Test guard-only failure blocking in new-WSL render - #908

Scope

Add a regression test against the actual new-WSL rendered settings.json: exactly one secret_path_guard.py command hook must be under PreToolUse with matcher Bash and onFailure == "block". Every other hook must omit onFailure entirely.

This draft targets main and contains one test commit above the landed guard change. Required designated GPT and CC reads, J8 for test code, CI and the pre-cue check remain landing gates; landing requires the command center's cue through 5f.

• Base commit: 2489b8481042755586a2d2005125d5359627f6c4.
• Lane: lane:foundation.
• Owned paths touched: tests/test_new_wsl_client_config.py; its existing hash/byte row in manifests/evidence.json, refreshed on main's manifest through scripts.host_receipts.register_file.

SOTA sources

• anthropics/claude-code, commit 602df92bf481ed904533e95c09f740f40aab5aed, CHANGELOG.md, 2.1.295: upstream adds onFailure: "block" for command and HTTP hooks. The pinned upstream release note was fetched independently for this follow-up.
• native-agent-stack, landed parent commit 2489b8481042755586a2d2005125d5359627f6c4, guard settings template: the guard declaration supplied by Make the credential guard hook fail closed #897. The existing new-WSL RenderTests fixture runs the repository's renderer and supplies the rendered output; this change uses that fixture.

Evidence-class table

These checks cover rendered configuration. Live Claude Code execution behavior remains the parent PR's separately recorded evidence.

Local commands run

The check process ran under nice -n 10 ionice -c2 -n7; the commands below were run after the rebase.

python3 -B -c 'from pathlib import Path; from scripts.host_receipts import register_file; register_file(Path.cwd(), "tests/test_new_wsl_client_config.py")'
rc 0
timeout 600 python3 -m unittest tests.test_new_wsl_client_config
rc 0; Ran 229 tests; OK
timeout 600 python3 scripts/validate.py
rc 0; 10917 hashed files; status passed
timeout 600 python3 scripts/evidence_manifest.py --check
rc 0; 10917 files; status passed
git diff --check
rc 0

Decision record

The parent decision, docs/decisions/2026-10-08-guard-hook-fails-closed.md, documents the field and the render regression gap. This test closes that gap using the existing renderer fixture. Exact rendering regressions would fail the assertion; an independently supported change to the guard declaration would require reviewing the expectation.

Host evidence

No files under evidence/hosts/ are changed. Required designated reads, J8 for test code, CI and the pre-cue check remain landing gates.

Checklist

• New/changed GitHub Actions are pinned to a full commit SHA with a version comment. No workflow change.
• New/changed workflows declare top-level permissions: {} and grant each job only what it needs. No workflow change.
• No secrets are printed, logged or committed; no new required secret was added without a documented owner.
• No new paid hosting, subscription or billing surface was introduced.
• Peer-owned untracked files and worktrees were preserved.