drscrewdriver/dsh-perm-gate

Shipped with cc-safety-net-style mechanical safety-net rules appended; supports both no-model and model-assisted security review, in modes such as (auto-review) and (mechanical pass-through). P0–P4 deterministic-first permission gate with permissive tier, learning sedimentation and approval-history UI; hard-deny credentials and protected paths, auto-allow internal read-only tools.