@ccoalm/ccl-skills 0.13.0 → 0.15.0

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/init_policy_matrix.py

@@ -8,8 +8,8 @@ what the parser + the wrapper's routing table actually do end to end.
 Intended policy (stated here, not derived from the code):
 
   A. Isolation proof is the exact `tools` allowlist plus the tool_use scan.
-     Any declared/invoked tool outside the expectation, or any non-empty
-     customization list, is a BREACH -> terminal.
+     Any declared/invoked tool outside the expectation, or a non-empty MCP
+     server list, is a BREACH -> terminal.
   B. A known field carrying a known-unsafe value (`permissionMode` outside
      {default, plan}) is a proven BREACH -> terminal.
   C. Anything we cannot verify -- an unrecognized surface-shaped field, or an
@@ -21,31 +21,23 @@ Intended policy (stated here, not derived from the code):
      stronger class.
   F. The verdict must never be steerable by CLI-supplied text: a field NAME
      cannot select which routing arm matches.
-  G. HOST VOCABULARY is unverifiable, not a proven breach. The built-in
-     command/skill allowlists are a snapshot of names the host owns and this
-     repo does not, so a BARE identifier they do not recognise cannot be shown
-     to be a user customization -- it is class C, not class A. A NAMESPACED,
-     path-shaped, duplicated or unparseable entry is still a customization and
-     stays terminal, and `plugins` is never host vocabulary. Refusal is
-     unchanged either way; only the next action differs, so no path that was
-     terminal becomes TOLERATED.
-  H. A same-executable, no-tool, no-plugin baseline may establish whole-string
-     host command/skill names only for a formal init reporting the same CLI
-     version. The baseline never establishes tools, authority, or schema.
-
-Every row below is (case, init-event, expected verdict class), run through the
-parse paths it declares. Policy G rows declare the review-skill paths, because
-that is the only invocation shape whose customization lists are populated at all
-(measured: 46 commands / 16 skills under `--plugin-dir`, both empty under
-`--disable-slash-commands`) -- and it is the shape the skill-free paths never
-exercised, which is why an earlier vocabulary outage passed a green matrix.
-Each shape is crossed over BOTH parse implementations, since only
-`--runtime-surface-only` selects the main-invocation branch.
+  G. HOST AND PLUGIN VOCABULARY IS NOT A BOUNDARY. `slash_commands`,
+     `terminal_slash_commands`, `skills` and `plugins` are recorded and never
+     judged: any value, any shape, any origin, present or absent, is
+     TOLERATED on its own. Nothing listed there is invocable past the pinned
+     `tools` set, so judging those lists against a snapshot of the host's own
+     built-in names turned every CLI release that shipped a new skill or
+     command into a reviewer-lane outage while proving nothing. Policies A-E
+     still apply unchanged alongside any vocabulary.
+
+Every row below is (case, init-event, expected verdict class), run through both
+parse paths: only `--runtime-surface-only` selects the main-invocation branch,
+and the two implementations have drifted apart in opposite directions before.
 
 Pass an alternate parser path as argv[1] to check a candidate or a mutant
 against the same policy -- that is how this oracle is validated: it must report
 mismatches for a deliberately weakened parser, or its clean verdict means
-nothing. That walk is now EXECUTED by `test_init_policy_matrix.sh` rather than
+nothing. That walk is EXECUTED by `test_init_policy_matrix.sh` rather than
 recorded here as prose: per-mutant scores were a hand-maintained number that
 every added row invalidated, and a sensitivity claim nothing runs is one
 refactor away from being vacuous.
@@ -90,26 +82,12 @@ def init(**overrides):
     return ev
 
