{
  "_comment": "Org OS enforcement hooks — LIVE config loaded by Claude Code. Wiring per spec C7 (docs/superpowers/specs/2026-07-10-p0-execution-integrity-design.md). settings.hooks.json is the reference template; THIS file is the one Claude Code actually loads. Hook changes take effect on the next session. Verify with: python3 .claude/hooks/doctor.py",
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash|Write|Edit|NotebookEdit|Read|Grep|Glob|WebFetch|WebSearch|Agent|Task",
        "hooks": [
          { "type": "command", "command": "python3 \"$CLAUDE_PROJECT_DIR/.claude/hooks/guard_tools.py\"" }
        ]
      }
    ],
    "PostToolUse": [
      {
        "matcher": "Bash|Write|Edit",
        "hooks": [
          { "type": "command", "command": "python3 \"$CLAUDE_PROJECT_DIR/.claude/hooks/evidence_ledger.py\"" }
        ]
      },
      {
        "matcher": "Bash|Write|Edit|NotebookEdit|Read|Grep|Glob|WebFetch|WebSearch",
        "hooks": [
          { "type": "command", "command": "python3 \"$CLAUDE_PROJECT_DIR/.claude/hooks/usage_observer.py\" --event tool" }
        ]
      }
    ],
    "SubagentStart": [
      {
        "hooks": [
          { "type": "command", "command": "python3 \"$CLAUDE_PROJECT_DIR/.claude/hooks/subagent_register.py\"" },
          { "type": "command", "command": "python3 \"$CLAUDE_PROJECT_DIR/.claude/hooks/usage_observer.py\" --event start" }
        ]
      }
    ],
    "SubagentStop": [
      {
        "hooks": [
          { "type": "command", "command": "python3 \"$CLAUDE_PROJECT_DIR/.claude/hooks/usage_observer.py\" --event stop" },
          { "type": "command", "command": "python3 \"$CLAUDE_PROJECT_DIR/.claude/hooks/stop_validate.py\"" }
        ]
      }
    ],
    "Stop": [
      {
        "hooks": [
          { "type": "command", "command": "python3 \"$CLAUDE_PROJECT_DIR/.claude/hooks/stop_validate.py\" --main" }
        ]
      }
    ]
  },
  "permissions": {
    "_comment": "PRIMARY boundary (finding #11): Claude Code 네이티브 permission이 진짜 경계다. guard_tools.py는 2차 심층방어일 뿐. matrix가 default-deny 하는 side-effect를 여기서 deny/ask. 사람이 정당히 승인할 수 있는 것(원격 push/PR/배포)은 ask, secret 읽기/파괴적 명령은 hard deny. 일반 개발(git status/diff/add/commit, python, npm, ls, grep, test)은 건드리지 않는다.",
    "deny": [
      "Read(./.env)",
      "Read(./.env.*)",
      "Read(**/.env)",
      "Read(**/.env.*)",
      "Read(**/id_rsa)",
      "Read(**/id_rsa.*)",
      "Read(**/.aws/credentials)",
      "Read(**/.ssh/**)",
      "Bash(rm -rf:*)",
      "Bash(rm -fr:*)"
    ],
    "ask": [
      "Bash(git push:*)",
      "Bash(gh pr create:*)",
      "Bash(gh pr merge:*)",
      "Bash(kubectl:*)",
      "Bash(terraform apply:*)",
      "Bash(docker push:*)",
      "Bash(helm upgrade:*)",
      "Bash(serverless deploy:*)"
    ]
  }
}