dsh-preclaim

Configuration

- insert:
    - id: preclaim
      name: dsh-preclaim
      config:
        triggerTools: [pwsh, bash, write, edit, str_replace_editor]
        readmeGlobs: ['README*', 'CHANGELOG*', 'docs/**/*.md', '**/README.md']
        decision: review      # review | deny
        audit: true
        ledgerLimit: 500
        pushMessageLimit: 20

There is deliberately no configuration value that lets an unbacked claim through. decision chooses between asking and refusing, and nothing else — a gate with an off switch is a gate that gets switched off. resolveConfig throws on decision: allow.

pushMessageLimit caps how many commit messages a push is checked against, so the cost does not grow with repository age. The cap is reported when it bites, because a silently truncated check reads as a complete one.