 
-def case(
-    name,
-    ev,
-    expected,
-    extra_events=(),
-    paths=("probe", "main"),
-    host_baseline=None,
-):
-    """One row. `paths` names the invocation shapes it is meaningful under.
-
-    The two default paths declare no native skills, so their customization
-    lists are empty in every real run and any entry is a breach. Policy G rows
-    therefore declare the two review-skill paths instead -- see SKILL_BASE.
-    """
+def case(name, ev, expected, extra_events=()):
+    """One row, run through both parse paths."""
     return {
         "name": name,
         "events": [ev, *extra_events, RESULT],
         "expected": expected,
-        "paths": paths,
-        "host_baseline": host_baseline,
     }
 
 
@@ -123,7 +101,6 @@ ROUTING_PHRASES = [
     "runtime capability",
     "Bash tool",
     "unrecognized surface-shaped init field",
-    "unclassifiable host-vocabulary entry",
 ]
 
 CASES = [
@@ -175,22 +152,21 @@ CASES = [
     # --- A: breach -> terminal ---------------------------------------------
     case("declared-tool", init(tools=["Write"]), TERMINAL),
     case("declared-bash", init(tools=["Bash"]), TERMINAL),
-    case("declared-skill", init(skills=["x"]), TERMINAL),
-    case("declared-plugin", init(plugins=["x"]), TERMINAL),
     case("declared-mcp", init(mcp_servers=["x"]), TERMINAL),
-    case("declared-command", init(slash_commands=["x"]), TERMINAL),
+    case("declared-mcp-dict", init(mcp_servers=[{"name": "x"}]), TERMINAL),
     case("invoked-tool", init(), TERMINAL, extra_events=[
         {"type": "assistant", "message": {"content": [
             {"type": "tool_use", "name": "Write", "input": {}}]}}]),
     case("missing-tools", init(tools=...), TERMINAL),
     case("wrong-type-tools", init(tools="none"), TERMINAL),
-    case("missing-skills", init(skills=...), TERMINAL),
+    case("missing-mcp", init(mcp_servers=...), TERMINAL),
+    case("wrong-type-mcp", init(mcp_servers="none"), TERMINAL),
     case("agents-non-string", init(agents=[{"name": "x"}]), FALLBACK),
     case("capabilities-non-list", init(capabilities="x"), FALLBACK),
     case("known-metadata-turned-container", init(cwd={"path": "x"}), FALLBACK),
 
     # --- E: stronger class wins on combination ------------------------------
-    case("drift+breach", init(future_surface=["x"], skills=["y"]), TERMINAL),
+    case("drift+breach", init(future_surface=["x"], mcp_servers=["y"]), TERMINAL),
     case("drift+unsafe-value", init(future_surface=["x"],
                                     permissionMode="bypassPermissions"), TERMINAL),
     case("authority+breach", init(permissionMode=..., tools=["Write"]), TERMINAL),
@@ -217,36 +193,57 @@ for phrase in ROUTING_PHRASES:
                                      {**BASE, phrase: ["x"]}, FALLBACK))
     # the same phrase attached to a genuine breach must NOT soften it
     CASES.append(case(f"steer-breach[{phrase}]",
-                      {**BASE, "skills": ["y"], phrase: ["x"]}, TERMINAL))
+                      {**BASE, "mcp_servers": ["y"], phrase: ["x"]}, TERMINAL))
     # Field names are not the only CLI-supplied text reaching the routed reason:
-    # tool names, skill/plugin/command identifiers and invoked-tool names are
-    # interpolated too, and they may contain spaces just as freely. A breach
-    # must stay terminal no matter what the inspected CLI calls its surfaces.
+    # tool names and invoked-tool names are interpolated too, and they may
+    # contain spaces just as freely. A breach must stay terminal no matter what
+    # the inspected CLI calls its surfaces.
     CASES.append(case(f"steer-tool-name[{phrase}]",
                       {**BASE, "tools": [phrase]}, TERMINAL))
-    CASES.append(case(f"steer-skill-name[{phrase}]",
-                      {**BASE, "skills": [phrase]}, TERMINAL))
+    CASES.append(case(f"steer-mcp-name[{phrase}]",
+                      {**BASE, "mcp_servers": [phrase]}, TERMINAL))
     CASES.append(case(f"steer-invoked-tool[{phrase}]", dict(BASE), TERMINAL,
                       extra_events=[{"type": "assistant", "message": {"content": [
                           {"type": "tool_use", "name": phrase, "input": {}}]}}]))
 
