hook: spawn-gate.sh

Part 3 · EACH TOOL · Slide 47 of 60

Event: PreToolUse on Agent · 15 s.
Reads the spawn payload; exit 2 with a deny decision when the
model is omitted, when subagent_type is "fork", or when the
model is haiku. Sonnet and opus pass. The override variable
permits loudly (it states itself in the transcript).
Allowed calls get more: the accepted lessons in the lane's scope
are injected into its prompt (the full input, prompt changed
only); an unfenced NOTREST-GATES: … END-GATES block becomes the
lane's Stop gates under a random 8-hex key; under an unattended
run (NOTREST_UNATTENDED=1) any fan-out is denied.

   Agent call ──► gate ──► allow (0) + lessons / deny (2 + reason)