prae-cli 0.6.1 → 0.7.0

package/lib/bin.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import "./evaluate-CkYySl7T.js";
-import "./views-CAD9738P.js";
-import { t as main } from "./cli-BUgU-LpN.js";
+import "./views-UODslKwu.js";
+import { t as main } from "./cli-chtNj_el.js";
 import "./src-Ciggx9ja.js";
 
 //#region src/bin.ts

package/lib/{cli-BUgU-LpN.js → cli-chtNj_el.js}

@@ -1,7 +1,7 @@
 import { t as evaluate } from "./evaluate-CkYySl7T.js";
-import { a as renderPacks, c as renderShell, d as cite, i as renderOverview, l as VERDICT_LABEL$1, n as renderApprovals, o as esc, r as renderCompliance, s as renderNav, t as navFor, u as FRAMEWORKS } from "./views-CAD9738P.js";
-import { m as seal, t as Ledger } from "./src-Ciggx9ja.js";
-import { existsSync, readFileSync } from "node:fs";
+import { a as renderPacks, c as renderNav, d as FRAMEWORKS, f as cite, i as renderOverview, l as renderShell, n as renderApprovals, o as CONTROLS, r as renderCompliance, s as esc, t as navFor, u as VERDICT_LABEL$1 } from "./views-UODslKwu.js";
+import { f as chain, i as fingerprint, l as verifySignature, m as seal, n as readEntries, r as verifyEntries, t as Ledger, u as GENESIS } from "./src-Ciggx9ja.js";
+import { existsSync, readFileSync, readdirSync, statSync, watch } from "node:fs";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { dirname, extname, join, normalize, resolve, sep } from "node:path";
 import { homedir } from "node:os";
@@ -752,7 +752,9 @@ function praeRow(options) {
 	];
 	if (options.ledger !== void 0) lines.push(`        ledger: ${JSON.stringify(options.ledger)}`);
 	if (options.approver !== void 0) lines.push(`        approver: ${JSON.stringify(options.approver)}`);
-	lines.push("        pack: |", indent(options.pack, 10));
+	if (options.mode !== void 0) lines.push(`        mode: ${options.mode}`);
+	if (options.packFile !== void 0) lines.push(`        packFile: ${JSON.stringify(options.packFile)}`);
+	else lines.push("        pack: |", indent(options.pack ?? "", 10));
 	return lines.join("\n");
 }
 /** Compose the write and check it, without touching the file. */
@@ -792,6 +794,60 @@ async function applyWrite(profile, plan, expectedRevision) {
 	return { snapshot: manifest.id };
 }
 
