Semantic brake for --auto

What it does

In a session that answers permission requests automatically (--auto, --yolo), scores each call before it is answered and withholds the automatic allow for a call scored irreversible or reaching outside the project: an interactive session shows the dialog, a headless run refuses with a reason. It guards against slips; it is not a security boundary.

Source

Outside beads: one of four proposals for using Jev judgments in ganja, carried into the map by its destination (#33, #34, #35).

File and line references in this issue are to main as of 75a7a92.

Against the three criteria

• Direction (README): The README does not mention Jev. The nearest passage is the isolation bullet's "blast radius of a poisoned prompt or a bad tool call" (README.md:23-27).
• Today's terminal users: A user who runs bypassed sessions keeps the speed of automatic answers and gets a dialog for the few calls that could not be taken back. A false positive costs a dialog that would have appeared anyway, except in a headless run, where it can stop unattended work.
• Evidence: Accuracy is unmeasured; measuring it is part of the work.

Depends on

Blocked by the judge seam and the [evaluate] table of #59. It touches three places: the ask arm (crates/ganja-core/src/session.rs:4843), the bypass answer (crates/ganja-core/src/engine.rs:525-579, where a bypassed session answers every permission request with allow), and the frontends' own answers.

Verdict

• Verdict: do
• Size: M — one plan and one decision number, a few waves.
• Exception to the probe rule: yes. #36 says an idea that needs a measurement or a probe first is not do; this one is an explicit exception: measuring accuracy is part of the work.
• Date: 2026-09-19
• Verdict ticket: #47

Theme: #50

Start with the judge seam and [evaluate] table from #59, then inspect the ask arm in crates/ganja-core/src/session.rs:4843, the bypass answer in crates/ganja-core/src/engine.rs:525-579, and the frontends' answers. Implement scoring before automatic permission allows, showing a dialog for interactive irreversible or out-of-project calls and refusing headless calls with a reason. Measure accuracy as part of validating the behavior.