@drakon-systems/shieldcortex-realtime 4.54.13 → 4.54.15

package/README.md

@@ -136,8 +136,8 @@ are read by the parser; on a conflicting key the top-level value wins, per key,
 and anything the top-level block does not mention is filled in from the alias.
 Everything below is relative to whichever of the two you use:
 
-- `actionGuard.enabled`: turn the before-tool-call Action Guard on or off (default `true`)
-- `actionGuard.enforce`: enforce dangerous-operation gating (default `true`); `false` opts down to warn-and-allow. Catastrophic operations are blocked regardless.
+- `actionGuard.enabled`: turn the before-tool-call Action Guard on or off (default `false`; unsigned configs leave Guard off)
+- `actionGuard.enforce`: enforce dangerous-operation gating (default `true` when Guard is on); `false` opts down to warn-and-allow. Catastrophic operations are blocked only while Guard is enabled.
 - `actionGuard.autoApprove`: array of operation allowlist entries for unattended agents that legitimately need specific dangerous operations
 - `actionGuard.auditAllows`: audit recognised (sensitive-tier) allow-decisions so "scanned & allowed" is distinguishable from "never scanned" (default `true`; benign allows are never audited)
 - `actionGuard.notify`: operator-notification transport (`enabled`, `webhookUrl`, `webhookSecret`, `openclaw`, `timeoutMs`). Off unless `enabled` is exactly `true`. Used both for held tool calls and for conversation-firewall detections.

package/dist/index.js

@@ -821,7 +821,7 @@ const PLUGIN_CONFIG_UI_HINTS = {
     },
     "interceptor.actionGuard.enabled": {
         label: "Action Guard",
-        help: "Gate dangerous shell/file/network/git tool calls before they execute. Catastrophic operations are always blocked while enabled.",
+        help: "Gate dangerous shell/file/network/git tool calls before they execute. Off by default. Catastrophic operations are blocked only while this is enabled.",
     },
     "interceptor.actionGuard.enforce": {
         label: "Enforce Action Guard",
@@ -3003,7 +3003,7 @@ export default {
                     // so the status line reflects what before_tool_call will actually do.
                     const rawInterceptor = cfg.interceptor;
                     const guardCfg = {
-                        ...(DEFAULT_INTERCEPTOR_CONFIG.actionGuard ?? { enabled: true, enforce: true, autoApprove: [] }),
+                        ...(DEFAULT_INTERCEPTOR_CONFIG.actionGuard ?? { enabled: false, enforce: true, autoApprove: [] }),
                         ...(rawInterceptor && typeof rawInterceptor === 'object' ? rawInterceptor.actionGuard ?? {} : {}),
                     };
                     const interceptorOn = (rawInterceptor && typeof rawInterceptor === 'object' ? rawInterceptor.enabled : undefined) ?? DEFAULT_INTERCEPTOR_CONFIG.enabled;
@@ -3079,7 +3079,7 @@ export default {
                             enabled: rawInterceptorConfig.enabled ?? DEFAULT_INTERCEPTOR_CONFIG.enabled,
                             severityActions: { ...DEFAULT_INTERCEPTOR_CONFIG.severityActions, ...rawInterceptorConfig.severityActions },
                             failurePolicy: { ...DEFAULT_INTERCEPTOR_CONFIG.failurePolicy, ...rawInterceptorConfig.failurePolicy },
-                            actionGuard: { ...(DEFAULT_INTERCEPTOR_CONFIG.actionGuard ?? { enabled: true, enforce: true, autoApprove: [] }), ...(rawInterceptorConfig.actionGuard ?? {}) },
+                            actionGuard: { ...(DEFAULT_INTERCEPTOR_CONFIG.actionGuard ?? { enabled: false, enforce: true, autoApprove: [] }), ...(rawInterceptorConfig.actionGuard ?? {}) },
                         } : {}),
                         logger: { info: api.logger?.info ?? console.log, warn: api.logger?.warn ?? console.warn },
                     };

