wrapper-guard: close the absence shape at the new boundary; stop giving wrong advice

Round six deleted the code/data parser and scoped what remained on `https?://`.
Review found the failure class had not been eliminated, only relocated: a raw
provider CLI carries no scheme, so the scope gate answered "not my business"
because the URL was ABSENT — the same shape, at the new boundary.

  gh api -X POST repos/a/b/issues -f title=x -f body=y
  gh api -X POST repos/a/b/pulls/1/reviews -f event=APPROVE
  tea api -X POST repos/a/b/issues/1/comments -f body=x
  curl -X POST -d x git.example.invalid/api/v1/repos/a/b/issues

All four were real writes to endpoints a wrapper owns, and all four passed.
Constitution gate 7 names raw provider CLIs explicitly, so they are in scope
rather than something to narrow the docs around. The scope gate now also
triggers on `/api/v{n}` and on the `api` subcommand of the provider CLIs, and
`-f key=value` joins curl's `-d` as an implicit POST. Adding triggers to a scope
gate can only make it stricter — it cannot open a new hole — which is why this
is a list of shapes rather than a model of any one caller.

The boundary is stated in the file rather than left to be discovered: provider
PORCELAIN (`tea pulls create`) is NOT covered, because catching it means
modelling every CLI's verb grammar, which is the parser mistake wearing a new
costume. That is a wrapper-and-review gap, not a thing this hook can hold.

Second finding, and the one I had flagged as my own worry: the endpoint `case`
was prefix-greedy, so `/issues/1/labels` blocked with "use issue-create.sh" —
the wrong wrapper for that call. A block an agent cannot comply with is worse
than no block, because it teaches that the hook is broken and the override is
routine, and an override that is routine is a guard that is off. Issue and PR
subresources now flow through, exactly as /releases and every other endpoint no
wrapper owns already does. This hook enforces "use the wrapper"; where there is
no wrapper it has nothing to enforce, and the gap belongs in the wrapper set.

I am departing from the review on that one deliberately: the review held that
blocking is correct there and only the remediation wrong. Naming a wrapper gap
in a refusal keeps gate-7 pressure, but it makes the override the normal path
for every labels and assignees call, which spends the override's meaning on the
cases where it is least needed.

Also: the APPROVE trap now catches the provider-CLI spelling `-f event=APPROVE`
alongside the JSON body, and still never matches the correct value APPROVED.

79/79 fixtures, locally and inside the CI image, with both blockers pinned in
both directions — the four repros block and name the right wrapper, while a
provider-CLI read, an unwrapped endpoint reached through one, porcelain, and the
`rm -f`/`grep -f` collisions all still pass. The 18-command ordinary sweep
blocks the same three round-six flips and nothing new, so the broader gate cost
nothing on ordinary work. Second over-block documented rather than found: prose
carrying `.post(` near a wrapped URL is refused, which follows from judging the
payload and is now stated next to the quoted-curl cost.

Gates: sanitization (all eight commands green in ci-base), shellcheck clean.