 
-# --- G: host vocabulary, on the review-skill path --------------------------
-# The only shape whose customization lists are populated in a real run. The
-# selected skill name must NOT also be a built-in skill name, or the
-# ambiguous-selected-owner guard fires on every row and masks the verdict under
-# test (observed while measuring the pre-change behaviour).
-SELECTED_SKILL = "product-rd-workflow"
-SKILL_BASE = {
+# --- G: vocabulary is never a verdict --------------------------------------
+# The owner-aware invocation is the shape whose vocabulary lists are populated
+# in a real run (captured from Claude Code 2.1.261 under `--safe-mode
+# --plugin-dir`); the skill-free shape reports them empty. Both shapes must be
+# accepted with those lists holding anything at all, and every breach class
+# must stay exactly as strong beside them.
+REAL_2_1_261_COMMANDS = [
+    "deep-research", "design-sync", "dataviz", "update-config", "verify",
+    "debug", "code-review", "simplify", "batch", "fewer-permission-prompts",
+    "doctor", "loop", "schedule", "claude-api", "workflow-authoring", "run",
+    "run-skill-generator", "advisor", "agents", "auto-mode-setup",
+    "autocompact", "clear", "color", "compact", "config", "context", "effort",
+    "fast", "heapdump", "init", "mcp", "import", "model", "__remote-workflow",
+    "workflow-launch-exec", "reload-plugins", "reload-skills", "rename",
+    "ultrareview", "security-review", "usage-credits", "extra-usage", "usage",
+    "insights", "recap", "skill-doctor", "goal", "design", "design-consent",
+    "design-revoke", "list-agents", "team-onboarding",
+    "ccl-skills:product-rd-workflow",
+]
+REAL_2_1_261_SKILLS = [
+    "deep-research", "design-sync", "dataviz", "update-config", "verify",
+    "debug", "code-review", "simplify", "batch", "fewer-permission-prompts",
+    "doctor", "loop", "schedule", "claude-api", "workflow-authoring", "run",
+    "run-skill-generator", "ccl-skills:product-rd-workflow",
+]
+VOCAB_BASE = {
     **BASE,
-    "slash_commands": ["init", "agents"],
-    "skills": [f"ccl-skills:{SELECTED_SKILL}", "dataviz"],
-    "plugins": [{"name": "ccl-skills"}],
+    "slash_commands": REAL_2_1_261_COMMANDS,
+    "terminal_slash_commands": ["doctor", "color", "reload-plugins"],
+    "skills": REAL_2_1_261_SKILLS,
+    "plugins": [{"name": "ccl-skills", "path": "/p"}],
+    "claude_code_version": "2.1.261",
 }
 
 
-def skill_init(**overrides):
-    ev = dict(SKILL_BASE)
+def vocab(**overrides):
+    ev = dict(VOCAB_BASE)
     for key, value in overrides.items():
         if value is ...:
             ev.pop(key, None)
@@ -255,293 +252,68 @@ def skill_init(**overrides):
     return ev
 
 
-def skill_case(name, ev, expected, extra_events=(), host_baseline=None):
-    return case(name, ev, expected, extra_events,
-                paths=("skill", "skill-probe"),
-                host_baseline=host_baseline)
-
-
 def with_command(*extra):
-    return skill_init(slash_commands=[*SKILL_BASE["slash_commands"], *extra])
+    return vocab(slash_commands=[*VOCAB_BASE["slash_commands"], *extra])
 
 
 def with_skill(*extra):
-    return skill_init(skills=[*SKILL_BASE["skills"], *extra])
+    return vocab(skills=[*VOCAB_BASE["skills"], *extra])
 