+//#endregion
+//#region src/record-files.ts
+function jsonOrNull(path) {
+	if (!existsSync(path)) return null;
+	try {
+		return JSON.parse(readFileSync(path, "utf8"));
+	} catch {
+		return null;
+	}
+}
+function readLedger(path) {
+	if (!existsSync(path)) return [];
+	const out = [];
+	for (const line of readFileSync(path, "utf8").split("\n")) {
+		if (line.trim() === "") continue;
+		try {
+			out.push(JSON.parse(line));
+		} catch {}
+	}
+	return out;
+}
+/** The defaults the demo writes; a caller with other names overrides them. */
+const DEFAULT_FILES = {
+	ledger: "papaya.jsonl",
+	discovery: "discovery.json",
+	report: "security-report.json",
+	guardians: "guardians.json",
+	pack: "papaya.prae.json",
+	publicKey: "prae-signing.pub.pem",
+	redteam: "../redteam/results"
+};
+function readRecord(dir, files) {
+	return {
+		ledger: readLedger(resolve(dir, files.ledger)),
+		discovery: jsonOrNull(resolve(dir, files.discovery)),
+		report: jsonOrNull(resolve(dir, files.report)),
+		guardians: jsonOrNull(resolve(dir, files.guardians)),
+		pack: jsonOrNull(resolve(dir, files.pack))
+	};
+}
+/** The red-team campaign and its runs, as the runner wrote them; empty when none. */
+function readRedteam(dir, files) {
+	const root = resolve(dir, files.redteam);
+	if (!existsSync(root)) return {
+		campaign: null,
+		runs: []
+	};
+	const runs = readdirSync(root).filter((n) => n.endsWith(".json")).sort().filter((n) => n !== "campaign.json").map((n) => jsonOrNull(resolve(root, n))).filter((r) => r !== null);
+	return {
+		campaign: jsonOrNull(resolve(root, "campaign.json")),
+		runs
+	};
+}
+
 //#endregion
 //#region src/serve.ts
 const TYPES = {
@@ -823,8 +879,233 @@ function safePath(root, urlPath) {
 	if (target !== base && !target.startsWith(base + sep)) return void 0;
 	return target;
 }
-/** Start the reader. Resolves once it is listening. */
-function serveConsole(root, port) {
+/**
+* Verify the ledger the way `prae verify` does — chain, then signatures
+* against the public key beside it. With `tamper`, one row's refusal is
+* changed to an allow in memory first and the altered text is what gets
+* verified: the forged-copy demonstration, without writing a file. With
+* `repair` as well, every hash is recomputed over the altered rows — what
+* an attacker would do to mend the chain — and the signatures, made over the
+* original hashes by a key they do not hold, are what fails. Nothing on disk
+* changes.
+*/
+function verifyRecord(record, tamper, repair = false) {
+	const { dir, files } = record;
+	const path = resolve(dir, files.ledger);
+	if (!existsSync(path)) return {
+		ok: false,
+		entries: 0,
+		problems: [{
+			line: 0,
+			message: "no ledger"
+		}],
+		tampered: null,
+		repaired: false,
+		signatures: null
+	};
+	let text = readFileSync(path, "utf8");
+	let tampered = null;
+	if (tamper !== void 0) {
+		const lines = text.trimEnd().split("\n");
+		const idx = lines.findIndex((line) => {
+			try {
+				return JSON.parse(line).seq === tamper;
+			} catch {
+				return false;
+			}
+		});
+		if (idx >= 0) {
+			const row$1 = JSON.parse(lines[idx]);
+			row$1.verdict = "allow";
+			row$1.reason = "looks fine to me";
+			lines[idx] = JSON.stringify(row$1);
+			if (repair) {
+				let prev = GENESIS;
+				for (let i = 0; i < lines.length; i += 1) {
+					const { seq, prev: _prev, hash: _hash, sig,...rest } = JSON.parse(lines[i]);
+					const entry = chain(rest, seq, prev);
+					lines[i] = JSON.stringify(sig === void 0 ? entry : {
+						...entry,
+						sig
+					});
+					prev = entry.hash;
+				}
+			}
+			text = `${lines.join("\n")}\n`;
+			tampered = tamper;
+		}
+	}
+	const verified = verifyEntries(text);
+	const keyPath = resolve(dir, files.publicKey);
+	let signatures = null;
+	if (existsSync(keyPath)) {
+		const publicKey = readFileSync(keyPath, "utf8");
+		let entries = [];
+		try {
+			entries = readEntries(text);
+		} catch {
+			entries = [];
+		}
+		const signed = entries.filter((e) => e.sig !== void 0);
+		signatures = {
+			checked: signed.length,
+			failed: signed.filter((e) => !verifySignature(e, e.sig, publicKey)).map((e) => e.seq),
+			fingerprint: fingerprint(publicKey)
+		};
+	}
+	return {
+		ok: verified.ok,
+		entries: verified.entries,
+		problems: [...verified.problems],
+		tampered,
+		repaired: tampered !== null && repair,
+		signatures
+	};
+}
+const OWASP = "owasp-llm-top-10-2026";
+/**
+* Evidence toward each control, from the pack and the ledger as they are
+* now — the rows the controls package defines, so the console, the exporter and
+* the old pages cannot disagree about what a profile shows. Framed as
+* evidence, never as compliance: an auditor decides.
+*/
+function complianceOf(record) {
+	const { dir, files } = record;
+	const ledgerPath = resolve(dir, files.ledger);
+	const text = existsSync(ledgerPath) ? readFileSync(ledgerPath, "utf8") : "";
+	let entries = [];
+	try {
+		entries = readEntries(text);
+	} catch {
+		entries = [];
+	}
+	const packPath = resolve(dir, files.pack);
