Function evaluate 

pub fn evaluate(
    spec: &HookGateSpec,
    tool_name: &str,
    file_path: Option<&str>,
) -> GuardVerdict

Judge one PreToolUse tool call against spec. file_path is the target path from the tool input (tool_input.file_path, or notebook_path on older CLIs’ NotebookEdit), as the CLI reported it — absolute, or relative to the session cwd.

Fail-CLOSED on every unjudgeable shape (no path, path outside the session checkout, broken touch-set glob): the projection exists to stop out-of-contract writes, and a write the guard cannot name is one the engine-side sweep could never attribute either. Blocking is recoverable — the CLI feeds the reason back to the model, which can relocate the write or surface the need for a touch-path grant.