release: v2.67.0 — the Discipline tab grows search, evidence, and controls

[drknowhow]

v2.66 shipped the knob; this ships the workbench around it. Most of what landed was capability the backend already had and no surface exposed: the raw denial-event log had a public reader nothing called, the policy layer accepted scope=global that no route passed, signal_ttl_s and blocked_tools were resolved and validated but had no write surface.

Hub Discipline tab

• Search / filter / sort — free-text over name/path/mode/tier (/ focuses), chips for Strict / Advisory / Off / Has denials / Attention (warnings + unreadable + tier drift), sort by name/denials/mode. 5s poll (like Locks) that never fires while typing or with a dialog open.
• Raw denial-event search in each expanded card — AND-substring over path/rule/tool, layer chips, click a session id to filter to it, all events to browse newest-first. Aggregate rows now show last-hit recency + session counts (already sent by the server, never rendered).
• Global default card for ~/.c3 — mode picker + TTL editor, honest NOT SET state.
• TTL + blocked-tools editors per project, enabled only when the policy is actually project-scoped; inherited policies explain why they are disabled instead of shadowing the inheritance.
• Bulk apply — checkbox select + sticky bar, one confirm, per-project audit, failures named.
• Drill panel Discipline tab — project names now open the drill there (full 12-row aggregate + event search) instead of dropping on Overview.

Backend

• enforcement_policy.set_fields — mode-less partial writes that never touch mode/set_by and refuse to create an enforcement section (a mode-less section coerces to strict and would shadow an inherited mode). set_mode gains blocked_tools + write-time ttl validation (30..86400 → 400).
• access_telemetry.search_events backing GET /api/enforcement/denials/search (project) and GET /api/projects/enforcement/denials/search (hub); includes the rotated .jsonl.1; matched keeps counting past the cap so truncation is visible.
• POST /api/projects/enforcement body is now {path?, scope?, mode?, signal_ttl_s?, blocked_tools?}; project scope keeps its old contract exactly. New GET /api/projects/enforcement mirror feeds the drill tab; aggregates accept ?session=.
• Fix: enforce was missing from the hub main_view whitelist — the Discipline tab silently never persisted as the active view (client swallows the 400). Pinned by a test mirroring the Locks one.

Verification

• 42 new tests; enforcement suites 132 green; full run 1926 passed, 3 skipped.
• New JSX parse-checked with esbuild; asset-marker tests assert the new components are actually in the served bundle.
• docs/enforcement.md updated (config reference, Hub section, telemetry search).

Deferred (evaluated, not in this release): outcome telemetry (advisory-nudge/allow logging for an effectiveness view — hot hook path, 10-100x event volume) and NotebookEdit governance (the discipline hook does not govern it at all today — enforcement-semantics change with its own tests).

Release: after merge, tag v2.67.0 on the merge commit → release.yml gates on CI, builds, publishes to PyPI via trusted publishing, and attaches the GitHub release. pyproject.toml and cli/c3.py are both bumped to 2.67.0 (the workflow verifies tag == package version).

https://claude.ai/code/session_01NYoHjKBW6UjTqjwzPRojEt