One-off repairs: block-one-off-repairs

A gate on pre_tool_use:bash (tama hook block-one-off-repairs) that refuses repairs made by hand against live machine state, and builds while the build hold stands, and names, in each refusal, the product command that owns the outcome. Every refusal starts BLOCKED: one-off repair by hand., appears as a {"decision":"block","reason":"…"} document on stdout, and repeats its reason on stderr. The dispatcher ends normally after that decision; a nonzero exit without a decision is a hook failure, not a policy refusal. The harness prevents the proposed command from running. An ordinary allowed command prints nothing; an admitted build may report consumption of its recorded capability.

#Why it exists

Oko's one-off repair detector (oko transcripts one-offs) reads the native harness files and counts commands that changed live state by hand instead of through a product path: service cycles, grants minted from the shell, binary copies over installed programs, rows and settings changed by hand, waits in place of a read. Each fixes one machine once and is gone at the next sync, image refresh or build.

#Two readings

What a command's structure states is read directly, and holds whether or not a model answers: a compile while the build hold stands (the program a line runs and the subcommand its toolchain documents as building, testing or running a suite, and the fleet's own compile commands), an install the register already says will fail, and a Python run. Everything else a command might do by hand is read by a model, through Oko's model call, against the operator's rule and the route of each outcome (block_one_off_repairs/judge-prompt.md): which verb of which launcher, client, store or watcher does it is not a list anybody can finish, and the verb lists this gate used to carry were the keyword logic block-keyword-literals refuses. The refusal is the model's sentence naming what the command does by hand and the route that owns it. A question the judge leaves unanswered refuses the command with TAMA_HOOK_INFRASTRUCTURE: block-one-off-repairs: review unavailable: … and the judge's recorded state, as asking a model describes; the build hold never depends on a judgement.

#Build admission and open records

Whether a build, compile or test may run is not a count Tama makes: the gate needs the session's own build attestation and asks Oko's one admission decision, oko admit build --product <product> --session <id> --json, for each product the command builds. A standing withdrawal refuses the build quoting the ruling; a standing consent or a recorded build session capability admits it; where neither decides, Oko holds it until every open item carries its repair. No build is ever asked of the operator. How the build gate decides a build gives the whole decision and its refusals.

Checking whether any defect remains open reads no Git history. The text gate, stop gate and open-work listing read Oko's open selection directly. Each consumed field is decoded against Oko's serialized field types; a row that does not decode refuses with cannot decode Oko's open defect row <index>: <cause> instead of supplying an empty value, and unknown fields remain compatible with later Oko additions. A non-array reply or a record without a nonempty text identity or product is an unavailable register, not an empty workload.

The repair_history_presence journeys invoke the built block-text-outside-tool-calls and block-stop-with-open-work hooks against the actual authenticated Oko register. They require TAMA_TEST_OKO_EXECUTABLE to name the installed Oko binary and an existing open defect, retain both executable digests and the real register response, and reject a dependency-error refusal as proof. The stop case also requires TAMA_TEST_OKO_SESSION, a real non-executor session without local pending tracker entries, and TAMA_TEST_OPEN_DEFECT, the full identity of an actual open defect in that session's scope. Its refusal must name that defect. Git trace events must show no history command during either hook. The journeys create no artificial register rows and change no session roles.

The presence journey also copies an actual open record into an isolated register, corrupts its identity, and invokes the genuine Oko CLI followed by the built text hook. The refusal must name the malformed identity, leave the file unchanged and perform no history scan. Restoring the copied record must restore the ordinary open-work refusal. This is a persisted corruption case, not a replacement Oko executable or a canned CLI response.

#What the model refuses, and the route each refusal names

Reads pass: listing, printing, status and logs (launchctl print, kill -0, a select, defaults read), a filter over a pipe, reading one named file, the product routes above, writing inside the repository, version control on it, and any --help. A command that only mentions a restart in quoted text restarts nothing.

#What the structure refuses

#Where the refusal comes from

Source: rust/crates/tama-hook-tools/src/ports/block_one_off_repairs/ (mod.rs for the order, vocabulary.rs for the toolchains' compile structure, judged.rs and judge-prompt.md for the model's reading); binary: src/programs/block/ownership/block_one_off_repairs.rs. The journey cargo test --manifest-path rust/Cargo.toml -p tama-cli --test one_off_repairs_judged runs the built hook with the judge recorded as not answering and requires a service cycle to pass with the stderr note and cargo build to be refused by the build hold; with TAMA_TEST_ONE_OFF_JUDGE=1 and -- --ignored it asks the real judge and requires the service cycle refused with stado service restart in the reason and a launchctl print passed. The detector that counts the same shapes after the fact, across every stored transcript, is Oko's transcripts one-offs; a refusal here is recorded there as refused by hook. Registration is two commands: DEVICE_HOOK_EDIT_APPROVED=1 tama hooks declare --file hook-declarations/block-one-off-repairs.json for the catalogue entry, the registry entry and the reseal, and DEVICE_HOOK_EDIT_APPROVED=1 tama hooks release for the binary and the installed release.