devlyn-cli 2.9.3 → 2.10.1

package/config/skills/_shared/archive_run.py

@@ -27,7 +27,19 @@ PER_RUN_PATTERNS = (
     "*.findings.jsonl",
     "*.log.md",
     "fix-batch.round-*.json",
+    "closure-durability.round-*.json",
+    "resolve-stop-hook.*.json",
     "criteria.generated.md",
+    "goal.raw.txt",
+    "surface-close.input.patch",
+    "surface-close.prompt",
+    "surface-close.output.json",
+    "surface-close.stdout",
+    # Mutation workers retain the exact session JSONL identified by their
+    # dispatch receipt. Round-scoped root files avoid engine-global scans.
+    "implement.worker-session.*.jsonl",
+    "surface-close.worker-session.*.jsonl",
+    "cleanup.worker-session.*.jsonl",
     "risk-probes.jsonl",
     # Probe scripts referenced by risk-probes.jsonl are archived by
     # move_probe_scripts() to preserve probes/<file> layout.
@@ -159,6 +171,15 @@ def self_test() -> int:
         )
         for name in (
             "risk-probes.jsonl",
+            "goal.raw.txt",
+            "surface-close.input.patch",
+            "surface-close.prompt",
+            "surface-close.output.json",
+            "surface-close.stdout",
+            "implement.worker-session.0.jsonl",
+            "surface-close.worker-session.0.jsonl",
+            "cleanup.worker-session.1.jsonl",
+            "resolve-stop-hook.run-1.123.456.json",
             "verify.pair.findings.jsonl",
             "verify-merge.summary.json",
             "codex-judge.stdout",
@@ -169,13 +190,24 @@ def self_test() -> int:
             (devlyn / name).write_text("{}\n", encoding="utf-8")
         (devlyn / "probes").mkdir()
         (devlyn / "probes" / "P1.py").write_text("print('probe')\n", encoding="utf-8")
+        global_rollout = devlyn / "engine-sessions" / "rollout-global.jsonl"
+        global_rollout.parent.mkdir()
+        global_rollout.write_text("{}\n", encoding="utf-8")
         run_id = read_run_id(devlyn)
         assert run_id == "run-1", run_id
         moved = move_artifacts(devlyn, devlyn / "runs" / run_id)
-        assert moved >= 9, moved
+        assert moved >= 12, moved
         for name in (
             "pipeline.state.json",
             "risk-probes.jsonl",
+            "goal.raw.txt",
+            "surface-close.input.patch",
+            "surface-close.prompt",
+            "surface-close.output.json",
+            "surface-close.stdout",
+            "implement.worker-session.0.jsonl",
+            "surface-close.worker-session.0.jsonl",
+            "cleanup.worker-session.1.jsonl",
             "probes/P1.py",
             "verify.pair.findings.jsonl",
             "verify-merge.summary.json",
@@ -185,6 +217,8 @@ def self_test() -> int:
             "claude-judge.stderr",
         ):
             assert (devlyn / "runs" / run_id / name).is_file(), name
+        assert global_rollout.is_file(), "engine-global session files must stay untouched"
+        assert not (devlyn / "runs" / run_id / global_rollout.name).exists()
 
         bad = pathlib.Path(tmp) / "bad"
         bad.mkdir()

package/config/skills/_shared/collect-codex-findings.py

@@ -1,17 +1,27 @@
 #!/usr/bin/env python3
-"""Normalize raw Codex pair-JUDGE stdout into canonical VERIFY JSONL."""
+"""Normalize raw pair-JUDGE stdout into canonical VERIFY JSONL."""
 
 from __future__ import annotations
 
 import argparse
 import json
 import pathlib
+import runpy
 import sys
 import tempfile
 from typing import Any
 