package/dist/interceptor.js

@@ -33,13 +33,11 @@ const DEFAULT_CONFIG = {
         high: 'deny',
         critical: 'deny',
     },
-    // Action Guard on by default: catastrophic ops are blocked out of the box;
-    // recognised-dangerous ops are ENFORCED by default (P1/WS1) — attended → prompt,
-    // unattended → fail closed on failurePolicy. Populate `autoApprove` per agent to
-    // pre-approve the dangerous ops it legitimately needs unattended; set
-    // `enforce:false` to opt back down to warn-and-allow.
+    // Action Guard OFF by default: false-card storms on live OpenClaw exec
+    // bags made default-on an uninstall risk. Catastrophic gating is also off
+    // until the operator signs `shieldcortex config --action-guard-enable`.
     actionGuard: {
-        enabled: true,
+        enabled: false,
         enforce: true,
         autoApprove: [],
         auditAllows: true,
@@ -151,6 +149,22 @@ export function formatApprovalPrompt(input) {
         '[Approve]  [Deny]',
     ].join('\n');
 }
+/**
+ * The guard could not CLOSE this bag: the #412 tool-input schema rejected it,
+ * or the command-evidence walk ran out of budget before it had read all of it.
+ * Either way the call was never fully scanned, so no operator widening may
+ * apply to it — see `unscannedBlock` at the enforcement site.
+ *
+ * Read off the guard's own reason codes (`invalid_tool_input` /
+ * `invalid-tool-input`) rather than the decision tier, so it stays true
+ * whichever door the core decides this class deserves. Mirrored in
+ * `scripts/pre-tool-hook.mjs` (`isSchemaInvalid`) — the two enforcement
+ * surfaces must agree, and parity is asserted by the plane gate.
+ */
+function isSchemaInvalid(v) {
+    return v.action === 'invalid_tool_input'
+        || (Array.isArray(v.signals) && v.signals.includes('invalid-tool-input'));
+}
 // --- WS2 fail-closed fallback (guard load/eval failure) ---
 // Deliberately DUPLICATED from tool-action-guard.ts's CATASTROPHIC list, not
 // imported — this file already avoids a compile-time dependency on the main
@@ -534,7 +548,7 @@ export function createInterceptor(config, pipeline, options) {
     const bindAudit = options?.bindAudit;
     /** Args of the in-flight tool call — used only to mint #224 actionKey. */
     let lastCallArgs;
-    const actionGuardCfg = config.actionGuard ?? { enabled: true, enforce: true, autoApprove: [] };
+    const actionGuardCfg = config.actionGuard ?? { enabled: false, enforce: true, autoApprove: [] };
     const evaluateToolCall = options?.evaluateToolCall;
     const broker = options?.broker;
     // The judge rides the operator's own model pool, so its calls are their cost
@@ -881,23 +895,70 @@ export function createInterceptor(config, pipeline, options) {
                 v = { ...v, decision: esc.decision, reason: `${v.reason} — ESCALATED by tainted session: ${taint.reason}` };
             }
         }
+        // ── Native contract drift observation ────────────────────────────────
+        // A reviewed host contract grew fields ShieldCortex does not read. The
+        // guard already dropped them before nested validation and before any
+        // extractor, so nothing here can change the verdict — this is the record
+        // that the drop HAPPENED, which is the only way an operator learns a host
+        // schema moved without a card storm telling them. It rides on the call's
+        // own outcome rather than minting a row of its own, so a drifted benign
+        // allow stays a single row and volume discipline holds. `auditAllows:false`
+        // opts out with the rest of the recognised-allow stream.
+        const drift = v.contractDrift && v.contractDrift.droppedKeys.length > 0
+            ? { contractDrift: v.contractDrift }
+            : undefined;
+        if (v.decision === 'allow' && drift && actionGuardCfg.auditAllows !== false) {
+            const d = drift.contractDrift;
+            log.warn(`[shieldcortex] action-guard CONTRACT DRIFT ${context.toolName} (${d.contract}): dropped unread field(s) ${d.droppedKeys.join(', ')}${d.truncated ? ', …' : ''}`);
+        }
         if (v.decision === 'allow') {
             // Issue #95: a RECOGNISED allow (the guard evaluated a known operation
             // family and let it through — severity above benign) leaves an audit
             // entry, so forensics can distinguish "scanned & allowed" from "never
             // scanned". Benign allows stay unaudited by design (volume discipline);
             // `actionGuard.auditAllows: false` opts the recognised entries off too.
-            if (v.severity !== 'benign' && actionGuardCfg.auditAllows !== false) {
-                const allowPreview = `${context.toolName} :: ${summariseToolArgs(context.arguments)}`;
-                emitAudit({ ...guardAuditBase(context.toolName, v, allowPreview), action: 'allow', outcome: 'allowed' });
+            if (actionGuardCfg.auditAllows !== false) {
+                if (v.severity !== 'benign') {
