init: company-haness 설계

2026-07-23 17:49:00 +09:00
parent 57d1bab894
commit f668d6a158
962 changed files with 98989 additions and 1 deletions
@@ -0,0 +1,75 @@
+{
+  "_comment": "Org OS enforcement hooks — LIVE config loaded by Claude Code. Wiring per spec C7 (docs/superpowers/specs/2026-07-10-p0-execution-integrity-design.md). settings.hooks.json is the reference template; THIS file is the one Claude Code actually loads. Hook changes take effect on the next session. Verify with: python3 .claude/hooks/doctor.py",
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Bash|Write|Edit|NotebookEdit|Read|Grep|Glob|WebFetch|WebSearch|Agent|Task",
+        "hooks": [
+          { "type": "command", "command": "python3 \"$CLAUDE_PROJECT_DIR/.claude/hooks/guard_tools.py\"" }
+        ]
+      }
+    ],
+    "PostToolUse": [
+      {
+        "matcher": "Bash|Write|Edit",
+        "hooks": [
+          { "type": "command", "command": "python3 \"$CLAUDE_PROJECT_DIR/.claude/hooks/evidence_ledger.py\"" }
+        ]
+      },
+      {
+        "matcher": "Bash|Write|Edit|NotebookEdit|Read|Grep|Glob|WebFetch|WebSearch",
+        "hooks": [
+          { "type": "command", "command": "python3 \"$CLAUDE_PROJECT_DIR/.claude/hooks/usage_observer.py\" --event tool" }
+        ]
+      }
+    ],
+    "SubagentStart": [
+      {
+        "hooks": [
+          { "type": "command", "command": "python3 \"$CLAUDE_PROJECT_DIR/.claude/hooks/subagent_register.py\"" },
+          { "type": "command", "command": "python3 \"$CLAUDE_PROJECT_DIR/.claude/hooks/usage_observer.py\" --event start" }
+        ]
+      }
+    ],
+    "SubagentStop": [
+      {
+        "hooks": [
+          { "type": "command", "command": "python3 \"$CLAUDE_PROJECT_DIR/.claude/hooks/usage_observer.py\" --event stop" },
+          { "type": "command", "command": "python3 \"$CLAUDE_PROJECT_DIR/.claude/hooks/stop_validate.py\"" }
+        ]
+      }
+    ],
+    "Stop": [
+      {
+        "hooks": [
+          { "type": "command", "command": "python3 \"$CLAUDE_PROJECT_DIR/.claude/hooks/stop_validate.py\" --main" }
+        ]
+      }
+    ]
+  },
+  "permissions": {
+    "_comment": "PRIMARY boundary (finding #11): Claude Code 네이티브 permission이 진짜 경계다. guard_tools.py는 2차 심층방어일 뿐. matrix가 default-deny 하는 side-effect를 여기서 deny/ask. 사람이 정당히 승인할 수 있는 것(원격 push/PR/배포)은 ask, secret 읽기/파괴적 명령은 hard deny. 일반 개발(git status/diff/add/commit, python, npm, ls, grep, test)은 건드리지 않는다.",
+    "deny": [
+      "Read(./.env)",
+      "Read(./.env.*)",
+      "Read(**/.env)",
+      "Read(**/.env.*)",
+      "Read(**/id_rsa)",
+      "Read(**/id_rsa.*)",
+      "Read(**/.aws/credentials)",
+      "Read(**/.ssh/**)",
+      "Bash(rm -rf:*)",
+      "Bash(rm -fr:*)"
+    ],
+    "ask": [
+      "Bash(git push:*)",
+      "Bash(gh pr create:*)",
+      "Bash(gh pr merge:*)",
+      "Bash(kubectl:*)",
+      "Bash(terraform apply:*)",
+      "Bash(docker push:*)",
+      "Bash(helm upgrade:*)",
+      "Bash(serverless deploy:*)"
+    ]
+  }
+}