Establish native blocking approval parity for Goose, or retain event-only status #280

Decision

Retain Goose as a non-certified, native blocking, deny-only adapter. It must not claim full v1 approval parity while Goose has no documented edited-input response.

Current state

Goose >= 1.35.0 provides a native PreToolUse denial boundary; it is not a notify-only event bridge. Onibi already provides:

• managed install/uninstall that preserves unrelated user hook groups;
• idempotent reinstall and managed-hook drift reporting;
• a local deny-block fixture; and
• a secret-gated TestLiveGooseDeny that records a redacted authenticated artifact.

An edited approval is denied because Goose has no documented input-replacement response. Do not add a wrapper that implies edit support or generic certified parity.

Remaining evidence

1. Run TestLiveGooseDeny against an authenticated Goose provider/model with its explicit opt-in environment variables.
2. Review the redacted artifact and installed provider version against the documented >= 1.35.0 floor.
3. Keep onibi adapters --json, hooks --show, doctor, and documentation exact about deny-only, non-certified behavior.

Promotion gate

Do not certify Goose as a full v1 adapter without a documented native edited-input mechanism, local contract coverage, authenticated live evidence, and review. Until then, retain the native blocking deny-only integration.