 
 FINDING_SEVERITIES = {"CRITICAL", "HIGH", "MEDIUM", "LOW", "INFO"}
+ENVELOPE_KEYS = {"text", "stopReason", "sessionId", "requestId"}
+IGNORABLE_FENCES = {"```", "```json", "```jsonl"}
+MERGE_CONTRACT = runpy.run_path(pathlib.Path(__file__).with_name("verify-merge-findings.py"))
+VERDICT_RANK = MERGE_CONTRACT["VERDICT_RANK"]
+finding_rank = MERGE_CONTRACT["finding_rank"]
+NARRATIVE_PREAMBLE_BYTES = frozenset(
+    b"\t\n\r !\"$%&'()*+,-./0123456789:;<=>?@"
+    b"ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_abcdefghijklmnopqrstuvwxyz|}~"
+) | frozenset(range(0x80, 0x100))
 
 
 def reject_json_constant(token: str) -> None:
@@ -32,71 +42,242 @@ def atomic_write(path: pathlib.Path, text: str) -> None:
     pathlib.Path(tmp_name).replace(path)
 
 
-def collect(stdout_path: pathlib.Path) -> tuple[list[dict[str, Any]], dict[str, Any] | None]:
+def collect_text(
+    text: str, source: pathlib.Path
+) -> tuple[list[dict[str, Any]], dict[str, Any] | None]:
     findings: list[dict[str, Any]] = []
     summary: dict[str, Any] | None = None
-    with stdout_path.open(encoding="utf-8") as handle:
-        for line_no, line in enumerate(handle, 1):
-            raw = line.strip()
-            if not raw:
-                continue
-            if raw.startswith("# SUMMARY "):
-                try:
-                    item = loads_strict_json(raw.removeprefix("# SUMMARY ").strip())
-                except ValueError as exc:
-                    raise SystemExit(f"error: invalid SUMMARY JSON at {stdout_path}:{line_no}: {exc}")
-                if not isinstance(item, dict):
-                    raise SystemExit(f"error: SUMMARY is not an object at {stdout_path}:{line_no}")
-                summary = item
-                continue
-            if raw.startswith("#"):
-                continue
+    for line_no, line in enumerate(text.splitlines(), 1):
+        raw = line.strip()
+        if not raw or raw in IGNORABLE_FENCES:
+            continue
+        if raw.startswith("# SUMMARY "):
+            if summary is not None:
+                raise SystemExit(f"error: record after terminal SUMMARY at {source}:{line_no}")
             try:
-                item = loads_strict_json(raw)
+                item = loads_strict_json(raw.removeprefix("# SUMMARY ").strip())
             except ValueError as exc:
-                raise SystemExit(f"error: invalid JSONL at {stdout_path}:{line_no}: {exc}")
+                raise SystemExit(f"error: invalid SUMMARY JSON at {source}:{line_no}: {exc}")
             if not isinstance(item, dict):
-                raise SystemExit(f"error: JSONL item is not an object at {stdout_path}:{line_no}")
-            severity = str(item.get("severity") or "").upper()
-            if severity not in FINDING_SEVERITIES:
-                raise SystemExit(f"error: finding missing valid severity at {stdout_path}:{line_no}")
-            findings.append(item)
-    if not findings and summary is None:
-        raise SystemExit("error: Codex pair-JUDGE stdout contained no JSONL findings or PASS line")
-    if summary and summary.get("verdict") in {"NEEDS_WORK", "FAIL", "BLOCKED"} and not findings:
+                raise SystemExit(f"error: SUMMARY is not an object at {source}:{line_no}")
+            if item.get("verdict") not in VERDICT_RANK:
+                raise SystemExit(f"error: SUMMARY has unknown verdict at {source}:{line_no}")
+            summary = item
+            continue
+        if raw.startswith("#"):
+            continue
+        if summary is not None:
+            raise SystemExit(f"error: record after terminal SUMMARY at {source}:{line_no}")
+        try:
+            item = loads_strict_json(raw)
+        except ValueError as exc:
+            raise SystemExit(f"error: invalid JSONL at {source}:{line_no}: {exc}")
+        if not isinstance(item, dict):
+            raise SystemExit(f"error: JSONL item is not an object at {source}:{line_no}")
+        if set(item) == {"verdict"}:
+            if item["verdict"] not in VERDICT_RANK:
+                raise SystemExit(f"error: SUMMARY has unknown verdict at {source}:{line_no}")
+            summary = item
+            continue
+        severity = str(item.get("severity") or "").upper()
+        if severity not in FINDING_SEVERITIES:
+            raise SystemExit(f"error: finding missing valid severity at {source}:{line_no}")
+        findings.append(item)
+    if summary is not None and summary["verdict"] == "PASS" and any(
+        finding_rank(finding) == 2 for finding in findings
+    ):
+        raise SystemExit("error: verdict-binding finding cannot have a PASS SUMMARY")
+    if not findings and (summary is None or summary.get("verdict") != "PASS"):
         raise SystemExit("error: non-PASS SUMMARY without JSONL findings")
     return findings, summary
 