+	let pack;
+	if (existsSync(packPath)) {
+		const parsed = parsePack(readFileSync(packPath, "utf8"));
+		if (parsed.ok) pack = parsed.pack;
+	}
+	const data = {
+		...pack === void 0 ? {} : { pack },
+		entries,
+		verification: verifyEntries(text),
+		generatedAt: (/* @__PURE__ */ new Date()).toISOString()
+	};
+	const owasp = FRAMEWORKS[OWASP]?.controls ?? {};
+	return { controls: CONTROLS.map((control) => {
+		const code = /LLM\d\d/.exec(control.id)?.[0];
+		const named = code === void 0 ? void 0 : owasp[code];
+		return {
+			id: code ?? control.id,
+			...named === void 0 ? {} : { name: named.name },
+			asks: control.asks,
+			framework: named === void 0 ? "obligation" : OWASP,
+			...control.evidence(data)
+		};
+	}) };
+}
+/**
+* The record over HTTP, for the Command Center (apps/console): the same
+* files `prae console` renders, as JSON, plus one event stream that says
+* when the ledger moved. Read-only, from files on disk, nothing computed
+* here — the console derives everything it shows from these bodies.
+*
+* Returns false when the URL is not an API route, so a caller can fall
+* through to static files. Shared with the console's Vite dev server so the
+* two answer identically.
+*/
+function handleApi(req, res, record) {
+	const route = (req.url ?? "").split("?")[0] ?? "";
+	if (!route.startsWith("/api/")) return false;
+	const json = (body, status = 200) => {
+		res.statusCode = status;
+		res.setHeader("content-type", "application/json; charset=utf-8");
+		res.setHeader("cache-control", "no-store");
+		res.end(JSON.stringify(body));
+	};
+	const { dir, files } = record;
+	if (route === "/api/events") {
+		res.writeHead(200, {
+			"content-type": "text/event-stream",
+			"cache-control": "no-store",
+			connection: "keep-alive"
+		});
+		res.write(": connected\n\n");
+		let sent = readRecord(dir, files).ledger.length;
+		const push = () => {
+			const rows = readRecord(dir, files).ledger;
+			if (rows.length < sent) sent = 0;
+			const fresh = rows.slice(sent);
+			sent = rows.length;
+			if (fresh.length > 0) res.write(`data: ${JSON.stringify(fresh)}\n\n`);
+			else res.write(": keepalive\n\n");
+		};
+		const watcher = existsSync(dir) ? watch(dir, { persistent: false }, () => push()) : void 0;
+		const keep = setInterval(push, 2e3);
+		res.on("close", () => {
+			clearInterval(keep);
+			watcher?.close();
+		});
+		return true;
+	}
+	if (route === "/api/verify") {
+		const raw = new URL(req.url ?? "/", "http://localhost").searchParams.get("tamper");
+		const tamper = raw === null ? void 0 : Number(raw);
+		const repair = new URL(req.url ?? "/", "http://localhost").searchParams.get("repair") === "1";
+		json(verifyRecord(record, Number.isInteger(tamper) ? tamper : void 0, repair));
+		return true;
+	}
+	if (route === "/api/compliance") {
+		json(complianceOf(record));
+		return true;
+	}
+	if (route === "/api/redteam") {
+		json(readRedteam(dir, files));
+		return true;
+	}
+	const snapshot = readRecord(dir, files);
+	switch (route) {
+		case "/api/record":
+			json(snapshot);
+			break;
+		case "/api/ledger":
+			json(snapshot.ledger);
+			break;
+		case "/api/discovery":
+			json(snapshot.discovery);
+			break;
+		case "/api/report":
+			json(snapshot.report);
+			break;
+		case "/api/guardians":
+			json(snapshot.guardians);
+			break;
+		case "/api/pack":
+			json(snapshot.pack);
+			break;
+		case "/api/status":
+			json({
+				dir,
+				files: Object.fromEntries(Object.entries(files).map(([name, file]) => {
+					const path = resolve(dir, file);
+					if (!existsSync(path)) return [name, null];
+					const stat$1 = statSync(path);
+					return [name, {
+						size: stat$1.size,
+						mtime: stat$1.mtimeMs
+					}];
+				}))
+			});
+			break;
+		default: json({ error: "not found" }, 404);
+	}
+	return true;
+}
+/**
+* Start the reader. Resolves once it is listening. With a record source,
+* `/api/*` answers from it; without one, only the rendered pages are served.
+*/
+function serveConsole(root, port, record) {
 	const server = createServer((req, res) => {
 		if (req.method !== "GET" && req.method !== "HEAD") {
 			res.statusCode = 405;
@@ -832,6 +1113,7 @@ function serveConsole(root, port) {
 			res.end();
 			return;
 		}
+		if (record !== void 0 && handleApi(req, res, record)) return;
 		const target = safePath(root, req.url ?? "/");
 		if (target === void 0) {
 			res.statusCode = 403;
@@ -852,9 +1134,10 @@ function serveConsole(root, port) {
 	return new Promise((ok, fail$1) => {
 		server.once("error", fail$1);
 		server.listen(port, "127.0.0.1", () => {
+			const address = server.address();
 			ok({
 				server,
-				url: `http://127.0.0.1:${port}/`
+				url: `http://127.0.0.1:${typeof address === "object" && address !== null ? address.port : port}/`
 			});
 		});
 	});
@@ -869,7 +1152,7 @@ const VERDICT_LABEL = {
 	deny: "DENIED",
 	correct: "CORRECTED"
 };
-const USAGE = `prae — operator policy for agent harnesses
+const USAGE = `⌜▪⌟ prae — operator policy for agent harnesses
 
