---
name: project-step1392-4d-sw-hook-expansion-2026-08-23
description: STEP 1369 Phase 12 - 4D 拡張 SW hook 5 種 (npm/pip/docker/db/cloud-api) = 5A pathway hook 4→9 種完成、STEP 1388 pattern 継承
metadata: 
  node_type: memory
  type: project
  originSessionId: 3acd3853-c124-47b1-974e-9d8c55c72877
  modified: 2026-08-23T02:20:15.264Z
---

# STEP 1392 — 4D 拡張 SW hook 5 種 (STEP 1369 Phase 12, 2026-08-23)

## 契機
- STEP 1391 close report で 次候補 (1) 4D 拡張 SW hook (npm/pip/docker/db/cloud API hook、 STEP 1388 pattern 継承)
- 藤本さん directive: 「1. 4D 拡張 SW hook (npm/pip/docker/db/cloud API hook、 STEP 1388 pattern 継承) でお願い致します」

## 実装 - 5 new wrappers (`scripts/oughtctl/hooks/`)

### 1. npm-wrapper.py (Python stdlib + _common.py 継承)
- IRR patterns 1-token: install/i/add/uninstall/remove/rm/un/unlink/publish/unpublish/deprecate/link/ci
- IRR patterns 2-token: audit fix / dedupe
- Readonly pass-through: list/ls/outdated/view/info/search/whoami/version/help/run <script>/test/start/build
- self-recursion 予防: `find_npm_binary()` + `OUGHTCTL_NPM_BIN` override
- action="publish" (package modification + registry side-effect の 統一 domain)

### 2. pip-wrapper.py
- IRR patterns 1-token: install/uninstall/download/wheel
- IRR patterns 2-token: config set/config unset/config edit
- Readonly pass-through: list/show/freeze/check/search/--help/--version/-V
- action="publish" (同上 domain)

### 3. docker-wrapper.py
- IRR patterns 1-token: rm/rmi/kill/stop/push
- IRR patterns 2-token: image rm/prune/remove, container rm/prune/kill/stop, volume rm/prune, network rm/prune, system prune, builder prune, buildx prune
- Readonly pass-through: ps/images/logs/inspect/stats/history/search/info/version/pull/build/run (v0.1 spike scope、 pull は state-changing but idempotent、 build は user-scoped)
- action="delete" for local destroy、 action="publish" for docker push (registry side-effect)

### 4. db-wrapper.py (multi-tool)
- **Alembic** (Python SQLAlchemy): IRR = upgrade/downgrade/stamp/merge / readonly = history/current/heads/branches
- **Django manage.py / django-admin**: IRR = migrate/flush/loaddata/makemigrations / readonly = shell/showmigrations/等
- **Prisma**: IRR = migrate deploy/reset/dev + db push/execute / readonly = migrate status/validate
- **Raw SQL** (psql/mysql/sqlite3/mariadb/cockroach): -c/-e/--command/--execute flag 内 SQL 文 scan
  - Regex: `^\s*(DELETE|DROP|TRUNCATE|ALTER|UPDATE|CREATE|GRANT|REVOKE|RENAME)\b` (case-insensitive)
  - Multi-statement 対応: `;` split + 各 stmt check
- **sql-scan mode** (diagnostic, no exec): `python db-wrapper.py sql-scan "<SQL>"` = 危険 stmt 列挙 (destructive→exit 2, safe→exit 0)
- action="delete" (destructive DB ops)

### 5. cloud-api-wrapper.py (3 provider unified)
- Invocation: `python cloud-api-wrapper.py {aws|gcloud|az} <args...>` (per-provider alias)
- **AWS 22 destructive patterns**: s3 rm/rb/mv, s3api delete-*, ec2 terminate-instances/delete-vpc/subnet/security-group/volume/snapshot, rds delete-db-instance/cluster/snapshot, iam delete-user/role/policy + detach-*, lambda delete-function, cloudformation delete-stack, dynamodb delete-table/item, sqs delete-queue/message-batch, sns delete-topic, logs delete-log-group
- **GCP 12 destructive**: compute instances delete/stop, compute disks delete, sql instances delete, storage rm/rb, container clusters delete, functions delete, iam service-accounts delete, projects delete, run services delete, secrets delete, pubsub topics/subscriptions delete
- **Azure 12 destructive**: vm delete/deallocate, storage account/blob/container delete, sql db/server delete, group delete (⚠ resource-group 全削除), functionapp/webapp delete, aks delete, keyvault delete + secret delete, network vnet/nsg delete, resource delete
- OUGHTCTL_CLOUD_{AWS|GCLOUD|AZ}_BIN env で override 対応
- action="delete"