 
 CASES += [
-    # the base itself must be accepted, or every row below proves nothing
-    skill_case("skill-clean", skill_init(), TOLERATED),
-
-    # Real Claude Code 2.1.233 owner-aware init drift. These three commands and
-    # terminal_slash_commands were captured from the exact safe-mode/plugin
-    # invocation used by claude_review.sh. They are host vocabulary/metadata,
-    # not an extra invocable surface; the exact tools list remains independently
-    # pinned by policy A.
-    skill_case(
-        "real-2.1.233-owner",
-        skill_init(
-            slash_commands=[
-                *SKILL_BASE["slash_commands"],
-                "__remote-workflow",
-                "auto-mode-setup",
-                "autocompact",
-                "list-agents",
-            ],
-            terminal_slash_commands=["init", "agents"],
-            claude_code_version="2.1.233",
-        ),
-        TOLERATED,
-        host_baseline=init(
-            slash_commands=[
-                *SKILL_BASE["slash_commands"],
-                "__remote-workflow",
-                "auto-mode-setup",
-                "autocompact",
-                "list-agents",
-            ],
-            skills=["dataviz"],
-            plugins=[],
-            terminal_slash_commands=["init", "agents"],
-            claude_code_version="2.1.233",
-        ),
-    ),
-    skill_case(
-        "host-baseline-version-mismatch",
-        skill_init(
-            slash_commands=[
-                *SKILL_BASE["slash_commands"],
-                "auto-mode-setup",
-            ],
-            claude_code_version="2.1.234",
-        ),
-        FALLBACK,
-        host_baseline=init(
-            slash_commands=["auto-mode-setup"],
-            claude_code_version="2.1.233",
-        ),
-    ),
-    skill_case(
-        "host-baseline-does-not-allow-unbaselined-command",
-        skill_init(
-            slash_commands=[
-                *SKILL_BASE["slash_commands"],
-                "baseline-command",
-                "formal-only-command",
-            ],
-            claude_code_version="2.1.233",
-        ),
-        FALLBACK,
-        host_baseline=init(
-            slash_commands=["baseline-command"],
-            skills=["dataviz"],
-            claude_code_version="2.1.233",
-        ),
-    ),
-    skill_case(
-        "host-baseline-does-not-authorize-new-skill",
-        skill_init(
-            skills=[*SKILL_BASE["skills"], "brand-new-host-skill"],
-            claude_code_version="2.1.233",
-        ),
-        FALLBACK,
-        host_baseline=init(
-            skills=["brand-new-host-skill"],
-            claude_code_version="2.1.233",
-        ),
-    ),
-    skill_case(
-        "host-baseline-rejects-namespaced-command",
-        skill_init(
-            slash_commands=[*SKILL_BASE["slash_commands"], "rogue:exfil"],
-            claude_code_version="2.1.233",
-        ),
-        TERMINAL,
-        host_baseline=init(
-            slash_commands=["rogue:exfil"],
-            claude_code_version="2.1.233",
-        ),
-    ),
-    skill_case(
-        "host-baseline-rejects-namespaced-skill",
-        skill_init(
-            skills=[*SKILL_BASE["skills"], "vendor:skill"],
-            claude_code_version="2.1.233",
-        ),
-        TERMINAL,
-        host_baseline=init(
-            skills=["vendor:skill"],
-            claude_code_version="2.1.233",
-        ),
-    ),
-    skill_case(
-        "host-baseline-does-not-allow-unbaselined-skill",
-        skill_init(
-            skills=[*SKILL_BASE["skills"], "formal-only-host-skill"],
-            claude_code_version="2.1.233",
-        ),
-        FALLBACK,
-        host_baseline=init(
-            skills=["brand-new-host-skill"],
-            claude_code_version="2.1.233",
-        ),
-    ),
-    skill_case(
-        "host-baseline-rejects-required-empty-surface",
-        skill_init(claude_code_version="2.1.233"),
-        TERMINAL,
-        host_baseline=init(
-            plugins=["untrusted-plugin"],
-            claude_code_version="2.1.233",
-        ),
-    ),
-    skill_case(
-        "terminal-commands-must-be-declared",
-        skill_init(terminal_slash_commands=["not-declared"]),
-        FALLBACK,
-    ),
-    skill_case(
-        "terminal-commands-ignore-json-key-order",
-        {
-            "terminal_slash_commands": ["init", "agents"],
-            **skill_init(),
-        },
-        TOLERATED,
-    ),
-    skill_case(
-        "terminal-commands-must-be-plain-strings",
-        skill_init(terminal_slash_commands=[{"name": "init"}]),
-        FALLBACK,
-    ),
-
-    # the defect: a name the host added and this snapshot does not know
-    skill_case("host-vocab-new-command", with_command("brand-new-builtin"), FALLBACK),
-    skill_case("host-vocab-new-skill", with_skill("brand-new-skill"), FALLBACK),
