Function opencode_default_policy 

pub fn opencode_default_policy() -> Translated

opencode’s documented DEFAULT policy (oc§4 “Default policy”: {"*": allow} with carve-outs doom_loop: ask, external_directory: ask, question: deny, plan_enter/plan_exit: deny, read {*.env: ask, *.env.*: ask, *.env.example: allow}), rendered into this engine’s pattern syntax and run through translate_last_match_to_first_match — the worked example design §4.4 specifies and this build reproduces.

Two of oc’s five carve-outs are deliberately EXCLUDED from the rule list itself (§4.4’s own text, reproduced here as the three named deviations):

1. doom_loop: ask is not a rule-language pattern at all — it’s a repetition TRIGGER (same call repeated), not a tool/path match. Routed to its real mechanism instead: Config::doom_loop_threshold (the P4 doom-loop breaker). No rule entry; a warning names the routing decision explicitly (never silently dropped).
2. external_directory: ask is an oc PERMISSION CATEGORY (any tool touching paths outside the worktree), not a tool name. Routed to its real mechanism: Config::additional_dirs — paths outside cwd and outside additional_dirs are simply unreachable, a stricter (not equivalent) reading. No rule entry; a warning names the routing decision.
3. .env.example → ASK, not ALLOW — this one DOES fall out of the generic algorithm above (a genuine, detected, safe-direction fixed- point divergence): under first-match deny→ask→allow, a read of .env.example matches the ask-rule read(*.env.*) BEFORE the allow list ("*") is ever consulted, so it asks where stock opencode allows. Recorded by translate_last_match_to_first_match’s own warning, not hidden.