### install.py update
- --install choices: pre-push/gh/rm/scpi + **npm/pip/docker/db/cloud** + all
- `print_shell_alias()` を dict-driven に refactor (wrapper_map dict + special cases for cloud multi-provider + db explicit dbsafe)
- `--install cloud` は 3 alias (aws/gcloud/az) 提案、 `--install db` は dbsafe 単一 alias

### README.md update
- Section 「9 hook + 共通 library」 = STEP 1388 core 4 + STEP 1392 拡張 5 の 2 部構成 table
- Test section: 58 (STEP 1388) + 133 (STEP 1392) = 191 累計
- Installation section: npm/pip/docker + db-wrapper (dbsafe explicit) + cloud-api (3 provider alias) 追加

## Verify

### test_new_wrappers.py = 133/133 PASS
- npm 4 blocks: readonly (12 case) + install irrev (9) + publish irrev (4) + audit fix (2)
- pip 3 blocks: readonly (7) + install irrev (6) + config set (2)
- docker 3 blocks: readonly (12) + 1-token destructive (5) + 2-token destructive (10)
- db 7 blocks: alembic (3) + django (3) + prisma (5) + SQL scan destructive (8 stmt) + SQL scan readonly (5) + psql -c dispatch (3) + multi-stmt (1)
- cloud 6 blocks: aws readonly (6) + aws destructive (8) + gcloud destructive (6) + gcloud readonly (4) + az destructive (5) + az readonly (4)

### STEP 1388 regression = 58/58 保持 (test_hooks.py 全 PASS 変化なし)

### 累計 pathway hook test coverage: 191 assertion

### Site + deploy
- md5 `adb3b5c467efbab9733d6c19fe0d3f04`、 894 行 (前 890 +4)
- commit `6f9267bcd` push (51815c508..6f9267bcd)、 10 files/1106+/23-
  - 2 M site + 2 M (README + install.py) + 6 A (5 wrapper + test_new_wrappers.py)
- CF Pages deploy 112,254 bytes、 HTTP 200
- Phase 12 marker (STEP 1392/Phase 12/npm-wrapper/pip-wrapper/docker-wrapper/db-wrapper/cloud-api-wrapper/test 133/4→9/46 destructive): 6 hits

## 5A pathway hook coverage 状態

| Hook | STEP | Domain | Approval action | Test |
|------|------|--------|-----------------|------|
| pre-push | 1388 | git remote push | push | 6+ |
| gh-wrapper | 1388 | GitHub CLI (release/pr merge/etc) | publish | 3 |
| scpi_proxy | 1388 | SCPI hardware actuator | hardware | 5 |
| rm-safe | 1388 | filesystem delete | delete | 5 |
| **npm-wrapper** | **1392** | Node.js package | publish | ~15 (4 blocks) |
| **pip-wrapper** | **1392** | Python package | publish | ~15 (3 blocks) |
| **docker-wrapper** | **1392** | container/image/volume/network | delete/publish | ~27 (3 blocks) |
| **db-wrapper** | **1392** | Alembic/Django/Prisma/psql/mysql/sqlite3 | delete | ~28 (7 blocks) |
| **cloud-api-wrapper** | **1392** | AWS/GCP/Azure | delete | ~33 (6 blocks) |

**9 hook 全 domain**: git-remote (2) + CI/CD-hosting (gh) + hardware-actuator (scpi) + filesystem-delete (rm) + package-manager (npm+pip) + container-orch (docker) + DB-migration (db) + cloud-infra (aws/gcloud/az 3-in-1)

## 4D 導入禁止 解除 gate 状態 (最新)

- **SW side (5A pathway hook)**: **coverage 完成**、 4→9 種 拡張 ✓
  - CI/CD + package management + container + DB migration + cloud infra 全 domain 対応
  - 191 test coverage
- **HW side (実 4D hardware)**: **依然 blocker** (Kikusui PLZ-5W / Zaber ステージ / Peltier / E-stop / interlock 未取得、 藤本さん judgment + 予算 stance 待ち)

## SAC-4 47 教訓 Phase 3-12 10 連続 clean 成功

Phase 3-12 = **10 連続 clean commit**、 全 pre-staged 0 件 confirm 後 明示 file add、 sweep-in 一切なし
- Phase 3=252+, 4=264+, 5=468+, 6=1391+, 7=1440+, 8=1266+, 9=797+, 10=942+, 11=1102+, 12=1106+
- 他タブ push 競合は Phase 4+8+11 で 各 1 度 → rebase 綺麗 integrate、 7 Phase は 競合なし
- **10 連続 clean = SAC-4 47 pattern の 定着 evidence**

