I3323 — An unclaimed edit is refused in Claude Code once no live peer edits without a claim

✕BLOCKED wave 1 · p2 · implementation profile · parallel safe

Part of a-provider-carries-the-contract-natively — Each agent client carries the contract through its own extension points, generated once and checked for drift.

Objective

Switch the edit guard from advisory to refusing through .ai/repo/policy.yaml once the claim-coverage report of I3322 shows no live peer editing without a claim, and prove an unclaimed edit is refused through the generated Claude Code configuration.

Why

The rollout the 2026-10-18 critique required: refusal turns on in a separate, later change than the wiring, because .ai/repo/policy.yaml sets edits_require_claim: true and a dozen concurrent sessions edit this repository, most without a live mesh claim. Split from I3300 by the 2026-10-18 verification. Governed by ADR 0214. Sources: chatgpt-majordomus:c174#18, chatgpt-majordomus:c193#1.

Current state

After I3322 the guard is wired and advisory; case 3069 proves the guard's judgement alone.

Desired state

An unclaimed Edit through the generated configuration is refused with the guard's message, and a claimed one passes.

Scope

• .ai/repo/policy.yaml

Out of scope

• Judging Bash-tool writes at edit time
• Wiring the guard (I3322)

Dependencies

• I3322○READY capture install wires the edit guard into Claude Code's PreToolUse, first in an advisory mode, and doctor reports it unwired

Acceptance criteria

• Refusal is enabled only with a dated claim-coverage report that shows no live unclaimed editor, cited in the change
• A case pipes a Claude Code PreToolUse payload through the command the generated .claude/settings.json names; it is refused for an unclaimed path and admitted for a claimed one
• The change is announced on the board and the mesh before it lands

Validation

• bash test/run.sh 3069_an_edit_no_claim_covers_is_refused
• majordomus plan validate

Evidence required

• case_an_unclaimed_edit_is_refused_through_the_generated_settings

Evidence

None recorded. Every token above needs a command or an artifact behind it before this issue can be completed; narrative is refused.

Timeline

started

—

verified

—

completed

—

Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.

Canonical record: .ai/repo/project/issues/I3323.yaml. Read it back with majordomus plan show I3323.