# Enforce Rule #8 Hole 6 — Deferred

**Date:** 2026-05-26
**Source:** brain-retro #5, [candidate C](../../observer/notes/2026-05-26-brain-retro.md)
**Status:** DEFERRED — by-definition, requires architectural choice.

## Hole

`enforce-classifier-match.mjs` is a **Stop-event hook**. The Stop event fires AFTER the agent's turn ends, which means all mutations (Edit, Write, Bash) have ALREADY happened. The hook can block the *next* turn (by returning `decision: block` in the Stop payload) but cannot revert the current turn's changes. By the time the hook decides "you should not have done that mutation", the mutation is committed to the working tree.

## Options

| # | Approach | Trade-off |
|---|---|---|
| A | Mirror the rule as a PreToolUse hook on `Edit\|Write\|Bash\|...` | PreToolUse fires before each mutation. But classifier output is computed once per turn (UserPromptSubmit), and per-tool re-check is per-tool — works. **Downside:** classifier_state may not be written by the time the first PreToolUse fires (race). Need to handle "no state yet" gracefully. |
| B | Mutation reversal (snapshot before, restore on block) | Dangerous. File-state restore is hard. Bash side-effects (DB writes, network calls, file deletions) can't be reverted at all. **Not recommended.** |
| C | Accept Stop-timing as best-effort | What we have now. Stop-event block prevents the *next* turn — still useful as cumulative discipline signal (agent sees the block message and adjusts in subsequent turns). Less immediate than A but materially valuable. |

**Recommendation:** Option A, as a follow-up after we have at least 7 days of data on the Stop-event enforce mode (which goes live after this 9-hole fix pass closes). The Stop-event variant is the "first line of defense" and should keep operating. PreToolUse variant adds "early-blocker" for the most-egregious classifier mismatches.

## Why deferred now

- The 9-hole pass is about closing bypass holes in the existing logic — adding a parallel hook layer is scope creep.
- Option A also needs a careful "no state yet" fallback (PreToolUse can fire before classifier ran for the turn — the classifier hook is on UserPromptSubmit, which races with PreToolUse on the first tool call).
- Stop-event enforce is materially useful as-is, even with this hole — the next turn's cumulative-discipline-block has a clear deterrent effect.

## Re-open trigger

If reviewer-pass data over a multi-week period shows ≥10 episodes where the rule "would have blocked" mutations had it fired earlier (i.e., mutations that completed successfully but were the wrong tool), reconsider Option A.