## Honest scope

1. **classification heuristic のみ** = npm/pip/docker/db/cloud 各 CLI の pattern list は 網羅性 未検証、 false-negative 予防のため 「不明時は 保守的に readonly 扱い」 default (誤 pass-through は sweep-in 予防できないため trade-off、 v0.2 で strict mode 追加 candidate)
2. **npm/pip/docker の pass-through 判定**: pull/build/run は state-changing but 「local + idempotent + user-scoped」 の理由で v0.1 は readonly 扱い、 実運用で 予期せぬ side-effect が出た場合 v0.2 で 昇格 candidate
3. **db-wrapper SQL scan は naive `;` split**: 文字列内 semicolon (e.g. `'DELETE'`) は 誤検出可、 v0.2 で sqlglot 等 proper parser 候補 (但し stdlib only discipline 崩す trade-off)
4. **cloud-api-wrapper**: pattern list は AWS/GCP/Azure の 主要 destructive のみ、 IAM policy update / config change 等 semi-destructive は 未装備 (v0.2 candidate)
5. **db-wrapper psql/mysql インタラクティブ mode** (`-c` flag なし interactive session) は scan 不能、 v0.1 は pass-through (user が interactive で DELETE 打つ場合は gate 効かない、 別 arc: pty wrapping 検討)
6. **self-recursion 予防** は 各 wrapper で `find_*_binary()` + wrapper_dir exclude、 PATH に wrapper dir が 先頭にある場合 でも 安全、 但し symlinked binary の場合の 検出は 未装備
7. **git-bash on Windows** で 動作前提、 PowerShell direct execution は subprocess.call の 挙動が 若干異なる可能性 (v0.1 spike scope 内では 未 verify)
8. **test 133 assertion は unit test のみ** = 実 CLI 呼び出しの end-to-end は 未 (実 npm install / docker rm / aws s3 rm 等の 実運用 pilot は 別 arc)
9. **cloud-api の 3 provider unified wrapper** = 各 CLI の 独自 flag (aws --profile / gcloud --project / az --subscription) は subprocess 経由で pass-through、 wrapper 側で 検証しない
10. **db-wrapper の `sql-scan` diagnostic mode** = destructive SQL の 事前 audit 用途、 実 execute には 使わない (subprocess exec なし)

## Deferred (継続)

1. **HW side 4D hardware 取得** (Kikusui PLZ-5W ~¥数十万 + 周辺、 藤本さん judgment)
2. **実運用 pilot** (git pre-push installed + npm alias set + rm alias set + scpi 実 benchtop stack 統合)
3. **TOCTOU race condition 対策** (approval check → 実 action の 間 の 状態変化 検出)
4. **post-action verify hook** (git push 失敗時 rollback、 gh CLI 非zero exit rollback)
5. **bypass audit periodic review protocol** (STEP 1388 継承 defer)
6. **5C 限界機械 → 6 橋機械 実 wire** (discovery-worker STEP 1382 上流に 5C 挿入)
7. **5D 意味機械 → 4A drift baseline 実 wire** (--drift-check flag、 4C ⟷ 5D pattern と 同型)
8. **統計 4 primitive covariates-aware 化** (STEP 1389 4B covariates + STEP 1350/1371/1376/1379 integration)
9. **ProvenanceRecord schema 拡張** (STEP 1345 benchtop_provenance.py の software + hardware 両対応)
10. **npm/pip/docker/db/cloud wrapper の 実 CLI end-to-end pilot** (実 npm install + docker rm + aws s3 rm 等の 実運用 verify)
11. **v0.2 拡張** (npm/pip/docker で pull/build/run の 昇格判断、 sql parser proper、 cloud IAM policy update 検出、 interactive psql pty wrapping)

## 関連

- [[project-step1391-4C-pc-side-stamp-and-5D-integration-2026-08-23]] Phase 11 直前 (metadata 3 側面 統合 第 1 実 wire)
- [[project-step1388-5A-pathway-hook-integration-2026-08-23]] Phase 8 (5A pathway hook 4 種 origin、 本 STEP は 5 種 拡張 = 4→9)
- [[project-step1386-five-arc-sequential-execution-2026-08-23]] Phase 6 (5A oughtctl core origin)
- [[project-step1383-four-physical-auxiliary-machines-2026-08-23]] 4D 導入禁止 discipline origin
- [[feedback-peace-axiom-hardware-io-extension-2026-08-17]] 4D 安全 discipline origin
- [[feedback-super-naming-siren-family-pattern]] 「pattern list は 網羅ではない、 保守的 default」 継承
- [[feedback-projection-self-audit-pattern]] SAC-4 47 教訓 Phase 3-12 10 連続 clean 成功
- [[feedback-no-rush-publication]] 「命名 → v0.1 spike → 実 pipeline 統合」 継続、 5A の 「実 pipeline 統合」 stage が 9 domain に 拡張