Approval Checkpoints and Risk Classification

function routeCall(call) {
  const command = parseCommand(call.args.command)

  if (BLOCKLIST.matches(command)) return "block"
  if (ALLOWLIST.matches(command)) return "run"

  const risk = rateRisk(command)                 // How hard to undo, and how far it reaches
  return RISK_MATRIX[risk.undo][risk.reach]      // "run", "report", or "stop"
}

This function decides whether Forge's next command runs at once, runs and is reported, waits for an engineer, or never runs. Forge has one tool for running commands, yet npm test and `git push --force origin main