 
+def recover_envelope_text(
+    text: str, source: pathlib.Path
+) -> tuple[list[dict[str, Any]], dict[str, Any] | None]:
+    encoded = text.encode("utf-8")
+    for cut, byte in enumerate(encoded[:-1], 1):
+        if byte not in NARRATIVE_PREAMBLE_BYTES:
+            break
+        try:
+            candidate = encoded[cut:].decode("utf-8")
+        except UnicodeDecodeError:
+            continue
+        try:
+            findings, summary = collect_text(candidate, source)
+        except SystemExit:
+            continue
+        if (
+            summary is not None
+            and summary["verdict"] == "NEEDS_WORK"
+            and any(finding_rank(finding) == 2 for finding in findings)
+        ):
+            return findings, summary
+    raise SystemExit("error: no admissible envelope recovery")
+
+
+def collect_stdout(stdout_path: pathlib.Path) -> tuple[list[dict[str, Any]], dict[str, Any] | None]:
+    stdout_text = stdout_path.read_text(encoding="utf-8")
+    try:
+        candidate = loads_strict_json(stdout_text)
+    except ValueError:
+        candidate = None
+    if (
+        not isinstance(candidate, dict)
+        or not ENVELOPE_KEYS.issubset(candidate)
+        or "severity" in candidate
+    ):
+        return collect_text(stdout_text, stdout_path)
+
+    stop_reason = candidate["stopReason"]
+    if stop_reason != "EndTurn":
+        raise SystemExit(
+            f"error: envelope stopReason must be 'EndTurn' at {stdout_path}; "
+            f"got {stop_reason!r}"
+        )
+    envelope_text = candidate["text"]
+    if not isinstance(envelope_text, str):
+        raise SystemExit(f"error: envelope text must be a string at {stdout_path}")
+
+    try:
+        return collect_text(envelope_text, stdout_path)
+    except SystemExit as exc:
+        try:
+            return recover_envelope_text(envelope_text, stdout_path)
+        except SystemExit:
+            raise SystemExit(f"error: envelope text rejected: {exc}") from None
+
+
 def self_test() -> int:
     with tempfile.TemporaryDirectory() as tmp:
         root = pathlib.Path(tmp)
-        stdout_path = root / "codex-judge.stdout"
+        stdout_path = root / "pair-judge.stdout"
         out_path = root / "verify.pair.findings.jsonl"
-        summary_path = root / "codex-judge.summary.json"
+        summary_path = root / "pair-judge.summary.json"
+
+        def assert_rejected(text: str, label: str, *message_parts: str) -> None:
+            stdout_path.write_text(text, encoding="utf-8")
+            try:
+                collect_stdout(stdout_path)
+            except SystemExit as exc:
+                message = str(exc)
+                assert all(part in message for part in message_parts)
+            else:
+                raise AssertionError(f"{label} must be rejected")
+
+        plain_finding = {"id": "a", "severity": "HIGH"}
+        plain_summary = {"verdict": "NEEDS_WORK"}
         stdout_path.write_text(
-            json.dumps({"id": "a", "severity": "HIGH"}) + "\n"
-            + '# SUMMARY {"verdict":"NEEDS_WORK"}\n',
+            json.dumps(plain_finding) + "\n"
+            + "# SUMMARY " + json.dumps(plain_summary) + "\n",
             encoding="utf-8",
         )
-        findings, summary = collect(stdout_path)
+        findings, summary = collect_stdout(stdout_path)
+        assert findings == [plain_finding]
+        assert summary == plain_summary
         write_outputs(findings, summary, out_path, summary_path)
         assert out_path.read_text(encoding="utf-8").count("\n") == 1
         assert loads_strict_json(summary_path.read_text(encoding="utf-8"))["verdict"] == "NEEDS_WORK"
-        stdout_path.write_text('{"id":"nan","severity":NaN}\n', encoding="utf-8")
-        try:
-            collect(stdout_path)
-        except SystemExit as exc:
-            assert "invalid JSON numeric constant: NaN" in str(exc)
-        else:
-            raise AssertionError("NaN Codex stdout finding must not normalize")
