feat(hook): the adjudicator's first slice — envelope, parser, gh policy (CLOUD-202)

.serena/memories/core.md

@@ -38,6 +38,11 @@ repo config > default`, declared as data in `SETTINGS` (per-key env var/flag),
   predicates over the repo. `run_static` (read-effect, no process spawn) backs
   `check`; `run_all` (every kind) backs `enforce`. `check` refuses a
   command-executing rule rather than silently skipping it.
+- `hook.rs` — the `hook` adjudicator (CLOUD-202): the normalized envelope, the
+  wrapper-lookthrough command parser, and the policy tables, ported from the
+  shell guards. Harness adapters decode/encode at the edges; the core is
+  harness-blind and fail-open, and the §7 exit-2-denies inversion lives in the
+  exit-code adapter only.
 - `identity.rs` — finding-identity fingerprints (CLOUD-123): SHA-256 over a
   normalized, kind-discriminated tuple — never raw `file:line` — so line
   insertion doesn't re-mint a finding; content changes correctly do.

crates/batten/src/cli.rs

@@ -13,6 +13,7 @@
 use clap::{Parser, Subcommand, ValueEnum};
 
 use crate::config::Strictness;
+use crate::hook::Harness;
 
 /// Repo-agnostic policy engine that keeps "done" aligned with landed-and-verified work.
 #[derive(Debug, Parser)]
@@ -56,6 +57,12 @@ pub enum Command {
         #[arg(long, value_enum, default_value_t = SpecFormat::Json)]
         format: SpecFormat,
     },
+    /// Adjudicate a mediated tool call read from stdin (under this verb, exit 2 denies).
+    Hook {
+        /// The harness whose payload to decode and whose decision channel to answer in.
+        #[arg(long, value_enum)]
+        harness: Harness,
+    },
 }
 
 /// Subcommands of `config`.

crates/batten/src/effect.rs

@@ -84,6 +84,11 @@ fn table() -> BTreeMap<&'static str, Effect> {
         ("enforce", Effect::Unclassified),
         ("config show", Effect::Read),
         ("spec", Effect::Read),
+        // `hook` adjudicates another tool's call: its own execution only reads
+        // stdin and config, but its *decision* mediates writes, so it is listed
+        // unclassified rather than allowed to leak into the derived read-only
+        // allowlist (CLOUD-202).
+        ("hook", Effect::Unclassified),
     ])
 }