[kyle-sexton]

Closes #9743
Closes #9751

Summary

Problem: the guardrails README said the Bash|PowerShell row's added wall time for block-cross-domain (#9743) and for the block-root-delete-target protected trees (#9751) was "not measured yet". This PR records those measurements, taken on the Windows reference host (melo-lap-001) as docs/conventions/hook-budget describes. Both changes cost nothing measurable: they stay inside the noise of the rows they do not touch.

Fix

• plugins/guardrails/README.md, "Hook budget accounting": both entries now state the host, the harness, the run count and the paired median in ms and in S, where they used to say "not measured yet".
• One guardrails patch changelog fragment.

Verification

• Harness: the dotfiles fan-out harness tools/measure/measure-claude-hook-fanout.sh (sha256 e1bbebb9…, the hash the hook-budget launcher A/B used) ran on melo-lap-001: Windows 11, Git Bash 5.3.15, Node 24.21.0, jq 1.8.2, on AC power. It ran with --runs 7 against a scratch CLAUDE_CONFIG_DIR that enables only guardrails, overriding the plugin root with --plugin-root.

• Rounds: 15 rounds over five arms, with the arm order rotated each round, for 75 runs. All 75 were valid: S was 20 to 29 ms, with a median of 21 ms, against the 160 ms validity limit.

  • feat(guardrails): add the identity-domain guard with domain classification and its kill switch #9743, guardrails at main (0.61.2), set through CLAUDE_PLUGIN_OPTION_BLOCK_CROSS_DOMAIN_ENABLED. The arms were false (control), true with no map, and true with a placeholder identity-domains.json.
  • feat(guardrails): deny recursive deletes of protected trees ahead of the allowed roots #9751, guardrails at f39428d89 (feat(guardrails): deny recursive deletes of protected trees ahead of the allowed roots #9981) against its parent.

• Results: paired per-round medians of the guardrails PreToolUse Bash row against its control:

  Arm	Bash	Bash $(…)	Write (untouched)	Edit (untouched)
  block-cross-domain on, no map	+0 ms	−6 ms	+1 ms	−1 ms
  block-cross-domain on, map	+5 ms (0.2 S)	+5 ms	+4 ms	+4 ms
  feat(guardrails): deny recursive deletes of protected trees ahead of the allowed roots #9981 vs its parent	+1 ms	−3 ms	−3 ms	−6 ms

• Arm controls: in every round the map arm wrote the compiled cache and the disabled arm did not. So the true arm ran the guard's map path and the false arm stopped at the kill switch.

• Inside the budget: neither change adds a spawn on this path (k unchanged), and the measured added time, +0 to +5 ms (at most 0.2 S), is inside the ±0.3 S that the untouched rows moved. So there is no measurable added work, and the row stays inside its k × S budget.

• The other done-when items of both issues, rechecked on this head:

  • scripts/run-test-file.sh printed block-root-delete-target.test.sh PASS=2665 FAIL=0, block-cross-domain.test.sh PASS=310 FAIL=0, and run-guards.test.sh PASS=701 FAIL=0.
  • block-root-delete-target.test.sh section 2e holds every deny case the issue lists: .git, a worktree root, the toplevel, another session's scratchpad, ~/.claude and a listed tree. It also holds both allow cases: a subdirectory of the toplevel and this session's own scratchpad.
  • run-guards.test.sh keeps the guardrails: Bash|PowerShell PreToolUse row takes 30+s on a ~70 KB command; its 60s timeout fails open #4528 over-length case.
  • scripts/check-changelog-fragments.sh --check-required origin/main exits 0.
  • block-cross-domain is on the hooks.json row, .userConfig.block_cross_domain_enabled is set, and git grep -nE "melodic|kyle|sexton" over both guard files prints nothing.

• scripts/check-affected.sh --tests on the committed head, after merging origin/main: 13 passed, 3 skipped.

• Left out: the recursive-delete arm of feat(guardrails): deny recursive deletes of protected trees ahead of the allowed roots #9751 is not timed. The harness samples (git status --short, echo $(git rev-parse HEAD)) are not recursive deletes, so the figure above is the common call's cost. That matches the README's claim that only a judged recursive delete pays for the arm.

Related

• feat(guardrails): add the identity-domain guard with domain classification and its kill switch #9894 and feat(guardrails): deny recursive deletes of protected trees ahead of the allowed roots #9981 shipped the guards themselves. Both linked their issue with Refs: and left this measurement open.

🤖 Generated with Claude Code

[gitguardian]

️✅ There are no secrets present in this pull request anymore.

If these secrets were true positive and are still valid, we highly recommend you to revoke them.
While these secrets were previously flagged, we no longer have a reference to the
specific commits where they were detected. Once a secret has been leaked into a git
repository, you should consider it compromised, even if it was deleted immediately.
Find here more information about risks.

---

^{_{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-29T01:20:08.669273Z	f1a9acc	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-review reviewed 25f94b9bb380d651fc8ef848943889c100c606fb: 0 finding(s), 0 as inline comments.

Incremental review of plugins/guardrails/README.md since f1a9acc. The only change is a wording rewrite of the 0.34.0 entry's last sentence in the hook-budget history. It now says every decision is byte-identical to 0.33.11 in exit code, stdout and stderr, over the 17-command corpus in both tool modes (34 cases) and over the commands harvested from the eight guard suites. The claim and numbers are unchanged, and the sentence now reads as a complete statement. The edit is docs-only and touches no trusted path.

I found nothing to flag. I did not re-review the other file in the PR, which is unchanged since the last review.

I did not run the measurements or tests the PR description cites for #9743 and #9751. They are author-claimed and unverified by me.

Closing issues #9743 and #9751 were read. The incremental change doesn't affect their criteria.

No manifest items are hit. No cost or security hold applies.

[github-actions]

claude-security-review reviewed 25f94b9bb380d651fc8ef848943889c100c606fb: 0 finding(s), 0 as inline comments.

Incremental security review of plugins/guardrails/README.md (since f1a9acc): no security findings.

The only change rewords one sentence in a performance-history note. It now says every decision is byte-identical to 0.33.11 in exit code, stdout and stderr, over the same corpora as before. It changes no code, hook block list, allowlist, manifest, workflow or trust control, and it deletes no standing instruction. Nothing is narrowed or softened. This is README prose only, so the skip gate's "no security-relevant surface" case applies.

No manifest items were hit, so there are no manifest <field> lines.

critical-findings: 0