Feature
Trust gates
Hooks, MCP servers and tool permissions wait for explicit approval.
Every asset has a trust class: passive_text, configuration, tool_permission, executable_hook, networked_mcp or telemetry_emitting. A trust gate blocks trust-sensitive assets until someone explicitly approves them.
A blocked pull exits with POLICY_VIOLATION (5). The projection scope decides how a rendered file lands locally, from generated_local to approval_required or forbidden.