Fix open issue regressions

README.md

@@ -598,15 +598,19 @@ The agent loop is gated (the PreToolUse install-gate across 11 harnesses), but a
 human typing `npm i x` / `npx y` / `brew install z` in their own terminal reaches
 the machine ungated. `kit guard install` writes PATH shims for the install +
 fetch-and-run family (`npm npx pnpm yarn bun bunx pip pip3 pipx uv uvx brew gem
-cargo`) that run the **same hardened parser + triage verdict** the agent gate
+cargo git`) that run the **same hardened parser + triage verdict** the agent gate
 uses — and log what it WOULD decide to `~/.kit/guard-observe.jsonl`.
 
 v1 is **observe-only** by the exec-broker discipline (observe → evidence →
 enforce): a shim never blocks and never breaks the tool — kit missing or
 crashing means unchanged behavior, non-install subcommands pass silently, and
 `KIT_GUARD_BYPASS=1` skips observation for one call. `kit guard status` shows
-what has passed through and what enforce mode would have stopped; `kit guard
-uninstall` removes everything. Notable: the shims also see the `npx`-spawned
+what has passed through, what enforce mode would have stopped, and whether a
+fresh login shell actually resolves each guarded tool to kit's shim (so a later
+PATH prepend cannot silently displace it); `kit guard uninstall` removes
+everything. `git clone` is **observe-only**, not hard-gated: the shim records
+repo intake and points at `kit triage repo <url>` for third-party dependencies.
+Notable: the shims also see the `npx`-spawned
 MCP servers agent harnesses launch **outside** any Bash gate — coverage the
 PreToolUse hook can't reach.