Scenario 3: narrow colon-style npm permission

[pengfei-threemoonslab]

Synthetic fixture PR (scenario 3, narrowing). The base branch s3-base-colon allows Bash(npm:*); this PR narrows it to Bash(npm test:*). Used only to exercise the agents-shipgate v1.1.0 host-only advisory Action.

[github-actions]

Agents Shipgate

Human summary

Repository-declared host capability changes:

• medium / narrowed — claude-code .claude/settings.json
allow: Bash(npm:*) → allow: Bash(npm test:*)
the new rule matches only what the old rule matched; runs without a prompt

What this run established:

• only sources this entry read or tried to read are listed, so this is not the whole change: a changed file it does not read is absent
• .claude/settings.json (claude-code): compared; 2 rows
• compared with no change in what this entry reads: .github/workflows/shipgate.yml, .mcp.json

Review question: Does the team intend this declared capability change (from 2 rows)?
Compared: base cb84442 → head 47c2d71, agents-shipgate 1.1.0.
Reproduce: check out 47c2d71, then run agents-shipgate diff --base cb8444277972776ddae94b7f8917255c6473a7b6
Advisory: no application release policy configured. This comparison grants no merge authority.
Evidence: verifier.json contains the compared commits, source paths and inventory digests.

Agent instruction block

{
  "agent_handoff": "agents-shipgate-reports/agent-handoff.json",
  "can_merge_without_human": false,
  "control": {
    "allowed_next_commands": [
      "agents-shipgate audit --host --workspace /home/runner/work/agents-shipgate-hosted-fixture/agents-shipgate-hosted-fixture --json"
    ],
    "completion_allowed": false,
    "human_review": {
      "required": false,
      "required_reviewers": [],
      "why": null
    },
    "must_stop": false,
    "next_action": {
      "actor": "coding_agent",
      "command": "agents-shipgate audit --host --workspace /home/runner/work/agents-shipgate-hosted-fixture/agents-shipgate-hosted-fixture --json",
      "expects": null,
      "kind": "discover",
      "why": "Read the repository-declared host inventory and its coverage limits; no manifest or baseline is required."
    },
    "permissions": {
      "commit": false,
      "edit": false,
      "merge": false,
      "push": false,
      "report_complete": false,
      "update_pr": false
    },
    "reason": "2 repository-declared host capability change(s). Advisory comparison only; no application release policy configured.",
    "state": "agent_action_required",
    "stop_reason": null,
    "verify_required": true
  },
  "fix_task": null,
  "merge_verdict": "unknown",
  "verification_command": null
}

Workflow artifacts: https://github.com/ThreeMoonsLab/agents-shipgate-hosted-fixture/actions/runs/35774377665