-    # identifiers are normalized before classification, so case is not a class
-    skill_case("host-vocab-mixed-case", with_command("BrandNewBuiltin"), FALLBACK),
-
-    # ...and everything that is NOT host vocabulary stays a proven breach
-    skill_case("namespaced-foreign-command", with_command("evil-plugin:pwn"), TERMINAL),
-    skill_case("namespaced-foreign-skill", with_skill("evil-plugin:pwn"), TERMINAL),
-    skill_case("path-shaped-identifier", with_command("dir/cmd"), TERMINAL),
-    skill_case("unparseable-identifier", with_command("ev!l"), TERMINAL),
-    skill_case("duplicate-identifiers", with_command("init"), TERMINAL),
-    skill_case("foreign-plugin",
-               skill_init(plugins=[{"name": "ccl-skills"}, {"name": "other"}]),
-               TERMINAL),
-    # A STRUCTURED entry stays terminal even when its reported `name` is bare:
-    # the identifier helper reads `name` first, so a sibling key can carry
-    # path-shaped proof of a real customization that the soft class would then
-    # ignore. Unread evidence is not the same as absent evidence, which is the
-    # only thing this class is for. Costs nothing: measured against the real
-    # CLI, both host-vocabulary fields arrive as plain strings.
-    skill_case("dict-entry-bare-name",
-               with_command({"name": "brand-new-builtin", "command": "/x/y"}),
-               TERMINAL),
-    # ...and the same shape with no smuggled key is still terminal, so the rule
-    # is "structured entries are not host vocabulary", not "we grep for paths".
-    skill_case("dict-entry-bare-name-only",
-               with_command({"name": "brand-new-builtin"}), TERMINAL),
-    # The severe variant, and the one a round-5 review found: a structured entry
-    # whose `name` is an ALLOWED built-in used to clear the allowlist outright,
-    # so its other keys were never inspected and the run reached TOLERATED with
-    # isolation reported verified. Reproduced before it was fixed. Both fields,
-    # because the shape gate must not be per-field folklore.
-    # The smuggled `name` must be an allowed built-in that is NOT already in the
-    # base list: reusing one duplicates an identifier, and the duplicate check
-    # then makes the row terminal for an unrelated reason. Caught by differential
-    # attribution — with the first fixtures, removing the shape gate flipped
-    # nothing here, which is a finding about the test, not a clean result.
-    skill_case("dict-entry-smuggled-under-allowed-command",
-               with_command({"name": "import", "command": "/x/y",
-                             "extra": ["Bash"]}), TERMINAL),
-    skill_case("dict-entry-smuggled-under-allowed-skill",
-               with_skill({"name": "verify", "command": "/x/y"}), TERMINAL),
-    # ...while `plugins` legitimately carries dicts in every real run, so the
-    # gate must not spread to it: this is what stops the fix from breaking the
-    # actual CLI.
-    skill_case("plugin-dict-stays-legitimate",
-               skill_init(plugins=[{"name": "ccl-skills", "path": "/p"}]),
-               TOLERATED),
-    # The third instance of the same class: a PLAIN STRING whose first token is
-    # bare while the discarded remainder carries the proof. The identifier helper
-    # keeps only that first token, so judging the token instead of the whole
-    # value read `brand-new evil-plugin:pwn` as host vocabulary.
-    skill_case("whitespace-hides-a-namespace",
-               with_command("brand-new evil-plugin:pwn"), TERMINAL),
-    skill_case("whitespace-hides-a-path",
-               with_command("brand-new dir/cmd"), TERMINAL),
-    skill_case("whitespace-hides-a-routing-phrase",
-               with_command("brand-new runtime isolation"), TERMINAL),
-    skill_case("whitespace-hides-a-namespace-in-skills",
-               with_skill("brand-new evil-plugin:pwn"), TERMINAL),
-    # SURROUNDING whitespace is the fourth instance, and the worst: wrapping an
-    # ALLOWLISTED name reached TOLERATED, because both the allowlist and the
-    # first version of the whole-value check stripped before comparing.
-    skill_case("trailing-space-on-an-allowlisted-command",
-               with_command("import "), TERMINAL),
-    skill_case("leading-space-on-an-allowlisted-command",
-               with_command(" import"), TERMINAL),
-    skill_case("trailing-space-on-an-allowlisted-skill",
-               with_skill("verify "), TERMINAL),
-    skill_case("trailing-space-on-an-unknown-command",
-               with_command("brand-new "), TERMINAL),
-    skill_case("tab-wrapped-allowlisted-command",
-               with_command("\timport"), TERMINAL),
-    # ...and the legitimate namespaced entry must survive all of that, since its
-    # whole value IS its identifier. Without this row the gate could be tightened
-    # into rejecting the surface the review-skill mode depends on.
