/agent/on-error-readable-core-6086c496 exit 0. Stale --no-merged remotes conflict (37/64 exit 1) but have no open PRs. Negative control this session: known-conflict exit 1, identical-branch exit 0.

This review does not merge.