+                    const allowPreview = `${context.toolName} :: ${summariseToolArgs(context.arguments)}`;
+                    emitAudit({ ...guardAuditBase(context.toolName, v, allowPreview), ...(drift ?? {}), action: 'allow', outcome: 'allowed' });
+                }
+                else if (drift) {
+                    // A benign allow is normally unaudited — but drift is the one thing
+                    // about it worth keeping, so it rides on ONE row of its own rather
+                    // than doubling the recognised-allow row above. The preview is the
+                    // tool name and nothing else: a drifted field may hold a prompt or a
+                    // token, and unlike `summariseToolArgs` this row must never be a
+                    // channel for a value the guard just refused to read.
+                    emitAudit({
+                        ...guardAuditBase(context.toolName, v, `${context.toolName} :: contract-drift`),
+                        ...drift,
+                        action: 'allow',
+                        outcome: 'allowed',
+                    });
+                }
             }
             return;
         }
         const preview = `${context.toolName} :: ${summariseToolArgs(context.arguments)}`;
-        const base = { ...guardAuditBase(context.toolName, v, preview), ...(escalation ? { escalated: escalation } : {}) };
+        const base = { ...guardAuditBase(context.toolName, v, preview), ...(escalation ? { escalated: escalation } : {}), ...(drift ?? {}) };
         const severity = v.severity === 'catastrophic' ? 'critical' : 'high';
         // Catastrophic / exfil — hard block, always enforced when the guard is enabled.
-        if (v.decision === 'block') {
+        // #436: the door-less throw is for that tier only. A schema rejection falls
+        // through to requireApproval so the operator can still say yes. autoApprove
+        // and enforce:false must not widen an unscanned call — they skip below.
+        const terminalBlock = v.decision === 'block'
+            && (v.severity === 'catastrophic' || v.severity === 'critical');
+        // Derived from the guard's OWN schema signal, not from `decision`. The core
+        // answers a scanned-clean schema rejection with `require_approval` (so all
+        // three planes say the same word about the same call), which means
+        // `decision === 'block'` no longer identifies the class. Keying off the
+        // decision here would silently re-open exactly what #436 closed:
+        // `{command:'…', evil:'…'}` running unscanned on an `enforce:false` host,
+        // and `autoApprove: ['unknown-keys']` becoming a blanket bypass of the #412
+        // closed schema. The residual `decision === 'block' && !terminalBlock` arm
+        // is kept for any sub-catastrophic block a future rule mints.
+        const unscannedBlock = isSchemaInvalid(v) || (v.decision === 'block' && !terminalBlock);
+        if (terminalBlock) {
             // #227: release any lease this call minted early — a blocked action must
             // not leave a hold on that scope (self-heals at TTL if release fails).
             if (leaseGate?.acquired) {
@@ -919,7 +980,7 @@ export function createInterceptor(config, pipeline, options) {
         // legitimate dangerous work. It NEVER applies to catastrophic ops — those
         // hard-block above, before this branch is reached.
         const autoApprove = actionGuardCfg.autoApprove ?? [];
-        if (autoApprove.length > 0) {
+        if (autoApprove.length > 0 && !unscannedBlock) {
             const hay = [v.family, v.action, ...v.signals].map(s => String(s).toLowerCase());
             const matched = autoApprove.some(a => {
                 const n = a.toLowerCase();
@@ -932,7 +993,8 @@ export function createInterceptor(config, pipeline, options) {
         }
         // require_approval — ENFORCED by default (P1/WS1). `enforce:false` opts back
         // down to warn-and-allow (advisory) for operators who want the old behaviour.
-        if (!actionGuardCfg.enforce) {
+        // #436: an unscanned schema rejection must not become an advisory allow.
+        if (!actionGuardCfg.enforce && !unscannedBlock) {
             log.warn(`[shieldcortex] ⚠️ Action Guard: ${context.toolName} — ${v.reason}`);
             emitAudit({ ...base, action: 'warn', outcome: 'warned' });
             return;
@@ -953,7 +1015,7 @@ export function createInterceptor(config, pipeline, options) {
             log.warn(`[shieldcortex] approval broker HARDENED ${context.toolName} to a denial: ${brokered.reason}`);
             throw new Error(`ShieldCortex: tool call blocked — ${brokered.reason}`);
         }
-        if (brokered?.outcome === 'pre_clear') {
+        if (brokered?.outcome === 'pre_clear' && !unscannedBlock) {
             // Reversible, on-host, in-context, judge-confident: proceed without
             // waiting. Loud on purpose — a release nobody approved must never be a
             // silent one, because the audit row is the only thing that will ever tell

