Every mutating tool call (subagent or main session) is scope-checked
against the active construction contract through the installed hook:
in-scope edits allowed, out-of-scope blocked naming the contract; the
durable lock fails closed across fresh processes (ACTIVE/UNREADABLE
both stop, ABSENT allows ordinary work); shell escapes (clobber/tee/
--output/touch) caught; supervisory acts refused; violations recorded
and self-clear on remediation. 67/67 drills + authority tests green;
hook installed hash-verified; activation front door ported (the one
design decision per the map) with the introduce-verb fix for rune's
Rust-core delegation.
closes#2499
Nick
9591e8a0eb