   prae check <pack.json>
       Validate a policy pack and summarise what it enforces.
@@ -931,9 +1214,11 @@ const USAGE = `prae — operator policy for agent harnesses
 
   prae init [--pack <file>] [--profile <dir>] [--ledger <file>]
                 (no --pack mounts the built-in baseline of 8 high-risk rules)
-                  [--approver <name>] [--apply]
+                  [--approver <name>] [--link] [--shadow] [--apply]
       Compose the overlay row that mounts PRAE with a pack. Prints the
-      diff; writes only with --apply.
+      diff; writes only with --apply. --link points the profile at the
+      pack file instead of copying it in, so edits hot-reload; --shadow
+      mounts in shadow mode: every verdict sealed, every call let through.
 `;
 function fail(message) {
 	console.error(`prae: ${message}`);
@@ -1073,7 +1358,7 @@ async function explain(path, tool, pairs) {
 * a key that arrived beside it is checked against nothing.
 */
 async function keygen(dir) {
-	const { generateKeypair, fingerprint } = await import("./src-C9L6NBvu.js");
+	const { generateKeypair, fingerprint: fingerprint$1 } = await import("./src-C9L6NBvu.js");
 	const { writeFileSync: writeFileSync$1 } = await import("node:fs");
 	const keys = generateKeypair();
 	const priv = join(dir, "prae-signing.pem");
@@ -1082,14 +1367,14 @@ async function keygen(dir) {
 	writeFileSync$1(pub, keys.publicKey);
 	console.log(`private     ${priv}  (0600 — this signs; guard it)`);
 	console.log(`public      ${pub}`);
-	console.log(`fingerprint ${fingerprint(keys.publicKey)}`);
+	console.log(`fingerprint ${fingerprint$1(keys.publicKey)}`);
 	console.log("");
 	console.log("Give the PUBLIC key and fingerprint to whoever will verify");
 	console.log("receipts, through a channel they trust. Point the plugin at the");
 	console.log("private key with `signingKey` to sign every row.");
 }
 async function receipt(path, seq, keyPath, out) {
-	const { Ledger: Ledger$1, makeReceipt, fingerprint } = await import("./src-C9L6NBvu.js");
+	const { Ledger: Ledger$1, makeReceipt, fingerprint: fingerprint$1 } = await import("./src-C9L6NBvu.js");
 	const { readFileSync: readFileSync$1 } = await import("node:fs");
 	const { createPublicKey } = await import("node:crypto");
 	const privateKey = readFileSync$1(keyPath, "utf8");
@@ -1106,7 +1391,7 @@ async function receipt(path, seq, keyPath, out) {
 		await writeFile(out, text);
 		console.log(`${out} · seq ${seq} · ${entry.verdict} ${entry.tool} ${entry.subject ?? ""}`);
 	}
-	console.log(`fingerprint ${fingerprint(publicKey)}`);
+	console.log(`fingerprint ${fingerprint$1(publicKey)}`);
 	console.log("The verifier compares that fingerprint against the one they");
 	console.log("pinned — a receipt is only as good as the key they trust.");
 }
@@ -1190,7 +1475,7 @@ async function verify(path, keyPath) {
 		const last = entries.at(-1);
 		console.log(`${result.entries} entries · chain intact${last === void 0 ? "" : ` · seal ${seal(last)}`}`);
 		if (keyPath !== void 0) {
-			const { verifySignature, fingerprint } = await import("./src-C9L6NBvu.js");
+			const { verifySignature: verifySignature$1, fingerprint: fingerprint$1 } = await import("./src-C9L6NBvu.js");
 			const { readFileSync: readFileSync$1 } = await import("node:fs");
 			const publicKey = readFileSync$1(keyPath, "utf8");
 			let signed = 0;
@@ -1198,13 +1483,13 @@ async function verify(path, keyPath) {
 			for (const entry of entries) {
 				if (entry.sig === void 0) continue;
 				signed += 1;
-				if (!verifySignature(entry, entry.sig, publicKey)) bad.push(entry.seq);
+				if (!verifySignature$1(entry, entry.sig, publicKey)) bad.push(entry.seq);
 			}
 			if (bad.length > 0) {
-				console.error(`signatures: ${bad.length} of ${signed} FAIL against ${fingerprint(publicKey)} — rows ${bad.join(", ")}`);
+				console.error(`signatures: ${bad.length} of ${signed} FAIL against ${fingerprint$1(publicKey)} — rows ${bad.join(", ")}`);
 				process.exitCode = 1;