-    skill_case("selected-namespaced-command-still-allowed",
-               with_command(f"ccl-skills:{SELECTED_SKILL}"), TOLERATED),
-
-    # E in review-skill mode: the softer class must never absorb a real breach
-    skill_case("host-vocab+tool-breach",
-               skill_init(slash_commands=[*SKILL_BASE["slash_commands"], "brand-new"],
-                          tools=["Write"]), TERMINAL),
-    skill_case("host-vocab+unsafe-value",
-               skill_init(slash_commands=[*SKILL_BASE["slash_commands"], "brand-new"],
-                          permissionMode="bypassPermissions"), TERMINAL),
-    skill_case("host-vocab+namespaced",
-               with_command("brand-new", "evil-plugin:pwn"), TERMINAL),
-    skill_case("host-vocab+invoked-tool",
-               with_command("brand-new"), TERMINAL,
-               extra_events=[{"type": "assistant", "message": {"content": [
-                   {"type": "tool_use", "name": "Write", "input": {}}]}}]),
-    # two unverifiables are still one unverifiable
-    skill_case("host-vocab+unknown-container",
-               skill_init(slash_commands=[*SKILL_BASE["slash_commands"], "brand-new"],
-                          future_surface=["x"]), FALLBACK),
-
-    # per event, not on the union
-    skill_case("second-init-adds-host-vocab", skill_init(), FALLBACK,
-               extra_events=[with_command("brand-new-builtin")]),
-    skill_case("second-init-adds-namespaced", skill_init(), TERMINAL,
-               extra_events=[with_command("evil-plugin:pwn")]),
-
-    # invariants that must survive in this mode too
-    skill_case("skill-missing-plugin", skill_init(plugins=[]), TERMINAL),
-    skill_case("skill-required-absent",
-               skill_init(skills=["ccl-skills:other-skill"]), TERMINAL),
-    skill_case("skill-authority-absent", skill_init(permissionMode=...), FALLBACK),
-    skill_case("skill-declared-tool", skill_init(tools=["Write"]), TERMINAL),
+    # the real owner-aware init, and the same on a skill-free run
+    case("real-2.1.261-owner", vocab(), TOLERATED),
+    case("declared-skill", init(skills=["x"]), TOLERATED),
+    case("declared-plugin", init(plugins=["x"]), TOLERATED),
+    case("declared-command", init(slash_commands=["x"]), TOLERATED),
+    case("missing-skills", init(skills=...), TOLERATED),
+    case("missing-commands", init(slash_commands=...), TOLERATED),
+    case("missing-plugins", init(plugins=...), TOLERATED),
+    # names the host may ship tomorrow, in any spelling
+    case("vocab-new-command", with_command("brand-new-builtin"), TOLERATED),
+    case("vocab-new-skill", with_skill("brand-new-skill"), TOLERATED),
+    case("vocab-mixed-case", with_command("BrandNewBuiltin"), TOLERATED),
+    # shapes that used to be read as proof of a customization
+    case("vocab-namespaced-command", with_command("other-plugin:cmd"), TOLERATED),
+    case("vocab-namespaced-skill", with_skill("other-plugin:skill"), TOLERATED),
+    case("vocab-path-shaped", with_command("dir/cmd"), TOLERATED),
+    case("vocab-unparseable", with_command("ev!l"), TOLERATED),
+    case("vocab-duplicate", with_command("init"), TOLERATED),
+    case("vocab-whitespace", with_command(" import", "brand-new dir/cmd"), TOLERATED),
+    case("vocab-dict-entry", with_command({"name": "x", "command": "/x/y"}), TOLERATED),
+    case("vocab-dict-skill", with_skill({"name": "verify", "command": "/x/y"}), TOLERATED),
+    case("vocab-foreign-plugin",
+         vocab(plugins=[{"name": "ccl-skills"}, {"name": "other"}]), TOLERATED),
+    case("vocab-plugin-strings", vocab(plugins=["ccl-skills"]), TOLERATED),
+    case("vocab-no-plugin", vocab(plugins=[]), TOLERATED),
+    case("vocab-wrong-type", vocab(skills="none", slash_commands={"a": 1}), TOLERATED),
+    case("vocab-terminal-any-shape",
+         vocab(terminal_slash_commands=[{"name": "init"}, "not-declared"]), TOLERATED),
+    case("vocab-terminal-wrong-type", vocab(terminal_slash_commands="doctor"), TOLERATED),
+    case("second-init-adds-vocab", vocab(), TOLERATED,
+         extra_events=[with_command("evil-plugin:pwn")]),
+
+    # ...while every breach class keeps exactly its strength beside vocabulary
+    case("vocab+tool-breach", vocab(tools=["Write"]), TERMINAL),
+    case("vocab+bash", vocab(tools=["Bash"]), TERMINAL),
+    case("vocab+mcp", vocab(mcp_servers=["x"]), TERMINAL),
+    case("vocab+unsafe-value", vocab(permissionMode="bypassPermissions"), TERMINAL),
+    case("vocab+invoked-tool", vocab(), TERMINAL,
+         extra_events=[{"type": "assistant", "message": {"content": [
+             {"type": "tool_use", "name": "Write", "input": {}}]}}]),
+    case("vocab+unknown-container", vocab(future_surface=["x"]), FALLBACK),
+    case("vocab+authority-absent", vocab(permissionMode=...), FALLBACK),
+    case("vocab+missing-tools", vocab(tools=...), TERMINAL),
 ]
 