package/dist/openclaw.plugin.json

@@ -1,6 +1,6 @@
 {
   "id": "shieldcortex-realtime",
-  "version": "4.54.13",
+  "version": "4.54.15",
   "name": "ShieldCortex Real-time Scanner",
   "description": "Real-time defence scanning on LLM input, memory extraction on LLM output, and active tool call interception with approval gating.",
   "kind": null,
@@ -304,7 +304,7 @@
             "properties": {
               "enabled": {
                 "type": "boolean",
-                "default": true
+                "default": false
               },
               "enforce": {
                 "type": "boolean",
@@ -427,7 +427,7 @@
         "properties": {
           "enabled": {
             "type": "boolean",
-            "default": true
+            "default": false
           },
           "enforce": {
             "type": "boolean",

package/index.ts

@@ -1164,7 +1164,7 @@ const PLUGIN_CONFIG_UI_HINTS = {
   },
   "interceptor.actionGuard.enabled": {
     label: "Action Guard",
-    help: "Gate dangerous shell/file/network/git tool calls before they execute. Catastrophic operations are always blocked while enabled.",
+    help: "Gate dangerous shell/file/network/git tool calls before they execute. Off by default. Catastrophic operations are blocked only while this is enabled.",
   },
   "interceptor.actionGuard.enforce": {
     label: "Enforce Action Guard",
@@ -3565,7 +3565,7 @@ export default {
           // so the status line reflects what before_tool_call will actually do.
           const rawInterceptor = cfg.interceptor;
           const guardCfg = {
-            ...(DEFAULT_INTERCEPTOR_CONFIG.actionGuard ?? { enabled: true, enforce: true, autoApprove: [] }),
+            ...(DEFAULT_INTERCEPTOR_CONFIG.actionGuard ?? { enabled: false, enforce: true, autoApprove: [] }),
             ...(rawInterceptor && typeof rawInterceptor === 'object' ? rawInterceptor.actionGuard ?? {} : {}),
           };
           const interceptorOn = (rawInterceptor && typeof rawInterceptor === 'object' ? rawInterceptor.enabled : undefined) ?? DEFAULT_INTERCEPTOR_CONFIG.enabled;
@@ -3643,7 +3643,7 @@ export default {
             enabled: rawInterceptorConfig.enabled ?? DEFAULT_INTERCEPTOR_CONFIG.enabled,
             severityActions: { ...DEFAULT_INTERCEPTOR_CONFIG.severityActions, ...rawInterceptorConfig.severityActions },
             failurePolicy: { ...DEFAULT_INTERCEPTOR_CONFIG.failurePolicy, ...rawInterceptorConfig.failurePolicy },
-            actionGuard: { ...(DEFAULT_INTERCEPTOR_CONFIG.actionGuard ?? { enabled: true, enforce: true, autoApprove: [] }), ...(rawInterceptorConfig.actionGuard ?? {}) },
+            actionGuard: { ...(DEFAULT_INTERCEPTOR_CONFIG.actionGuard ?? { enabled: false, enforce: true, autoApprove: [] }), ...(rawInterceptorConfig.actionGuard ?? {}) },
           } : {}),
           logger: { info: api.logger?.info ?? console.log, warn: (api.logger as any)?.warn ?? console.warn },
         };

