Build Log

Tooling & Sandbox Triage, and Making Signals Actionable

September 26, 2026

A charge to remediate signals became queue hygiene — until Zeb asked why, and the page turned out to be 8/9 noise.

ossignalsgatesalloyshell-safety

9 → 1

entries in Needs a Charge

374

real commands with 0 false positives

prior fixes that patched a symptom

times I committed the shape I was fixing

Timeline

Start

A red pulse verdict and a top-5 list

Zeb: triage Tooling & Sandbox, then the top 5, and execute

Early

Two OS tools gave opposite instructions

Both correct — same word '3', different denominators, neither naming its unit

Mid

Built the one shape whose trigger had fired

Shell-quoting: prose since 09-11, failed three times, twice more in this session

Turn

Zeb: 'why did you not do that?'

I had converted a remediation charge into queue hygiene and not noticed

End

The page was 8/9 unactionable

Six verified grab-bags; the one real signal was labelled as the unread one

What shipped

.claude/hooks/lib/shell-safety.mjs — classifies the inline-script quoting shapes with three evidenced occurrences; observe-mode only, fails open, never changes a permission decision

.claude/hooks/tests/shell-safety.test.mjs — 18 fixtures weighted toward negative cases (9 safe forms that must never be flagged)

.claude/hooks/gate-dispatch.mjs — observe-mode wiring, logging to <git-common-dir>/forgekit/shell-safety-observations.log.jsonl outside the working tree

forgekit-os/scripts/engine-guard.mjs — hard-rule baseline matching is now content-based, not line-based, ending a recurrence three prior fixes had only patched

forgekit-os/scripts/hard-rule-baseline.json — regenerated once with a `text` field, under a generator that refuses to write if any (file, phrase) count increased

forgekit-os/scripts/tests/engine-guard.test.mjs — line-shift regression test; caught a real bug in its own fix within minutes

products/alloy/lib/signals/prioritization.ts — CATEGORY_DISPOSITIONS registry, coherenceState exposed on PrioritizedSignal, Unverified Assumption recorded verified-coherent

products/alloy/components/signals/SignalsCockpit.tsx — Needs-a-Charge filters to actionable signals only, header states what was hidden

forgekit-os/charges/tooling-sandbox-disposition-2026-09-26.md — the triage record, with both follow-ups resolved in an addendum