-# F in review-skill mode: the new class is reached through a CLI-supplied
-# IDENTIFIER rather than a field name, so re-run the steering check over it. A
-# phrase is normalized to its first token, which is bare -- so the softest arm
-# it can reach is its own class, and it must never soften a breach.
+# F over vocabulary: a routing phrase placed INSIDE a vocabulary list is data,
+# never a verdict -- so it is tolerated alone and must not soften a breach.
 for phrase in ROUTING_PHRASES:
-    # A phrase containing whitespace cannot be a plain host name at all, so the
-    # whole-value gate disqualifies it and it stays TERMINAL — stricter than the
-    # single-token case, and the property under test is unchanged either way: a
-    # CLI-supplied identifier never reaches an arm SOFTER than its own class.
-    CASES.append(skill_case(f"steer-vocab-command[{phrase}]",
-                            with_command(phrase),
-                            FALLBACK if " " not in phrase else TERMINAL))
-    CASES.append(skill_case(f"steer-vocab-breach[{phrase}]",
-                            skill_init(
-                                slash_commands=[*SKILL_BASE["slash_commands"], phrase],
-                                tools=["Write"]), TERMINAL))
+    CASES.append(case(f"steer-vocab-command[{phrase}]", with_command(phrase), TOLERATED))
+    CASES.append(case(f"steer-vocab-skill[{phrase}]", with_skill(phrase), TOLERATED))
+    CASES.append(case(f"steer-vocab-breach[{phrase}]",
+                      vocab(slash_commands=[*VOCAB_BASE["slash_commands"], phrase],
+                            tools=["Write"]), TERMINAL))
 