package/interceptor.ts

@@ -46,6 +46,14 @@ export interface ActionGuardConfig {
 /** Structural shape of a Tool Action Guard verdict (kept local to avoid a
  * compile-time dependency on the main package across the plugin build boundary;
  * the real `evaluateToolCall` from `shieldcortex/defence` is compatible). */
+/** A reviewed native contract grew fields ShieldCortex does not read. Names
+ *  only — the guard drops the values before any scanner sees them. */
+export interface ContractDriftLike {
+  contract: string;
+  droppedKeys: string[];
+  truncated?: boolean;
+}
+
 export interface ToolGuardVerdictLike {
   decision: 'allow' | 'require_approval' | 'block';
   severity: 'benign' | 'sensitive' | 'dangerous' | 'catastrophic' | string;
@@ -53,6 +61,8 @@ export interface ToolGuardVerdictLike {
   action: string;
   reason: string;
   signals: string[];
+  /** Present only when a reviewed contract drifted. Never a verdict input. */
+  contractDrift?: ContractDriftLike;
   /** Rule → matched-span evidence behind `signals` (issue #192).
    *  #184: optional source/line/chain when the match came from folded script. */
   matches?: Array<{
@@ -277,6 +287,15 @@ export interface InterceptAuditEntry {
   escalated?: { by: 'session-taint'; from: string; to: string; reason: string };
   /** Files the reviewed-script allowlist exempted from folding (#189). */
   reviewedScripts?: string[];
+  /**
+   * Native contract drift: a reviewed exact-name host contract carried fields
+   * ShieldCortex does not read, which the guard dropped before validation and
+   * before any extractor. Key NAMES only, bounded — an operator can see THAT a
+   * host schema moved and which fields moved, without the row ever carrying a
+   * value from them. Advisory: this rides on the call's own outcome and never
+   * gates, denies, or mints a card.
+   */
+  contractDrift?: ContractDriftLike;
   /** #260 — plane origin so the session-guard summariser can find this row. */
   origin?: 'openclaw-interceptor';
   sessionKey?: string;
@@ -316,13 +335,11 @@ const DEFAULT_CONFIG: InterceptorConfig = {
     high: 'deny',
     critical: 'deny',
   },
-  // Action Guard on by default: catastrophic ops are blocked out of the box;
-  // recognised-dangerous ops are ENFORCED by default (P1/WS1) — attended → prompt,
-  // unattended → fail closed on failurePolicy. Populate `autoApprove` per agent to
-  // pre-approve the dangerous ops it legitimately needs unattended; set
-  // `enforce:false` to opt back down to warn-and-allow.
+  // Action Guard OFF by default: false-card storms on live OpenClaw exec
+  // bags made default-on an uninstall risk. Catastrophic gating is also off
+  // until the operator signs `shieldcortex config --action-guard-enable`.
   actionGuard: {
-    enabled: true,
+    enabled: false,
     enforce: true,
     autoApprove: [],
     auditAllows: true,
@@ -466,6 +483,23 @@ export function formatApprovalPrompt(input: ApprovalPromptInput): string {
   ].join('\n');
 }
 
