tests:
  # ════════════════════════════════════════════════════════════════
  # gh (GitHub CLI): read-only invocations allowed
  # ════════════════════════════════════════════════════════════════
  # Positive tests (should allow)
  - id: gh-pr-list-safe
    command: "gh pr list"
    expected:
      decision: allow
  - id: gh-pr-view-safe
    command: "gh pr view 123"
    expected:
      decision: allow
  - id: gh-pr-status-safe
    command: "gh pr status"
    expected:
      decision: allow
  - id: gh-pr-diff-safe
    command: "gh pr diff 123"
    expected:
      decision: allow
  - id: gh-pr-checks-safe
    command: "gh pr checks 123"
    expected:
      decision: allow
  - id: gh-issue-list-safe
    command: "gh issue list"
    expected:
      decision: allow
  - id: gh-issue-view-safe
    command: "gh issue view 42"
    expected:
      decision: allow
  - id: gh-issue-status-safe
    command: "gh issue status"
    expected:
      decision: allow
  - id: gh-repo-list-safe
    command: "gh repo list"
    expected:
      decision: allow
  - id: gh-repo-view-safe
    command: "gh repo view"
    expected:
      decision: allow
  - id: gh-auth-status-safe
    command: "gh auth status"
    expected:
      decision: allow
  - id: gh-version-safe
    command: "gh --version"
    expected:
      decision: allow
  - id: gh-help-safe
    command: "gh --help"
    expected:
      decision: allow
  - id: gh-help-short-safe
    command: "gh -h"
    expected:
      decision: allow
  # gh run and workflow commands (should allow)
  - id: gh-run-list-safe
    command: "gh run list"
    expected:
      decision: allow
  - id: gh-run-list-repo-safe
    command: "gh run list --repo owner/repo"
    expected:
      decision: allow
  - id: gh-run-view-safe
    command: "gh run view 123"
    expected:
      decision: allow
  - id: gh-run-view-log-safe
    command: "gh run view 123 --log"
    expected:
      decision: allow
  - id: gh-run-watch-safe
    command: "gh run watch 123"
    expected:
      decision: allow
  - id: gh-workflow-list-safe
    command: "gh workflow list"
    expected:
      decision: allow
  - id: gh-workflow-view-safe
    command: "gh workflow view CI"
    expected:
      decision: allow
  # gh api operations (requires full trust - remote API access)
  - id: gh-api-bare-safe
    command: "gh api"
    expected:
      decision: ask
    note: "no endpoint — classifier Step 0 rejects, falls through to allowlist (trust:full → ask)"
  - id: gh-api-read-safe
    command: "gh api repos/owner/repo"
    expected:
      decision: allow
      rule_id: gh-readonly-classifier
    note: "R7: classifier auto-allows read-only gh api GET with endpoint"
  - id: gh-api-contents-safe
    command: "gh api repos/owner/repo/contents"
    expected:
      decision: allow
      rule_id: gh-readonly-classifier
    note: "R7: classifier auto-allows read-only gh api GET with endpoint"
  - id: gh-api-jq-safe
    command: "gh api repos/owner/repo --jq '.name'"
    expected:
      decision: allow
      rule_id: gh-readonly-classifier
    note: "R7: classifier auto-allows read-only gh api GET with endpoint"

  # Remote-write operations (should ask at standard trust, require full trust)
  - id: gh-bare-ask
    command: "gh"
    expected:
      decision: ask
  # ── gh pr remote-write ──────────────────────────────────────────
  - id: gh-pr-create-ask
    command: "gh pr create"
    expected:
      decision: ask
  - id: gh-pr-merge-ask
    command: "gh pr merge 123"
    expected:
      decision: ask
  - id: gh-pr-close-ask
    command: "gh pr close 123"
    expected:
      decision: ask
  - id: gh-pr-reopen-ask
    command: "gh pr reopen 123"
    expected:
      decision: ask
  - id: gh-pr-comment-ask
    command: "gh pr comment 123 --body 'LGTM'"
    expected:
      decision: ask
  - id: gh-pr-review-ask
    command: "gh pr review 123 --approve"
    expected:
      decision: ask
  - id: gh-pr-edit-ask
    command: "gh pr edit 123 --title 'New title'"
    expected:
      decision: ask
  - id: gh-pr-ready-ask
    command: "gh pr ready 123"
    expected:
      decision: ask
  # ── gh issue remote-write ───────────────────────────────────────
  - id: gh-issue-create-ask
    command: "gh issue create"
    expected:
      decision: ask
  - id: gh-issue-close-ask
    command: "gh issue close 42"
    expected:
      decision: ask
  - id: gh-issue-reopen-ask
    command: "gh issue reopen 42"
    expected:
      decision: ask
  - id: gh-issue-comment-ask
    command: "gh issue comment 42 --body 'Fixed'"
    expected:
      decision: ask
  - id: gh-issue-edit-ask
    command: "gh issue edit 42 --title 'Updated'"
    expected:
      decision: ask
  - id: gh-issue-delete-ask
    command: "gh issue delete 42"
    expected:
      decision: ask
  # ── gh release remote-write ─────────────────────────────────────
  - id: gh-release-create-ask
    command: "gh release create v1.0.0"
    expected:
      decision: ask
  - id: gh-release-delete-ask
    command: "gh release delete v1.0.0"
    expected:
      decision: ask
  - id: gh-release-edit-ask
    command: "gh release edit v1.0.0 --notes 'Updated'"
    expected:
      decision: ask
  # ── gh repo remote-write ────────────────────────────────────────
  - id: gh-repo-create-ask
    command: "gh repo create myrepo"
    expected:
      decision: ask
  - id: gh-repo-delete-ask
    command: "gh repo delete myrepo"
    expected:
      decision: ask
  - id: gh-repo-edit-ask
    command: "gh repo edit --description 'New desc'"
    expected:
      decision: ask
  - id: gh-repo-fork-ask
    command: "gh repo fork owner/repo"
    expected:
      decision: ask
  # ── gh label remote-write ───────────────────────────────────────
  - id: gh-label-create-ask
    command: "gh label create bug"
    expected:
      decision: ask
  - id: gh-label-edit-ask
    command: "gh label edit bug --name bugfix"
    expected:
      decision: ask
  - id: gh-label-delete-ask
    command: "gh label delete bug"
    expected:
      decision: ask
  # ── gh run/workflow remote-write ────────────────────────────────
  - id: gh-run-rerun-ask
    command: "gh run rerun 123"
    expected:
      decision: ask
  - id: gh-run-cancel-ask
    command: "gh run cancel 123"
    expected:
      decision: ask
  - id: gh-workflow-run-ask
    command: "gh workflow run deploy.yml"
    expected:
      decision: ask
  - id: gh-workflow-enable-ask
    command: "gh workflow enable deploy.yml"
    expected:
      decision: ask
  - id: gh-workflow-disable-ask
    command: "gh workflow disable deploy.yml"
    expected:
      decision: ask
  # gh api mutating operations (should ask - caught by rule)
  - id: gh-api-post-ask
    command: "gh api repos/owner/repo -X POST"
    expected:
      decision: ask
  - id: gh-api-method-post-ask
    command: "gh api repos/owner/repo --method POST"
    expected:
      decision: ask
  - id: gh-api-delete-ask
    command: "gh api repos/owner/repo -X DELETE"
    expected:
      decision: ask
  - id: gh-api-patch-ask
    command: "gh api repos/owner/repo --method PATCH"
    expected:
      decision: ask
  - id: gh-api-put-ask
    command: "gh api repos/owner/repo -X PUT"
    expected:
      decision: ask
  - id: gh-auth-login-ask
    command: "gh auth login"
    expected:
      decision: ask
  - id: gh-unknown-ask
    command: "gh unknown-command"
    expected:
      decision: ask