-        stdout_path.write_text("", encoding="utf-8")
-        try:
-            collect(stdout_path)
-        except SystemExit as exc:
-            assert "no JSONL findings" in str(exc)
-        else:
-            raise AssertionError("empty Codex stdout must not normalize to PASS")
+        assert_rejected(
+            '{"id":"nan","severity":NaN}\n',
+            "NaN pair-JUDGE stdout finding",
+            "invalid JSON numeric constant: NaN",
+        )
+        rejection_cases = (
+            ("", "no SUMMARY line", "non-PASS SUMMARY without JSONL findings"),
+            ('# SUMMARY {}\n', "empty SUMMARY object", "SUMMARY has unknown verdict"),
+            ('# SUMMARY {"verdict":"pass"}\n', "lowercase pass", "SUMMARY has unknown verdict"),
+            ('# SUMMARY {"verdict":"UNKNOWN"}\n', "unknown verdict", "SUMMARY has unknown verdict"),
+        )
+        for text, label, message in rejection_cases:
+            assert_rejected(
+                text,
+                label,
+                message,
+            )
+
+        def envelope(text: Any, stop_reason: str = "EndTurn") -> str:
+            return json.dumps(
+                {
+                    "text": text,
+                    "stopReason": stop_reason,
+                    "sessionId": "session",
+                    "requestId": "request",
+                }
+            )
+
+        envelope_finding = {
+            "id": "envelope-finding",
+            "severity": "HIGH",
+            "detail": {"preserved": True},
+        }
+        envelope_summary = {"verdict": "NEEDS_WORK"}
+        stdout_path.write_text(
+            envelope(
+                json.dumps(envelope_finding)
+                + "\n# SUMMARY "
+                + json.dumps(envelope_summary)
+                + "\n"
+            ),
+            encoding="utf-8",
+        )
+        findings, summary = collect_stdout(stdout_path)
+        assert findings == [envelope_finding]
+        assert summary == envelope_summary
+
+        assert_rejected(
+            envelope("review completed without findings"),
+            "findings-less envelope text",
+            "error: envelope text rejected: error: invalid JSONL",
+        )
+        assert_rejected(
+            envelope('{"findings":[],"verdict":"PASS"}', "Cancelled"),
+            "Cancelled envelope",
+            "envelope stopReason must be 'EndTurn'",
+            "'Cancelled'",
+        )
+        assert_rejected(
+            envelope("", "UnknownStop"),
+            "unknown envelope stopReason",
+            "envelope stopReason must be 'EndTurn'",
+            "'UnknownStop'",
+        )
+        assert_rejected(
+            envelope(None),
+            "non-string envelope text",
+            "error: envelope text must be a string",
+        )
+        welded = (
+            "I will inspect the result."
+            + json.dumps(envelope_finding)
+            + "\n# SUMMARY "
+            + json.dumps(envelope_summary)
+            + "\n"
+        )
+        stdout_path.write_text(envelope(welded), encoding="utf-8")
+        findings, summary = collect_stdout(stdout_path)
+        assert findings == [envelope_finding]
+        assert summary == envelope_summary
+        dual_document = (
+            json.dumps(envelope_finding)
+            + json.dumps({"id": "second", "severity": "LOW"})
+            + "\n# SUMMARY "
+            + json.dumps(envelope_summary)
+            + "\n"
+        )
+        assert_rejected(
+            envelope(dual_document),
+            "concatenated envelope documents",
+            "error: envelope text rejected: error: invalid JSONL",
+        )
+        clean_summary = {"verdict": "PASS"}
+        stdout_path.write_text(
+            envelope("# SUMMARY " + json.dumps(clean_summary) + "\n"),
+            encoding="utf-8",
+        )
+        findings, summary = collect_stdout(stdout_path)
+        assert findings == []
+        assert summary == clean_summary
     return 0
 