packages/mosaic/framework/tools/git/test-wrapper-guard.sh

@@ -137,6 +137,39 @@ FIXTURES="$TMP/fixtures.tsv"
   # detection: neither of these names curl at all.
   printf '2\t{"tool_input":{"command":"python3 -c '"'"'import requests; requests.post(\\"https://git.example.invalid/api/v1/repos/a/b/issues/1/comments\\", json={})'"'"'"}}\ta library call is a write with no flag and no curl\n'
   printf '2\t{"tool_input":{"command":"wget --post-data=x https://git.example.invalid/api/v1/repos/a/b/issues/1/comments"}}\twget spells its body differently and is still a write\n'
+
+  # Round six scoped the guard on `https?://`, and review found the absence shape
+  # had simply moved to that new boundary: a raw provider CLI carries no scheme,
+  # so the guard never reached the write question. These are the reported repros.
+  printf '2\t{"tool_input":{"command":"gh api -X POST repos/a/b/issues -f title=x -f body=y"}}\tgh api is a raw write with no URL scheme at all\n'
+  printf '2\t{"tool_input":{"command":"gh api -X POST repos/a/b/pulls/1/reviews -f event=APPROVE"}}\tand it reaches the endpoint the review wrapper owns\n'
+  printf '2\t{"tool_input":{"command":"tea api -X POST repos/a/b/issues/1/comments -f body=x"}}\ttea api, same shape, different CLI\n'
+  printf '2\t{"tool_input":{"command":"curl -X POST -d x git.example.invalid/api/v1/repos/a/b/issues"}}\ta scheme-less host path is still an API write\n'
+  printf '2\t{"tool_input":{"command":"gh api repos/a/b/issues -f title=x"}}\tgh POSTs implicitly when handed a field, exactly as curl does with -d\n'
+  # ...and the boundary that stops a broader scope gate becoming block-everything.
+  printf '0\t{"tool_input":{"command":"gh api repos/a/b/pulls/1"}}\treading through a provider CLI stays untouched\n'
+  printf '0\t{"tool_input":{"command":"gh api -X POST repos/a/b/releases -f tag_name=v1"}}\tno wrapper owns releases, whoever calls it\n'
+  printf '0\t{"tool_input":{"command":"tea pulls create --title x --repo a/b"}}\tprovider PORCELAIN is out of scope by decision, not by accident\n'
+  printf '0\t{"tool_input":{"command":"rm -f /var/tmp/api/v1-issues-notes.txt"}}\t-f is only a body when it carries key=value\n'
+  printf '0\t{"tool_input":{"command":"grep -f patterns.txt /src/api/v1/repos/a/b/issues.log"}}\tsame, on the flag agents actually collide with\n'
+
+  # Wrong remediation is its own defect: /issues/1/labels used to block with
+  # "use issue-create.sh", which is not the wrapper for that call. No wrapper
+  # owns an issue/PR subresource, so these flow through like every other
+  # unwrapped endpoint — and the two arms above them must keep blocking.
+  printf '0\t{"tool_input":{"command":"curl -X PATCH -d @b https://git.example.invalid/api/v1/repos/a/b/issues/1/labels"}}\tno wrapper owns issue labels, so there is nothing to enforce\n'
+  printf '0\t{"tool_input":{"command":"curl -X POST -d @b https://git.example.invalid/api/v1/repos/a/b/issues/1/assignees"}}\tnor assignees\n'
+  printf '0\t{"tool_input":{"command":"curl -X PATCH -d @b https://git.example.invalid/api/v1/repos/a/b/issues/comments/5"}}\tediting a comment has no wrapper either; only creating one does\n'
+  printf '2\t{"tool_input":{"command":"curl -X POST -d @b https://git.example.invalid/api/v1/repos/a/b/issues/1/comments"}}\tand the wrapped subresource must not fall through the arm above it\n'
+  printf '2\t{"tool_input":{"command":"curl -X POST -d @b https://git.example.invalid/api/v1/repos/a/b/issues"}}\tnor may issue creation\n'
+  printf '0\t{"tool_input":{"command":"curl -X PATCH -d @b https://git.example.invalid/api/v1/repos/a/b/pulls/1/labels"}}\tPR labels are unwrapped on the same reasoning as issue labels\n'
+  printf '2\t{"tool_input":{"command":"curl -X POST -d @b https://git.example.invalid/api/v1/repos/a/b/pulls"}}\tPR creation is wrapped and must not fall through with them\n'
+
+  # The APPROVE trap, in the spelling a provider CLI uses, and the value that
+  # must never trip it.
+  printf '0\t{"tool_input":{"command":"curl -X POST -d {\\"event\\":\\"APPROVED\\"} https://git.example.invalid/api/v1/repos/a/b/releases"}}\tAPPROVED is the correct value and is never the trap\n'
+  # Documented over-block, pinned so it is a known boundary and not a surprise.
+  printf '2\t{"tool_input":{"command":"python3 -c '"'"'print(\\"https://git.example.invalid/api/v1/repos/a/b/issues/1/comments .post(\\")'"'"'"}}\tprose carrying .post( near a wrapped URL is refused, by the same payload rule\n'
 } > "$FIXTURES"
 
 fail=0 n=0

packages/mosaic/framework/tools/git/wrapper-guard.sh

@@ -132,8 +132,28 @@ fi
 # mistakes; it is not a sandbox, and pretending otherwise is how you get a
 # control nobody can trust the boundaries of.
 #
-# Scoped to commands carrying a URL, so nothing without one is even considered.
-if printf '%s' "$CMD" | grep -Eq 'https?://'; then
+# Scoped to commands that are provider-API-shaped, so nothing else is even
+# considered. The first version of this scope gate asked only for `https?://`,
+# and review found the absence shape had simply moved to the new boundary:
+#   gh api -X POST repos/a/b/pulls/1/reviews -f event=APPROVE
+#   tea api -X POST repos/a/b/issues/1/comments -f body=x
+#   curl -X POST -d x git.example.invalid/api/v1/repos/a/b/issues
+# all carry a real write to a wrapped endpoint and none carries a scheme, so the
+# guard never asked the write question at all. Gate 7 covers raw provider CLIs,
+# so these are in scope and the gate now names the shapes they come in.
+#
+# Adding alternatives to a scope gate can only make it stricter — it cannot
+# create a new allow — which is why this is a list of triggers rather than a
+# model of any one caller.
+#
+# Boundary, deliberate and worth stating: this covers the `api` subcommand,
+# which is a raw API call wearing a CLI. Provider PORCELAIN (`tea pulls create`,
+# `gh pr merge`) is NOT covered — catching that means modelling every CLI's verb
+# grammar, which is the parser mistake again in a new costume. Porcelain is a
+# gate-7 gap for prose and review to hold, not this hook.
+API_SHAPED='https?://|/api/v[0-9]'
+API_SHAPED="$API_SHAPED"'|(^|[[:space:]|;&(])(gh|tea|glab|hub)[[:space:]]+api([[:space:]]|$)'
+if printf '%s' "$CMD" | grep -Eq "$API_SHAPED"; then
 
