Alohomora

---
name: alohomora
description: Audit blocking guards for over-reach — false positives that refuse legitimate work. Finds path resolution that treats out-of-scope paths as in-scope, guards applied to work outside the resource they protect, matching on symptom instead of emitter AND condition, missing or uncapped escape hatches, and block messages naming a route that no longer exists. Use for "the hook blocked something legitimate", "I can't write outside the repo", "this guard is in my way", "agents keep working around the gate", "false positive on a lint", or as part of /opus-pocus. Read-only; prescribes narrowing with negative tests. NOT for whether an artifact is wired (→ priori-incantato). NOT for whether a check reports honestly (→ nihil-revelio).
---

# 🐉 Alohomora

> *"Your guard locked a door it was never asked to watch."*

The asymmetry is the whole point: a noisy advisory costs tokens, but a false-positive **blocking**
guard costs the job. And it does not merely stop the work — it teaches agents to route around it,
in ways nobody reviews and no test covers. Every over-broad guard trains the exact behaviour the
guard exists to prevent, then hides the evidence, because a workaround leaves no failure to find.

## What to scan

- Every guard that refuses rather than warns — pre-tool hooks, pre-commit gates, CI blockers
- Their path/scope resolution: what root they resolve against, and what they do with anything
  outside it
- Their block messages, read as instructions — agents obey block text verbatim
- Their escape hatches: existence, TTL, attribution, ceiling
- Their test suites, specifically the **negative** cases: the legitimate inputs they must not block

**This spell's subject is guards you wrote.** On a repo whose only guards are `husky`,
`lint-staged` and branch protection, the prescriptions below do not apply — you cannot cap
`git commit --no-verify`, and branch protection's escape is an admin override the platform already
attributes in its audit log. Report **`N/A` — no repo-owned blocking guards**, and say that is
what you found rather than reporting a clean sweep of an empty set.

## Anti-patterns to find

1. **Out-of-scope paths resolved as in-scope.** Relative, home-prefixed (`~/…`) or symlinked
   paths resolved against the wrong root. Measured example: a repo-isolation guard blocked a
   write to a directory outside the repository entirely, because it resolved a `~`-prefixed
   absolute path as repo-relative — the guard's own subject was never involved.
2. **A shared-resource guard applied to work that does not touch the resource.** A
   stage-everything guard firing inside a *different* repository; a lease check on an operation
   that takes no lease. The rule is right; its domain is wrong.
3. **Matching on the symptom instead of emitter AND condition.** The guard keys on a surface
   string rather than on who emitted it and under what condition — so the eventual narrowing
   suppresses real cases along with false ones, and nobody can tell which.
4. **No escape hatch, or an unbounded one.** Either the guard has no override at all — so the
   only route past it is a workaround nobody reviews — or the override is untimed, unattributed
   and uncapped, which is not an escape but a permanent hole with better manners.
5. **A block message naming a dead route.** Block text is an instruction agents follow literally.
   A remedy that no longer exists is worse than no remedy: it sends every blocked agent down a
   path that fails a second time, and the second failure looks like the agent's fault.
6. **Severity mismatched to consequence.** Blocking where an advisory would do (refusing
   legitimate work over a stylistic rule), and advising where only a block will hold (a
   destructive or irreversible action behind a warning agents can and do proceed past).

## Fix prescriptions

| Finding class | Fix |
|---|---|
| Path resolution over-reach | Resolve against an explicit, named root; treat anything outside that root as out-of-scope and pass it through. Add negative tests for absolute, `~`-prefixed, symlinked and sibling-repo paths |
| Wrong domain | Gate on the resource, not the command shape — check whether *this* operation touches the protected resource before refusing it |
| Symptom matching | Narrow by emitter **AND** condition, never by symptom. If the narrowing would have let the original defect through, it is a silencing — do not land it |
| Missing/uncapped escape | Every escape gets a TTL, an attributed reason, and a ceiling. Short by default; a job needing longer needs a different mechanism, not a longer hole |
| Stale block message | Keep the remedy in the message verified by a test that runs the command it names, so a route that dies takes the message with it |
| Severity mismatch | Block only irreversible, destructive, or shared-resource-corrupting actions; advise everything else — and where an advisory is being ignored, the fix is usually a mechanism, not a louder advisory |

**The rule that governs all six:** a guard getting in your way is a defect report, not a wall.
But making it stop *noticing* is the failure mode; making it stop being *wrong* is the fix. The
deliverable of this pass is not a narrower guard — it is a corpus of legitimate commands the
guard must not block, encoded as tests, so the next narrowing cannot quietly become a silencing.

## Bounds

- Scope: blocking guards the repo itself owns and can change — pre-tool hooks, pre-commit gates, CI blockers — and their tests. Not advisory emitters (those are Muffliato Hookus), and not third-party gates whose behaviour you cannot alter.
- Cap: 15 findings, ranked by how ordinary the wrongly-refused work is.
- Done when every blocking guard has been checked once for a legitimate input it refuses.
- Quote once, at read time; mark anything you cannot re-confirm `UNVERIFIED` rather than re-reading to check yourself.
- See `skills/opus-pocus/references/casting-safety.md` for the full rules.

## Report format

Per guard: `path` · what it protects · the concrete legitimate input it wrongly refuses · class
(1–6) · prescription · whether a negative test now covers it. Lead with the count of guards that
can refuse legitimate work today, against the total examined, and flag any guard with no negative
tests at all — an untested guard's false-positive rate is unknown, not zero. `SCANNED NOTHING` if
no repo-owned blocking guards were found, grading `N/A` — never "clean", and never `O`.