Add governed-workflow: hook-enforced safety harness for Claude Code

[AidenHiew]

Summary

Adds governed-workflow/, a self-contained safety bundle for Claude Code:

• CLAUDE.md — intent layer (operating model, hard stops, prompt-injection defence, commit workflow)
• settings.json — deny-list of irreversible/destructive commands plus wiring for the four hooks
• hooks/sentinel-watch.ps1 — UserPromptSubmit hook that detects typed sentinel phrases and unlocks pushing for the session
• hooks/push-guard.ps1 — PreToolUse hook implementing a two-tier branch-push gate; force-push blocked unconditionally; also catches shell-wrapper evasion (bash -c, sh -c, eval, iex)
• hooks/secrets-guard.ps1 — PreToolUse hook blocking read/edit of .env, *.pem, id_rsa, secrets, credentials, cloud creds, etc.
• hooks/session-audit.ps1 — Stop hook that appends an audit line and clears this session's unlock flags so the next session starts locked down
• README.md — install, tuning notes, porting guidance for mac/Linux

Two-tier push gate

Human types in chat	Effect (this session)
(nothing)	All pushes blocked
push this branch now	Push to non-protected branches allowed
override protected push now	Push to protected branches (main, master, prod, release, staging, develop) also allowed
anything + force flag	Blocked unconditionally — no phrase unlocks it

The model cannot type the phrase as the human, so it cannot unlock itself; flags are per-session and cleared on session end.

Caveats

• Hooks are PowerShell (Windows). The intent layer and deny-list are cross-platform; a hooks-bash/ POSIX port is welcome — porting notes are in the README.
• These are a speed-bump and backstop, not a sandbox. Pair with real server-side controls (branch protection, scoped tokens).

Test plan

• Install per README, start a new Claude Code session.
• Ask Claude to push → expect block citing tier-1 phrase.
• Type the tier-1 phrase, retry push to a feature branch → expect success.
• Retry push to main → expect block citing tier-2 phrase.
• Try a force push after both phrases → expect unconditional block.
• Ask Claude to read a .env file → expect block from secrets-guard.
• End session, verify unlock flags under ~/.claude/session-env/ are gone.