 
 def wrapper_arm(reason: str) -> str:
@@ -573,21 +345,6 @@ PATHS = {
     "probe": [],
     "main": ["--require-empty-init", "--expected-tools", "",
              "--allow-expected-tool-use", "--runtime-surface-only"],
-    # The review-skill shape, carrying the native-skill flags the wrapper really
-    # passes. Added because the two paths above declare no skills, so their
-    # customization lists are empty in every real run -- leaving the branch that
-    # actually classifies host vocabulary untested by a green matrix.
-    "skill": ["--require-empty-init", "--expected-tools", "",
-              "--expected-native-skills", SELECTED_SKILL,
-              "--required-native-skills", SELECTED_SKILL,
-              "--allow-expected-tool-use", "--runtime-surface-only"],
-    # ...and the same shape through the OTHER parse path. `--runtime-surface-only`
-    # is what selects the main-invocation branch, so without this the review-skill
-    # cases would only ever exercise one of the two implementations that have
-    # drifted apart in opposite directions twice before.
-    "skill-probe": ["--require-empty-init", "--expected-tools", "",
-                    "--expected-native-skills", SELECTED_SKILL,
-                    "--required-native-skills", SELECTED_SKILL],
 }
 
 
@@ -597,18 +354,8 @@ def run_case(entry, parser=PARSER, path="probe"):
         err = Path(tmp, "stderr")
         out.write_text("\n".join(json.dumps(ev) for ev in entry["events"]))
         err.write_text("")
-        parser_args = [*PATHS[path]]
-        if entry["host_baseline"] is not None:
-            baseline = Path(tmp, "host-baseline")
-            baseline.write_text(
-                "\n".join(
-                    json.dumps(ev)
-                    for ev in (entry["host_baseline"], RESULT)
-                )
-            )
-            parser_args.extend(["--host-init-baseline", str(baseline)])
         proc = subprocess.run(
-            [sys.executable, str(parser), "0", str(out), str(err), *parser_args],
+            [sys.executable, str(parser), "0", str(out), str(err), *PATHS[path]],
             capture_output=True, text=True)
     if proc.returncode == 0:
         return TOLERATED, ""
@@ -624,7 +371,7 @@ def main():
     failures = []
     runs = 0
     for entry in CASES:
-        for path in entry["paths"]:
+        for path in PATHS:
             runs += 1
             actual, reason = run_case(entry, parser, path)
             if actual != entry["expected"]: