prefix_rule(
    pattern = ["git", "status"],
    decision = "allow",
    justification = "Read-only git status is required for harness workspace checks.",
)

prefix_rule(
    pattern = ["git", "diff"],
    decision = "allow",
    justification = "Read-only diff inspection is required before verification and delivery.",
)

prefix_rule(
    pattern = ["git", "log"],
    decision = "allow",
    justification = "Read-only commit history inspection is safe for context gathering.",
)

prefix_rule(
    pattern = ["git", "show"],
    decision = "allow",
    justification = "Read-only object inspection is safe for review and evidence gathering.",
)

prefix_rule(
    pattern = ["git", "add"],
    decision = "prompt",
    justification = "Staging changes must be scoped to the current harness task.",
)

prefix_rule(
    pattern = ["git", "commit"],
    decision = "prompt",
    justification = "Commits require fresh verification and ownership checks.",
)

prefix_rule(
    pattern = ["git", "push"],
    decision = "prompt",
    justification = "Pushing changes affects a remote repository and requires explicit intent.",
)