 
@@ -117,9 +298,9 @@ def write_outputs(
 def main() -> int:
     parser = argparse.ArgumentParser(description=__doc__)
     parser.add_argument("--devlyn-dir", default=".devlyn")
-    parser.add_argument("--stdout-file", default="codex-judge.stdout")
+    parser.add_argument("--stdout-file", default="pair-judge.stdout")
     parser.add_argument("--out", default="verify.pair.findings.jsonl")
-    parser.add_argument("--summary-out", default="codex-judge.summary.json")
+    parser.add_argument("--summary-out", default="pair-judge.summary.json")
     parser.add_argument("--self-test", action="store_true")
     args = parser.parse_args()
     if args.self_test:
@@ -130,7 +311,7 @@ def main() -> int:
     if not stdout_path.is_file():
         sys.stderr.write(f"error: {stdout_path} not found\n")
         return 1
-    findings, summary = collect(stdout_path)
+    findings, summary = collect_stdout(stdout_path)
     write_outputs(findings, summary, devlyn / args.out, devlyn / args.summary_out)
     print(json.dumps({"findings_count": len(findings), "summary": summary}, sort_keys=True))
     return 0

package/config/skills/_shared/engine-doctor.sh

@@ -17,12 +17,13 @@ set -uo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" && pwd)"
 ADAPTERS_DIR="$SCRIPT_DIR/adapters"
 
-TARGETS=(claude codex omp pi)
-KINDS=(cli-engine cli-engine cli-engine orchestrator-only)
-BINARIES=(claude codex omp "")
+TARGETS=(claude codex grok omp pi)
+KINDS=(cli-engine cli-engine cli-engine cli-engine orchestrator-only)
+BINARIES=(claude codex grok omp "")
 INSTALL_HINTS=(
   "see https://docs.anthropic.com/en/docs/claude-code"
   "npm install -g @openai/codex"
+  "see https://docs.x.ai/build/overview (install + browser auth)"
   "brew install can1357/tap/omp"
   ""
 )
@@ -88,6 +89,8 @@ for i in "${!TARGETS[@]}"; do
       ;;
   esac
 
+  [ "$target" = 'grok' ] && note='not emission-certified; BLOCKED pair source'
+
   printf '%-8s %-17s %-8s %-8s %-14s %-12s %s\n' \
     "$target" "$kind" "$binary" "$adapter" "$role" "$pin_eligible" "$note"
 done

package/config/skills/_shared/engine-preflight.md

@@ -4,12 +4,12 @@ Used by `/devlyn:resolve` and `/devlyn:ideate`. One shared availability rule so
 
 ## Rule
 
-Each skill resolves the effective engine from its own SKILL.md default plus any explicit `--engine` flag passed by the user. `/devlyn:resolve` also computes conditional pair/risk-probe requirements before the phase that needs the OTHER engine.
+Each skill resolves the effective engine from its own SKILL.md default plus any explicit `--engine` flag passed by the user. `/devlyn:resolve` also computes the default VERIFY-pair route and conditional risk-probe requirements before the phase that needs the OTHER engine.
 
