Optional: live-config round-trip probe for the dispatch-variety DENY-honor leg (follow-up to #865/#1028)

[michael-wojcik]

Context

Follow-up to #865 / #1028 (shipped in #1029, v4.4.41). Tracks the one accepted residual from the dispatch-variety DENY arm: the "platform honors the exit-2 deny" leg is source-proven only, not exercised via a real-binary round-trip into live session-config.

This is an optional runtime-confidence check, NOT a blocker. The deny arm is opt-in (PACT_DISPATCH_VARIETY_MODE=deny; default warn), source-proven, and fail-safe (graceful warn-degrade if a deny is ever not honored).

What is already proven

• The gate emits the deny contract correctly — test_dispatch_variety_deny_honor_probe.py is a non-mocked subprocess seam-integration: real subprocess.run([sys.executable, hook]) + real PACT_DISPATCH_VARIETY_MODE env read at import + isolated HOME with real on-disk session-context/team-config/task JSON. It asserts the exact contract the platform consumes: exit 2 + permissionDecision: deny + hookEventName: PreToolUse.
• The platform consumes that contract tool-agnostically — source-proven: toolExecution.ts deny branch returns before tool.call(), no tool-name carve-out.

The residual (what this issue covers)

We have NOT run a real-binary round-trip: a live claude process, with a real session-config (CLAUDE_CONFIG_DIR) and PACT_DISPATCH_VARIETY_MODE=deny, attempting a genuinely-unstamped TaskUpdate dispatch-wiring write, and observing that the platform actually blocks the TaskUpdate.

Acceptance sketch

1. Stand up an isolated CLAUDE_CONFIG_DIR with a real team config + a Task B that is genuinely unstamped (metadata.variety absent) and linked via addBlockedBy.
2. Launch a real claude session with PACT_DISPATCH_VARIETY_MODE=deny.
3. Drive the terminal dispatch-wiring TaskUpdate (owner = a pact-specialist + addBlockedBy set).
4. Assert: the TaskUpdate is blocked by the gate (not merely warned). Confirm the warn-default path is unaffected when the env-knob is unset.

Why optional

Bounded safe by: warn-default + opt-in deny + graceful warn-degrade. A consumer who never sets PACT_DISPATCH_VARIETY_MODE=deny sees no behavioral change. Closing #865/#1028 on the verified WARN-level enforcement is sound; this probe only upgrades the deny leg from source-proven to runtime-proven.

[michael-wojcik]

Closing as substantially covered (won't-do the dedicated TaskUpdate round-trip)

The residual this issue tracks — "the platform honors the exit-2 deny leg, via a real-binary round-trip into live session-config" — is now covered well enough that a dedicated, finicky headless-claude TaskUpdate round-trip is not worth the cost:

1. The gate emits the correct deny contract — test_dispatch_variety_deny_honor_probe.py is a non-mocked subprocess seam-integration test asserting exit 2 + permissionDecision: deny + hookEventName: PreToolUse (already noted in this issue).
2. The platform honors deny tool-agnostically — source-proven: toolExecution.ts's deny branch returns before tool.call(), with no tool-name carve-out (already noted in this issue).
3. NEW adjacent empirical evidence (2026-07-01): during the merge-guard: gate branch-protection API mutations (.../branches/*/protection); repo/release/api-repo-delete documented out-of-charter [RESOLVED] #1063 branch-protection post-install live-probe, the platform demonstrably honored a PreToolUse exit 2 + permissionDecision: deny for a real tool call — the merge-guard blocked a live gh api -X DELETE .../branches/*/protection Bash invocation in a running session (it never executed). That is the same deny mechanism this gate uses, exercised end-to-end against a real binary. Combined with (2)'s tool-agnostic source-proof, the "platform honors the exit-2 deny" leg is empirically demonstrated (on Bash) and source-proven to generalize to TaskUpdate.

The one thing not done is a TaskUpdate-specific round-trip (a headless claude with PACT_DISPATCH_VARIETY_MODE=deny driving a genuinely-unstamped dispatch-wiring TaskUpdate); given the deny arm is opt-in + fail-safe (graceful warn-degrade) and the honoring mechanism is now empirically demonstrated on another tool, that marginal delta does not justify the finicky nested-session probe. Closing as won't-do.