amont-agent 2.17.0

A guard that inspects a shell command before Claude Code runs it
# amont-agent-cases-v1
# Reviewed judgements for this rule. Generated by
#   amont-agent explain <rule> --format cases
# then labelled by hand. `amont-agent corpus check` replays every line through
# the rules as they stand today, and runs as a test — so widening a rule in a
# way that breaks a judgement somebody already made is a red build.
#
# match   the rule SHOULD fire here
# nomatch the rule must stay silent here — these are the ones that matter,
#         because a corpus of positives alone measures recall, not precision
# ?       nobody has looked yet; never counts as evidence

# --- the rule should fire (from real transcripts) ---
match	kubectl apply -f kubernetes/homelab/apps/trade-agents/daily-pipeline.yaml
match	export KUBECONFIG=/Users/fredericrous/Developer/Perso/homelab/infrastructure/homelab/kubeconfig.yaml; kubectl -n trade-agents delete deployment ibkr-ingester
match	kubectl -n keda scale deploy runner --replicas=0
match	kubectl patch kustomization apps -n flux-system --type merge -p '{"spec":{"suspend":true}}'
match	cat manifest.yaml | kubectl apply -f -
match	kubectl --context=cloud create namespace stalwart
match	kubectl -n forgejo create secret generic runner-token --from-literal=token=x

# --- the rule must stay silent ---
nomatch	kubectl -n trade-agents get pods --no-headers 2>&1 | grep ibkr
nomatch	kubectl delete pod x --wait=false; kubectl get pods | head
nomatch	kubectl apply --dry-run=client -f x.yaml 2>&1 | tail -20
nomatch	kubectl -n velero logs deploy/velero --since=30m 2>&1 | tail -40
nomatch	kubectl rollout restart deploy/stremio-server -n stremio
nomatch	kubectl -n ci delete job runner-123
nomatch	kubectl get kustomizations -A 2>/dev/null | grep -i trade
nomatch	flux reconcile kustomization apps --with-source
nomatch	kubectl -n forgejo exec forgejo-7d9c4cdc5-2bjcv -- sh -c 'rm -f /tmp/.ct'