Safety controlEvidence
Repository mappings
Map hook scope to known repositories without scanning secrets, sessions, or arbitrary workspace content.
Repository mappings — contract and behavior
- Mappings come from explicit metadata and identify where a hook policy applies.
- The app reads descriptors and status files, not source trees, secret files, or transcripts.
- A missing repository mapping is surfaced as unknown scope rather than inferred from folder names.
- Path display avoids exposing more local filesystem detail than the operator needs.