tama enforcement only

Replaces the machine-wide baseline with an operator-owned selection of installed hook ids.

#Invocation

tama enforcement only <hook-id>...

Provide one or more ids declared by the installed registry. Known ids include the registry's agent hooks and repository Git hooks. Tama sorts and deduplicates accepted ids before writing them.

#Output and state

Success begins Machine enforcement selection saved. Tama writes ~/Library/Application Support/Tama/hook-enforcement.json atomically with mode 0600, mode: "only", the selected ids, the transition time, and the immediately preceding effective mode and ids in previous. A live session may add hooks for itself, but cannot remove an id from this machine selection.

#Refusals and failures

An unknown id refuses the entire mutation before any write:

Unknown hook id '<id>'; the installed registry declares <N> hook ids, and the enforcement selection was not changed.

The sentence names the rejected id and the number of unique agent and Git hook ids known to the installed registry.

A hook that cannot run on this machine is refused the same way, before any write, because a selected hook that answers every tool call with a credential error takes the machine away from its agent - including the command that would undo the selection:

Hook '<id>' cannot run on this machine, so nothing was selected and the enforcement selection was not changed. It answered: <the hook's own line>

Tama asks each requested hook once with the activation payload the session path uses, expanding the home directory the registry records literally. A hook whose binary is not installed yet is accepted: it is absent, not broken. Only a hook that runs and answers with an infrastructure failure is refused. tama enforcement preflight shows that exchange for one hook without changing anything.

Other registry or write failures print enforcement: <OS/core error> to stderr and exit 1 without claiming success.

Return to the complete CLI command tree.