Coverage and boundaries
Auto Mode Gate is a pre-tool policy gate, not an operating-system sandbox. Its guarantees are intentionally limited to execution paths proven to pass through the documented OpenCode and Pi hooks.
Host coverage
Section titled “Host coverage”- OpenCode uses
tool.execute.beforefor the validated 1.18.18 baseline. - Pi uses
tool_callfor the executed 0.84.1 deterministic baseline and the isolated 0.84.2 judge probe. - Both adapters enforce only the built-in
bashtool. - Other tools remain under native host permissions.
A separately launched host process must load its own adapter. The hooks do not provide verified child-process identity or guarantee that a child loaded the gate. Each adapter reads only its host-owned global and project policy. Legacy paths act only as migration sources when that host’s destination is absent.
Evidence and identity
Section titled “Evidence and identity”The adapters require explicit shell evidence and an exact absolute executable path for narrow safe allowances. They do not infer agent or subagent identity, session ancestry, objectives, recent actions, or arguments that the host does not provide.
A trusted path is configuration authority, not an immutable file handle. Replacing a trusted file between policy evaluation and execution remains outside the hook contract. Within the host process, an enforced allowance freezes the reviewed argument object so later pre-tool handlers cannot replace its command.
No sandbox or remote service
Section titled “No sandbox or remote service”The shared core does not execute commands, display UI, contact a network service, or persist state. The Pi adapter may contact the user-configured model through Pi for one eligible request in an active session. Native host permissions still apply after an allowance.
The project does not provide an operating-system sandbox, a remote policy service, or a replacement for native host permissions.
Permission judge status
Section titled “Permission judge status”Version 0.2.0 supports an opt-in Pi judge through the host’s model registry; version 0.1.0 remains deterministic-only. Each Pi session starts off and can use /amg-judge to inspect status, toggle the judge, select an available model, or reset to the global default.
Only closed sanitized Git candidates are eligible. Deterministic decisions, ineligible input, off, and shadow use zero model calls. Pi failures block before the Bash effect. OpenCode has no equivalent verified transport and blocks eligible cases as unavailable.