+/**
+ * The guard could not CLOSE this bag: the #412 tool-input schema rejected it,
+ * or the command-evidence walk ran out of budget before it had read all of it.
+ * Either way the call was never fully scanned, so no operator widening may
+ * apply to it — see `unscannedBlock` at the enforcement site.
+ *
+ * Read off the guard's own reason codes (`invalid_tool_input` /
+ * `invalid-tool-input`) rather than the decision tier, so it stays true
+ * whichever door the core decides this class deserves. Mirrored in
+ * `scripts/pre-tool-hook.mjs` (`isSchemaInvalid`) — the two enforcement
+ * surfaces must agree, and parity is asserted by the plane gate.
+ */
+function isSchemaInvalid(v: ToolGuardVerdictLike): boolean {
+  return v.action === 'invalid_tool_input'
+    || (Array.isArray(v.signals) && v.signals.includes('invalid-tool-input'));
+}
+
 // --- WS2 fail-closed fallback (guard load/eval failure) ---
 // Deliberately DUPLICATED from tool-action-guard.ts's CATASTROPHIC list, not
 // imported — this file already avoids a compile-time dependency on the main
@@ -946,7 +980,7 @@ export function createInterceptor(
   const bindAudit = options?.bindAudit;
   /** Args of the in-flight tool call — used only to mint #224 actionKey. */
   let lastCallArgs: Record<string, unknown> | undefined;
-  const actionGuardCfg: ActionGuardConfig = config.actionGuard ?? { enabled: true, enforce: true, autoApprove: [] };
+  const actionGuardCfg: ActionGuardConfig = config.actionGuard ?? { enabled: false, enforce: true, autoApprove: [] };
   const evaluateToolCall = options?.evaluateToolCall;
   const broker = options?.broker;
   // The judge rides the operator's own model pool, so its calls are their cost
@@ -1304,25 +1338,74 @@ export function createInterceptor(
       }
     }
 
+    // ── Native contract drift observation ────────────────────────────────
+    // A reviewed host contract grew fields ShieldCortex does not read. The
+    // guard already dropped them before nested validation and before any
+    // extractor, so nothing here can change the verdict — this is the record
+    // that the drop HAPPENED, which is the only way an operator learns a host
+    // schema moved without a card storm telling them. It rides on the call's
+    // own outcome rather than minting a row of its own, so a drifted benign
+    // allow stays a single row and volume discipline holds. `auditAllows:false`
+    // opts out with the rest of the recognised-allow stream.
+    const drift = v.contractDrift && v.contractDrift.droppedKeys.length > 0
+      ? { contractDrift: v.contractDrift }
+      : undefined;
+    if (v.decision === 'allow' && drift && actionGuardCfg.auditAllows !== false) {
+      const d = drift.contractDrift;
+      log.warn(
+        `[shieldcortex] action-guard CONTRACT DRIFT ${context.toolName} (${d.contract}): dropped unread field(s) ${d.droppedKeys.join(', ')}${d.truncated ? ', …' : ''}`,
+      );
+    }
+
     if (v.decision === 'allow') {
       // Issue #95: a RECOGNISED allow (the guard evaluated a known operation
       // family and let it through — severity above benign) leaves an audit
       // entry, so forensics can distinguish "scanned & allowed" from "never
       // scanned". Benign allows stay unaudited by design (volume discipline);
       // `actionGuard.auditAllows: false` opts the recognised entries off too.
-      if (v.severity !== 'benign' && actionGuardCfg.auditAllows !== false) {
-        const allowPreview = `${context.toolName} :: ${summariseToolArgs(context.arguments)}`;
-        emitAudit({ ...guardAuditBase(context.toolName, v, allowPreview), action: 'allow', outcome: 'allowed' });
+      if (actionGuardCfg.auditAllows !== false) {
+        if (v.severity !== 'benign') {
+          const allowPreview = `${context.toolName} :: ${summariseToolArgs(context.arguments)}`;
+          emitAudit({ ...guardAuditBase(context.toolName, v, allowPreview), ...(drift ?? {}), action: 'allow', outcome: 'allowed' });
+        } else if (drift) {
+          // A benign allow is normally unaudited — but drift is the one thing
+          // about it worth keeping, so it rides on ONE row of its own rather
+          // than doubling the recognised-allow row above. The preview is the
+          // tool name and nothing else: a drifted field may hold a prompt or a
+          // token, and unlike `summariseToolArgs` this row must never be a
+          // channel for a value the guard just refused to read.
+          emitAudit({
+            ...guardAuditBase(context.toolName, v, `${context.toolName} :: contract-drift`),
+            ...drift,
+            action: 'allow',
+            outcome: 'allowed',
+          });
+        }
       }
       return;
     }
 
     const preview = `${context.toolName} :: ${summariseToolArgs(context.arguments)}`;
-    const base = { ...guardAuditBase(context.toolName, v, preview), ...(escalation ? { escalated: escalation } : {}) };
+    const base = { ...guardAuditBase(context.toolName, v, preview), ...(escalation ? { escalated: escalation } : {}), ...(drift ?? {}) };
     const severity: Severity = v.severity === 'catastrophic' ? 'critical' : 'high';
 
