The sidecar’s scheduled-agent wrapper restores .git/config and .git/hooks/ on every exit. The copy here predated the EXIT trap, so an agent that poisoned core.hooksPath and then failed, or a cancelled job, left it for the workflow’s later steps to read.
The registrar gate reads a confirmation whole, not its by: line. Re-dating an existing human: event, moving its revision or writing it in flow style added no by: human: line and so passed the old gate unseen. The gate also refuses a human: id it cannot look up, resolves a commit-shaped revision against the tree, and now runs under a top-level permissions: {} with no checkout credential on disk.
Added
The sidecar gains the preflight, the forge-free provenance gate and the conventions parser - knowledge-preflight.sh, knowledge-provenance.sh and knowledge-conventions.py - plus .lokf/.gitattributes, keeping the bundle on LF so a Windows checkout gives CI’s verdict.
A pull request that would release is held to its release notes and its title. The plan job refuses an empty ## [Unreleased], which semantic-release itself skips on a pull-request event, and refuses a title with no releasing type, since a squash merge takes its commit subject from the title.
