...ails
Utility skill that installs optional deterministic guardrails for an
agent group: regex/keyphrase rules with block/flag actions, evaluated
per text at four enforcement layers (container inbound, MCP send hooks,
host outbound delivery, router inbound), fail-closed on broken config,
with a host-side quarantine audit trail and chat alerts.
Ships only .claude/skills/add-guardrails/ — no trunk behavior changes.
Resources were verified by applying them to a checkout: build and
typecheck clean, 397 host vitest + 128 container bun tests green;
resources are byte-identical to the applied tree.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Optional modules can now attach to the message path without editing core:
- src/module-hooks.ts — inbound message gates (router, pre-write),
 outbound message gates (delivery, pre-send), mount contributors
 (container spawn). Empty registries are exact no-ops.
- container/agent-runner/src/hooks.ts — inbound batch hooks (run before
 pre-task scripts in both the initial and follow-up poll paths) and
 result-text hooks (null suppresses dispatch).
- mcp-tools/server.ts — tool-call middleware chain around the single
 dispatch chokepoint, covering every registered tool.
- container/agent-runner/src/modules.ts — registration barrel imported
 by both container entry points (poll loop + MCP server); wrong-process
 registrations are inert.
deliverMessage now takes the existing OutboundMessage type instead of an
inline duplicate.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

...t host write threw
openOutboundDb is readonly:true by design (host reads, container writes),
but writeOutboundDirect — the command gate's deny-response path — used it
for an INSERT, so every call threw 'attempt to write a readonly database'
and the deny response never reached the user. Use the RW opener, mirroring
the host-sweep orphan-claim fix (8d022fd). Callers only write when they've
decided not to wake the container for the message; even seq parity is
preserved.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

The skill previously instructed ~11 marker-guarded edit blocks across 8
core files, guarded by an AST wiring test. It now rides the generic hook
seams: install = copy the module dirs + one barrel-import line per side
+ build.
- host: index.ts is now pure import-time registration (inbound gate,
 outbound delivery gate, guardrails-dir RO mount contributor, quarantine
 delivery action); the old index.ts logic lives unchanged in inbound.ts;
 delivery-gate.ts absorbs the alert-delivery block that SKILL.md used to
 splice into deliverMessage.
- container: register.ts registers the inbound batch hook, result-text
 hook, and tool middleware; tool-middleware.ts guards every MCP send path
 through the dispatch chokepoint via a per-tool text-extractor map
 (covering a future tool = one map entry).
- guardrails-wiring.test.ts (AST test) deleted — there are no hand edits
 left to drift. The rules.ts host↔container byte-identity guard moved to
 registration.test.ts; mcp-hooks.test.ts now drives the middleware
 directly.
- SKILL.md phases collapse to cp + 2 barrel lines + build; REMOVE.md to
 the reverse. Two deliberate semantic shifts documented: MCP block alerts
 route via session routing (not the resolved to= destination), and the
 guard now runs before tool-handler validation (a blocked send_file
 filename can no longer probe path existence).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>