The session is started with --permission-mode dontAsk and one --allow
or --deny per rule. Bash(cmd:*) was checked on this machine. Checkout
and a PowerShell prefix cover the loop prompt; pushes to main, staging,
and branch deletes stay denied.
Names are the runner text after "not ok N - " from npm run test:db
on this machine: 80 tests, 67 pass, 13 fail, cancelled 0.
grok-permissions.json already matches Bash(cmd:*) and is unchanged.
jesse-ux