What & why

The v0.22.1 edge-case re-audit found two critical defects in the secret-redaction guard, plus remaining enforcement overclaims in the docs. This PR fixes exactly that scope.

CR-01 — PostToolUse redaction violated the structured-output contract. Built-in tools (Bash, Read, Grep, …) return structured objects, and Claude Code ignores an updatedToolOutput whose shape doesn't match the original — the redactor stringified objects, so its replacement was silently discarded and the unredacted, secret-bearing output stayed visible. The redactor now redacts recursively while preserving the value's exact structure: strings redacted in place, arrays/objects keep their keys, non-string leaves (numbers, booleans, null) pass through untouched, and an unchanged response emits no rewrite at all.

CR-02 — strict mode was a false promise, twice. (a) The shell wrapper ran node "$MJS" then unconditionally exit 0, erasing the strict-mode exit 2 before Claude ever saw it — it now propagates the child's exit status. (b) Comments and docs claimed FORGE_GUARD_STRICT=1 "makes degradation blocking" — PostToolUse fires after the tool already ran and cannot block; all wording now states exit 2 is surfaced stderr feedback, with blocking belonging to the PreToolUse guard.

ME-24 — honest positioning. README no longer claims "one brain for every AI coding agent", "enforced guardrails", or "every task passes a fast, deterministic gate"; automatic hooks are described as Claude Code-specific and advisory by default (enforcement opt-in via FORGE_ENFORCE=1), and guardrails as defence in depth, not a security sandbox. The GUIDE's FORGE_GUARD_STRICT row states the visibility-not-blocking semantics.

Checklist

• npm test passes (984 tests, 0 fail — 5 new: Bash-shaped object, Grep-shaped nested response, clean-object no-op, and two wrapper-level strict-mode tests driving the real secret-redact.sh)
• npm run check passes (Biome)
• New public functions have a test (redactValue covered via the guard's structured-response tests)
• Conventional commit message (security:)
• CHANGELOG.md updated under ## [Unreleased]
• No new runtime dependency
• Substrate/docs updated (GUIDE env-var table; forge docs check green)

Risk & rollback

• Risk level: low — the redactor's output for plain-string responses is byte-identical to before; the only behavioral changes are correct object-shaped replacements, a propagated exit status, and doc wording.
• Rollback plan: revert the single commit.

Extra checks (tick if applicable)

• npm run typecheck passes
• Input validated at boundaries; errors handled (degradation stays loud; no swallowing)
• Logs contain no secrets/PII (test literals built via test/_fixtures.js helpers)
• If AI-assisted: I understand it, verified the package APIs, and it has tests

🤖 Generated with Claude Code

https://claude.ai/code/session_01KfCEnSJzSG914yyVesjjD6

Generated by Claude Code