feat(guide): entry authorization replaces per-action consent [spec 03-03]

[wine-fall]

Stacked on #136 (quit correctness), which stacks on #134. Merge order: #134 → #136 → this.

Implements the 2026-08-18 consent revision of specs/spec03/03-03-guide-harness.md (§3, §5, §2 updated in this PR; recorded as a user decision).

What

Entry authorization replaces per-action consent: the offer card's y is the authorization, and the guide acts on it.

• cliPermission rewritten: allows every tool call, never asks — the y/N wall (and the isReadOnlyCommand classifier that patched it, tests included) is deleted. Denies secret-bearing input with a reason the model can act on; a fired quit latch still denies.
• The secret guard's real enforcement point is a PreToolUse hook (guideOptions): a smoke against the real SDK proved canUseTool is consulted only when the SDK's own policy would ask — a Read of .env sailed straight through the permission callback (a pre-existing hole in the per-action design too). The hook fires for every tool use; SECRET_BEARING also widens to secret-shaped names and environment dumps (*API_KEY, printenv, env), closing the review finding deferred from fix(guide): /quit cuts the session instead of waiting it out [spec 03-03] #136. murmur-owned tools are exempt — write_voice_config owns the keyboard secret channel by design.
• Prompts rewritten (GUIDE_PERSONA + the task sections): routine steps — investigation, installs/upgrades on the user's own channel — run without asking, narrated as they go; the guide stops in natural language only at substantive forks (destructive/hard-to-reverse, a genuine choice, costs money). The never-take-a-credential-in-conversation rule is unchanged.
• Offer card y row states the authorization: "I'll run the fixes, and check with you at real choices".
• bypassPermissions stays banned (grep-guard kept); the surface stays bounded via tools.

Evidence

Real-SDK smoke (runGuide, Opus): node --version ran with zero questions reaching the host; a Read of .env was denied by the hook and the model quoted the credential reason back verbatim. Note: the SDK's safe-command classifier runs read-only commands without consulting canUseTool at all — visibility comes from the tool-activity stream (#134), which narrates every tool use into the dev log; the spec now records this seam fact.

Spec 03-03 §5.3 now owes a fresh by-ear pass under the new flow (the 2026-07/08 passes ran under per-action consent) — tracked as an issue.

Peer review: codex skipped — workspace spend cap; fell back to /code-review high (multi-agent): 8 findings, 6 applied, 2 dismissed. Applied: the api[_-]?key regex denied the walkthrough's own open .../app/api-keys step (URLs now stripped before the name test); the deny-list's bypass set (set/export -p//proc/self/environ/~/.murmur globs/bare $KEY expansions) now trips the guard; the false-positive set (/usr/bin/env as launcher, WebFetch pricing prompts, script shebangs) now passes; the quit latch reaches pullBed (stops at the next ref boundary); stale per-action-consent comments scrubbed across four files; date stamps dropped from code comments. Dismissed: the dev-log "command received" line states wire receipt — its purpose is quit-latency measurement, receipt ≠ handled; the SIGINT handover's escalation-counter reset is latent (the run still winds down via the quit check; the cost is one extra press only if voice.start() stalls).

AI coding brief

• Original request: engine-line stacked PR B of two: guide auto-mode — entry authorization replaces per-action confirmation, the offer's y is the authorization; deny only secret-bearing paths; conversational stops at substantive forks; spec 03-03 §3/§5.1 revised as the 2026-08-18 user decision.
• Manual interventions: none — executed as briefed; the PreToolUse-hook enforcement point was added beyond the brief after a real-SDK smoke showed canUseTool never sees the calls the SDK auto-allows.
• Retro: the smoke-before-claiming-done discipline earned its keep — the permission-callback-only design (both old and new) was silently unenforceable for Read, and only a real SDK run showed it. Any consent-layer brief should demand a real-SDK probe of the enforcement point first.

🤖 Generated with Claude Code