An AI rule that rates a statement high can now map to require_review: the relay files a review, refuses the statement, and forwards it only after a person approves — once.

local rules → [opa gate] → review CLAIM → analyzer → [opa decide] → review DECIDE

CLAIM runs before the analyzer, so an approved statement costs one gateway round trip and no model call.

Relay — new hoopinspect/review package. Two identities, never interchangeable: statement_hash (SHA-256 over the exact statement, from the bytes on the wire) is what an approval authorizes; the correlation marker only decides whether a request is a retry. One marker name across protocols — X-Hoop-Correlation-Id on HTTP, -- x-hoop-correlation-id= on SQL. A message kind the codec does not recognize is refused, not gated on a shape hash.

Gateway — /api/inspect/*, machine-only, auth on the route group so a later route cannot be reached by a human session by omission. Claim is single-use and atomic (FOR UPDATE SKIP LOCKED); poll is rate limited, claim and create are not — they sit on the data path. Migration 000114 adds statement_hash / request_marker and two partial indexes.

Also fixes a pre-existing analyzer fold: an AI rule whose trigger did not match reported skipped, erasing a rule that had classified — so a lane with two AI rules allowed statements it rated high. Reproduced on 06dc3dd6. And provider HTTP errors now quote the response body at log_level: debug only.

Limitations

• Gated: postgres simple Query, mssql SQLBatch, HTTP with capture_body. Parameterized statements (Parse, sp_executesql) and truncated bodies are refused, not gated — one approval would otherwise cover every later binding. Most drivers send Parse, so this is CLI/agent-shaped today. runs, it just files a duplicate review.
• A gated lane needs fail_open: false and unknown in the trigger.
• The lane's connection must exist with an access-request rule.
• An admin-grouped credential can approve its own review — use a non-admin group for a sandbox token.
• Gate sessions record principal: anonymous and carry no statement body.