 Engine requirements have two classes:
 
 - **Explicit routes** — `--engine`, `--risk-probes`, `--pair-verify`. These are promises. If the required engine is unavailable, fail closed with `BLOCKED:<engine>-unavailable` and never downgrade to solo.
-- **Automatic escalations** — auto high-risk risk-probes and auto VERIFY pair-JUDGE inferred from the spec. These are candidate routes, selected only when their preconditions hold, OTHER-engine availability included. If an auto candidate would fire but the OTHER engine is absent, do not select the cross-engine route: proceed solo and report the skipped escalation and its reason. This is route selection, not a fallback.
+- **Automatic routes** — high-risk risk-probes remain conditional; VERIFY pair-JUDGE is selected by default unless `--no-pair` was passed. Both require an available OTHER engine. If it is absent, proceed solo and report the skipped route and reason. This is route selection, not a fallback.
 
 ## Role resolution
 
@@ -32,11 +32,11 @@ When a run or phase requires engine `<name>` (claude, codex, omp, or any adapter
 
 Never prompt the user mid-pipeline. Missing engines for explicit routes are BLOCKED states, not silent fallbacks. Missing OTHER engines for automatic escalations are reported solo-skips, not fallbacks — the auto route was never selected.
 
-Per-skill defaults: `/devlyn:resolve` uses Claude for PLAN/IMPLEMENT when the orchestrator has Claude Code's native Agent primitive; Codex CLI and oh-my-pi orchestrators use their own fresh worker as the default route (Codex child process, omp native `task`) so the pipeline still has structural phase isolation. VERIFY may invoke the OTHER engine when its pair-JUDGE trigger fires. `/devlyn:ideate` defaults to Claude; `--engine` selects the elicitation/normalization adapter, not an automatic cross-model challenge phase. Any future ideate read-only critique must follow `_shared/codex-config.md` isolation rules. Each SKILL.md flag block is source of truth for that skill's default.
+Per-skill defaults: `/devlyn:resolve` uses Claude for PLAN/IMPLEMENT when the orchestrator has Claude Code's native Agent primitive; Codex CLI and oh-my-pi orchestrators use their own fresh worker as the default route (Codex child process, omp native `task`) so the pipeline still has structural phase isolation. VERIFY invokes the OTHER engine by default when available unless `--no-pair` was passed. `/devlyn:ideate` defaults to Claude; `--engine` selects the elicitation/normalization adapter, not an automatic cross-model challenge phase. Any future ideate read-only critique must follow `_shared/codex-config.md` isolation rules. Each SKILL.md flag block is source of truth for that skill's default.
 