   # Write detection, now client-agnostic. Every spelling curl accepts, because
   # the guard is defeated by the one spelling it does not know: `-d@body` (no
@@ -151,7 +171,18 @@ if printf '%s' "$CMD" | grep -Eq 'https?://'; then
   # curl sends POST implicitly when handed a body, in any of these forms.
   printf '%s' "$CMD" | grep -Eq -- \
     '(^|[[:space:]])(-d|-F|-T)|--data([-a-z]*)?[[:space:]=]|--json[[:space:]=]|--form|--upload-file|--post-(data|file)[[:space:]=]' && is_write=1
+  # The provider CLIs POST implicitly the same way curl does, when handed a
+  # field. Matched only in `-f key=value` shape, so the far more common `rm -f`
+  # and `grep -f` cannot be read as a body.
+  printf '%s' "$CMD" | grep -Eq -- \
+    '(^|[[:space:]])(-f|--field|--raw-field)[[:space:]]+[A-Za-z_][A-Za-z0-9_.-]*=|--input[[:space:]=]' && is_write=1
   # ...and a library call is a write without any flag at all.
+  #
+  # Second documented over-block, and broader than the body flags because it
+  # needs no flag: any text carrying `.post(` near a wrapped URL is refused,
+  # including prose that merely quotes it. That follows from the same rule as
+  # the quoted-curl cost above — the payload is judged, not the caller — and it
+  # is stated here so it is a known boundary rather than a surprise.
   printf '%s' "$CMD" | grep -Eq -- \
     '\.(post|put|patch|delete)\(' && is_write=1
 
@@ -162,6 +193,19 @@ if printf '%s' "$CMD" | grep -Eq 'https?://'; then
                               endpoint="pull-request review"; wrapper="pr-review.sh" ;;
       *"/pulls/"*"/merge"*)   endpoint="pull-request merge";  wrapper="pr-merge.sh"  ;;
       *"/issues/"*"/comments"*) endpoint="issue comment";     wrapper="issue-comment.sh" ;;
+      # Any OTHER path UNDER a numbered issue or PR — labels, assignees, times,
+      # a comment edit at /issues/comments/{id}, a PATCH of the issue itself.
+      # No wrapper owns these, and this arm exists so the guard does not claim
+      # one does: before it, /issues/1/labels fell through to the generic arm
+      # below and was refused with "use issue-create.sh", which is the wrong
+      # call. Wrong remediation is worse than no remediation, because a block an
+      # agent cannot comply with teaches it that the hook is broken and the
+      # override is routine — and an override that is routine is a guard that is
+      # off. So these flow through, exactly as /releases and every other
+      # unwrapped endpoint already does. That is the standing rule here: this
+      # hook enforces "use the wrapper", and where there is no wrapper it has
+      # nothing to enforce. The gap belongs in the wrapper set, not in a block.
+      *"/issues/"?*|*"/pulls/"?*) : ;;
       *"/pulls"*)             endpoint="pull request";        wrapper="pr-create.sh" ;;
       *"/issues"*)            endpoint="issue";               wrapper="issue-create.sh" ;;
       *"/milestones"*)        endpoint="milestone";           wrapper="milestone-create.sh" ;;
@@ -251,7 +295,10 @@ EOF
 fi
 
 # ---- 3. the APPROVE/APPROVED trap, wherever it appears ---------------------
-if printf '%s' "$CMD" | grep -Eq '"event"[[:space:]]*:[[:space:]]*"APPROVE"'; then
+# Both spellings the trap arrives in: the JSON body `"event": "APPROVE"` and the
+# provider-CLI field `-f event=APPROVE`. The trailing [^A-Z] is what keeps the
+# correct value out of it — APPROVED must never match.
+if printf '%s' "$CMD" | grep -Eq 'event"?[[:space:]]*[=:][[:space:]]*"?APPROVE([^A-Z]|$)'; then
   cat <<EOF
 BLOCKED: review event "APPROVE" is not valid on Gitea.