[dotdevdotdev]

Rule groups + opt-in vendor packs. Closes #1141

What it does

• agentwire/safety/groups.py: every bundled rules/tooldefs file owned by exactly one group or pack (sweep test). Kernel (control-plane, core) always on; default groups (git, registry, agentwire, payloads, remote, mcp-tools, outbound) opt-out; packs (aws, gcp, firebase, cloud-hosting, databases, containers, infrastructure, publish) off until enabled.
• State in the protected host policy file under ~/.agentwire/ (packs:, disabled_groups:), comment-preserving writes.
• agentwire safety packs|groups list|status|enable|disable; mutations human-only (tty gate + PROTECTED_COMMAND_PATTERNS); MCP safety_packs_list / safety_groups_list read-only.
• Heal installs wanted files via the three-way baselines; removes a disabled entry's file only if pristine, never an edited one. Drift checks skip disabled entries.
• Surfaces: doctor (informational), agentwire init step, CLAUDE.md, agentwire role, skills, wiki. Agents suggest, never run.
• No deploy skew: hooks never read the state; "off" = not installed.

Review fixes

1. Migration loses no file. On an existing install with packs: absent, EVERY pack is enabled (not just those with files present); a fresh machine starts all-off. Test drops databases.yaml + both aws files from an old layout and asserts both packs come back whole.
2. Malformed policy file. read_state catches yaml.YAMLError; broken = most protective (everything on, nothing removed), never migrated or written over, enable|disable refuse, doctor reports [!!] does not parse.
3. Generic destructive ops moved to defaults. gh repo delete -> git.yaml (id now git.gh-repo-delete-deletes-repository); npm unpublish -> new default registry group, which also owns the npm.yaml tooldef (npm publish ask-tier) — previously that tooldef sat in the publish pack. Sweep of the other packs: everything left is vendor-specific (cloud/infra deletes + deploys, docker/kubectl, DB CLIs and migration runners, non-npm publish). Migration runners (alembic/manage.py/rails/prisma/...) are the one judgement call; left in databases.
4. Disabled group != typo. doctor and tasks review report grants from a disabled group as "group 'git' disabled" (lint.split_missing_ids).

Re-review fixes

• Tooldef grant ids (tooldef.uv-run-...) are attributed to their owning tooldef file/group, so a disabled group reads as "group disabled", not a typo or [!!].
• uv is its own default group (opting out of git keeps uv-run ask coverage).
• Onboarding steps renumbered (tmux is now 5).
• Migration-runner binaries (prisma, rails, alembic, flyway, knex, sequelize) added to the databases pack so doctor/init suggest it. Block-tier prisma migrate reset / flyway clean stay in the pack: moving them would split the vendor-CLI boundary (dropdb/FLUSHALL sit beside them).

Verification

• Full fast suite: 5971 passed; ruff clean; baselines + hooks regenerated after rebase onto main.
• Mutation-checked, each goes red: migration scope, YAMLError catch, broken-file write guard, gh repo delete / npm unpublish rules, disabled-group classification, plus earlier edited-file removal, kernel guard, tty gate, protected pattern.
• Not verifiable pre-merge: live agentwire rebuild + safety install --yes.

Built by dotdev.dev