 ## What a skill must report after a BLOCKED engine check
 
-When an engine required by the selected route or conditional pair trigger is absent, the final user-facing report/summary shows the requested route, the missing engine, and setup steps:
+When an engine required by the selected route or default VERIFY pair route is absent, the final user-facing report/summary shows the requested route, the missing engine, and setup steps:
 
 ```
 Engine: claude + codex pair required
@@ -48,4 +48,11 @@ Do not report a downgraded successful run when a required engine is missing.
 
 ## Canonical cross-engine invocations
 
-After the availability check passes: a Claude-side orchestrator spawning a Codex judge/worker uses `config/skills/_shared/codex-config.md` (monitored wrapper, canonical flag set); a non-Claude orchestrator spawning a Claude judge uses `_shared/adapters/claude.md` `## Invocation` (headless `claude -p`, locked-down allowlist, hermetic settings).
+After the availability check passes, Codex keeps the monitored `codex-monitored.sh`
+path; every other resolved OTHER engine follows `_shared/adapters/<name>.md`
+`## Invocation`. Capture `.devlyn/<name>-judge.stdout`, then normalize it with
+`collect-codex-findings.py --devlyn-dir "<abs repo>/.devlyn" --stdout-file
+<name>-judge.stdout`. A non-zero collector exit writes no canonical findings:
+the pair source is `BLOCKED` for `verify.pair.emission-contract`, and unparsed
+stdout remains diagnostic-only rather than being merged. On exit 124, the
+timeout marker's `engine` field is the resolved `<name>`.

package/config/skills/_shared/expected.schema.json

@@ -24,6 +24,13 @@
             "description": "Required exit code. Default 0 if omitted.",
             "default": 0
           },
+          "timeout_sec": {
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 600,
+            "description": "Per-command timeout in seconds. Default 60 if omitted; maximum 600.",
+            "default": 60
+          },
           "stdout_contains": {
             "type": "array",
             "description": "Each substring must appear verbatim in (stdout + stderr) for pass.",

package/config/skills/_shared/grok-anchor-guard.py

@@ -0,0 +1,61 @@
+#!/usr/bin/env python3
+"""Deny pair-judge shell outside the probe anchor, with a model-readable reason.
+
+Registered as a native grok `PreToolUse` hook. It fires at step 1 of the
+authorization pipeline, before the permission rules and before the mode policy
+whose auto-deny silently terminates the review at exit 0 (iter-0081).
+
+The anchor is supplied via DEVLYN_PROBE_ANCHOR, derived by the orchestrator from
+the same source as the --allow rule.
+
+Measured (iter-0081 M-C6 v2, external isolation, admissible cell): Line A 6/6 —
+the denial arrives as a model-visible tool_result, the judge re-routes to
+read_file, the anchor still executes inside the grok process, EndTurn with zero
+PermissionCancelled. Line A-chain 1/1 — `<anchor> && <write>` is denied
+model-visibly, neither segment executes, and the judge then runs the bare anchor.
+"""
+import json
+import os
+import sys
+
+REASON = (
+    "DEVLYN-0081-HOOK-DENY: this shell command is outside the permitted probe "
+    "anchor. Use the read_file tool for file reads. The only permitted shell "
+    "command is the anchor named in your prompt, unchained."
+)
+
+SHELL_TOOLS = {"run_terminal_command", "run_terminal_cmd", "Bash"}
+
+# A conservative, quote-OBLIVIOUS lexical veto — deliberately not a shell parser.
+# It rejects these characters even inside quotes, over-denying rather than ever
+# under-denying a chain. Adding quote-, escape-, or operator-aware exceptions is
+# how this becomes a parser; that is a registered falsifier, not a polish.
+FORBIDDEN = set(";&|`$()<>") | {"\n", "\r"}
+
+
+def main():
+    anchor = os.environ.get("DEVLYN_PROBE_ANCHOR", "")
+    payload = json.load(sys.stdin)
+
+    if payload.get("toolName") not in SHELL_TOOLS or not anchor:
+        print(json.dumps({"decision": "allow"}))
+        return
+
+    # The anchor, or the anchor plus argv, and nothing that could start a second
+    # command. A bare prefix rule would allow `<anchor> && <other>` — the vendor's
+    # own documented footgun. Exact match would instead deny `<anchor> --n 5`,
+    # mechanically destroying the "bounded input variations" that verify.md
+    # requires of every engine. Both were rejected by both seats (iter-0081 v2).
+    command = (payload.get("toolInput") or {}).get("command", "").strip()
+    if command == anchor or (
+        command.startswith(anchor + " ")
+        and not any(ch in FORBIDDEN for ch in command)
+    ):
+        print(json.dumps({"decision": "allow"}))
+        return
+
+    print(json.dumps({"decision": "deny", "reason": REASON}))
+
+
+if __name__ == "__main__":
+    main()