U

uze-sh/hook-read-guard

Copy page

Conformance deny on the file.read alias: a guard that denies only a path carrying lab-deny, followed by a second handler that must not run after a denial. Reading is a tool some harnesses never ask permission for, so the denial has to hold without a prompt.