Feature
Trust gates
Hooks, MCP servers and tool permissions need approval before they touch disk.
Every asset carries a trust class, from lowest to highest: passive_text, configuration, tool_permission, executable_hook, networked_mcp and telemetry_emitting. Trust can only be escalated, never weakened, and the trust class decides which trust gate applies: automatic, review, or explicit approval.
Sensitive assets, the ones that can execute code or grant tools, are never written silently. In a home workspace they need an explicit acknowledgment (`--yes`), and the CLI exits with code 5 on an unacknowledged one.