     // Catastrophic / exfil — hard block, always enforced when the guard is enabled.
-    if (v.decision === 'block') {
+    // #436: the door-less throw is for that tier only. A schema rejection falls
+    // through to requireApproval so the operator can still say yes. autoApprove
+    // and enforce:false must not widen an unscanned call — they skip below.
+    const terminalBlock = v.decision === 'block'
+      && (v.severity === 'catastrophic' || v.severity === 'critical');
+    // Derived from the guard's OWN schema signal, not from `decision`. The core
+    // answers a scanned-clean schema rejection with `require_approval` (so all
+    // three planes say the same word about the same call), which means
+    // `decision === 'block'` no longer identifies the class. Keying off the
+    // decision here would silently re-open exactly what #436 closed:
+    // `{command:'…', evil:'…'}` running unscanned on an `enforce:false` host,
+    // and `autoApprove: ['unknown-keys']` becoming a blanket bypass of the #412
+    // closed schema. The residual `decision === 'block' && !terminalBlock` arm
+    // is kept for any sub-catastrophic block a future rule mints.
+    const unscannedBlock = isSchemaInvalid(v) || (v.decision === 'block' && !terminalBlock);
+    if (terminalBlock) {
       // #227: release any lease this call minted early — a blocked action must
       // not leave a hold on that scope (self-heals at TTL if release fails).
       if (leaseGate?.acquired) {
@@ -1342,7 +1425,7 @@ export function createInterceptor(
     // legitimate dangerous work. It NEVER applies to catastrophic ops — those
     // hard-block above, before this branch is reached.
     const autoApprove = actionGuardCfg.autoApprove ?? [];
-    if (autoApprove.length > 0) {
+    if (autoApprove.length > 0 && !unscannedBlock) {
       const hay = [v.family, v.action, ...v.signals].map(s => String(s).toLowerCase());
       const matched = autoApprove.some(a => {
         const n = a.toLowerCase();
@@ -1356,7 +1439,8 @@ export function createInterceptor(
 
     // require_approval — ENFORCED by default (P1/WS1). `enforce:false` opts back
     // down to warn-and-allow (advisory) for operators who want the old behaviour.
-    if (!actionGuardCfg.enforce) {
+    // #436: an unscanned schema rejection must not become an advisory allow.
+    if (!actionGuardCfg.enforce && !unscannedBlock) {
       log.warn(`[shieldcortex] ⚠️ Action Guard: ${context.toolName} — ${v.reason}`);
       emitAudit({ ...base, action: 'warn', outcome: 'warned' });
       return;
@@ -1380,7 +1464,7 @@ export function createInterceptor(
       throw new Error(`ShieldCortex: tool call blocked — ${brokered.reason}`);
     }
 
-    if (brokered?.outcome === 'pre_clear') {
+    if (brokered?.outcome === 'pre_clear' && !unscannedBlock) {
       // Reversible, on-host, in-context, judge-confident: proceed without
       // waiting. Loud on purpose — a release nobody approved must never be a
       // silent one, because the audit row is the only thing that will ever tell

package/openclaw.plugin.json

@@ -1,6 +1,6 @@
 {
   "id": "shieldcortex-realtime",
-  "version": "4.54.13",
+  "version": "4.54.15",
   "name": "ShieldCortex Real-time Scanner",
   "description": "Real-time defence scanning on LLM input, memory extraction on LLM output, and active tool call interception with approval gating.",
   "kind": null,
@@ -304,7 +304,7 @@
             "properties": {
               "enabled": {
                 "type": "boolean",
-                "default": true
+                "default": false
               },
               "enforce": {
                 "type": "boolean",
@@ -427,7 +427,7 @@
         "properties": {
           "enabled": {
             "type": "boolean",
-            "default": true
+            "default": false
           },
           "enforce": {
             "type": "boolean",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@drakon-systems/shieldcortex-realtime",
-  "version": "4.54.13",
+  "version": "4.54.15",
   "description": "OpenClaw plugin for ShieldCortex real-time defence scanning and optional memory extraction.",
   "type": "module",
   "main": "./dist/index.js",