disk-hygiene: disk_hygiene_enabled kill switch does not gate the PowerShell lane and is inert under the env-injection failure

[kyle-sexton]

Summary

The disk_hygiene_enabled=false kill switch ("audit-only mode") does not actually prevent deletions
on the platforms where it matters, for two independent reasons.

B2 — the enabled flag never gates the PowerShell lane

• skills/clean/scripts/destructive_guard.py:296-300 routes tool_name == "PowerShell" to
  powershell_decision() and returns before the enabled flag is computed.
• The enabled = ... CLAUDE_PLUGIN_OPTION_DISK_HYGIENE_ENABLED ... computation at :303 is only
  reached on the Bash branch.

So with execution disabled, Remove-Item / del / ::Delete / recycle-bin spellings still return
ask and can be approved. On Windows/macOS the PowerShell lane is the deletion/handoff path, so
"audit-only mode" is not audit-only there.

Fix: when disabled, powershell_decision should deny (not ask) the mutation spellings.

D3 — the kill switch is inert under the #376 injection failure anyway

• :303 reads CLAUDE_PLUGIN_OPTION_DISK_HYGIENE_ENABLED from the hook process env and defaults to
  enabled=true when absent (... != "false").
• Skill-frontmatter hooks do not receive plugin env vars (the disk-hygiene: skill-frontmatter guard reads CLAUDE_PLUGIN_DATA from env but never receives it -> engine lane fails closed on all platforms #376 mechanism), so this variable is
  absent on exactly the hosts disk-hygiene: skill-frontmatter guard reads CLAUDE_PLUGIN_DATA from env but never receives it -> engine lane fails closed on all platforms #376 affects → the guard defaults to enabled regardless of the
  configured userConfig value. The deterministic kill switch is silently defeated; only the
  model-advisory ${user_config.disk_hygiene_enabled} token in SKILL.md:35-37 remains (and its
  expansion in skill-body text is itself unverified).

Fix: move kill-switch enforcement to a point that actually receives the value — pass it as a
hook arg alongside the ${CLAUDE_PLUGIN_DATA} fix from #376, or have the engine read/enforce it.

Severity

HIGH — a disabled kill switch that does not disable execution is a safety-contract violation.
Related: #376 (same env-injection root cause for D3).

[kyle-sexton]

Claimed by work-2 lane (T5) at 2026-07-22T08:01:11Z. Even-A2 freeze-core (operator-promoted disk-hygiene trio per #627); disk-hygiene now unblocked (#936/#380 merged 07:41Z). Implementing both: B2 — gate the PowerShell lane on disk_hygiene_enabled (deny, not ask, on mutation spellings when disabled); D3 — pass the enabled flag as a hook argv (mirroring the --authorized-data-root argv landed via #742/#376) so the kill switch is authoritative on env-injection-failing hosts. Branch: fix/382-diskhygiene-killswitch-gate. PR opens DRAFT (touches PreToolUse guard + SKILL.md hook args → orchestrator diff-reads before ready). Same-plugin note: serializes behind any disk-hygiene PR (e.g. sibling #381) already open at PR-open time.