 			} else if (signed === 0) console.log("signatures: none present — this ledger is not signed");
-			else console.log(`signatures: ${signed}/${entries.length} rows verify against ${fingerprint(publicKey)}`);
+			else console.log(`signatures: ${signed}/${entries.length} rows verify against ${fingerprint$1(publicKey)}`);
 		}
 		console.log("tamper-evident: a removed, edited, or reordered row breaks this chain.");
 		console.log("It does not prove against a rewrite of the whole file by someone holding this code.");
@@ -1366,7 +1651,7 @@ async function consoleOut(path, argv) {
 		const [{ ingest }, { extract }, { renderInstructions }] = await Promise.all([
 			import("./src-CraUX64d.js"),
 			import("./src-CQ0UmFUK.js"),
-			import("./instructions-oGCdVxHM.js")
+			import("./instructions-C104EUaE.js")
 		]);
 		const read = ingest(instructionsDir);
 		instructionsView = renderInstructions(data, read, extract(read.statements));
@@ -1395,8 +1680,16 @@ async function consoleOut(path, argv) {
 	const portFlag = flag(argv, "serve");
 	const port = portFlag === void 0 ? 4180 : Number(portFlag);
 	if (!Number.isInteger(port) || port < 1 || port > 65535) fail(`--serve takes a port, got \`${portFlag}\``);
-	const { url } = await serveConsole(out, port);
+	const { url } = await serveConsole(out, port, {
+		dir: dirname(resolve(path)),
+		files: {
+			...DEFAULT_FILES,
+			ledger: resolve(path),
+			...packPath === void 0 ? {} : { pack: resolve(packPath) }
+		}
+	});
 	console.log(`\nserving ${out} at ${url}`);
+	console.log(`record at ${url}api/record · events at ${url}api/events`);
 	console.log("loopback only, read-only. ctrl-c to stop.");
 }
 async function init(argv) {
@@ -1413,8 +1706,11 @@ async function init(argv) {
 	const profile = profileDir === void 0 ? defaultProfile() : profileAt(profileDir);
 	const ledger = flag(argv, "ledger");
 	const approver = flag(argv, "approver");
+	const link = argv.includes("--link");
+	const shadow = argv.includes("--shadow");
 	const row$1 = praeRow({
-		pack: source,
+		...link ? { packFile: resolve(packPath) } : { pack: source },
+		...shadow ? { mode: "shadow" } : {},
 		...ledger === void 0 ? {} : { ledger },
 		...approver === void 0 ? {} : { approver }
 	});
@@ -1426,7 +1722,8 @@ async function init(argv) {
 	}
 	console.log(`profile     ${profile.dir}`);
 	console.log(`overlay     ${plan.patchPath}`);
-	console.log(`pack        ${pack.pack} ${pack.version} · ${pack.rules.length} rules`);
+	console.log(`pack        ${pack.pack} ${pack.version} · ${pack.rules.length} rules${link ? ` · linked, edits hot-reload (${resolve(packPath)})` : ""}`);
+	if (shadow) console.log("mode        shadow · every verdict sealed, every call proceeds");
 	if (ledger !== void 0) console.log(`ledger      ${ledger}`);
 	if (plan.findings.length > 0) {
 		console.log("");

package/lib/docs/pilot-dsh.md

@@ -172,9 +172,9 @@ Prefer the interactive UI? Swap `@deepseek-ai/dsh-headless` for
 | Attempt | Expected | Why |
 | --- | --- | --- |
 | Ask for the file by another relative spelling, `../pilot-target/docs/…`, an absolute path | **deny** | Paths are normalized and anchored; the content rule has no path condition anyway |
-| Ask it to `cat` / `head` / `tail` the file through the shell | **held (ask)** by `SEC-005` | Shell output is not content-inspected; the pilot pack holds the known dumpers for a human. In headless mode there is no approver, so expect the call to fail closed rather than run |
-| Ask it to `python3 -c "print(open(...).read())"`, `node -e`, `awk`, or a here-doc | **not caught** by this pack | Shell is governed by *command* rules, not by content inspection — the list of programs that can print a file is unbounded. The honest control is scope: deny or hold `proc:spawn` for agents that should not need a shell |
-| Ask it to `grep AKIA docs/` or search the directory | **not caught** by this pack | Search tools return matched *lines*; content inspection runs on whole-file reads. A pilot pack can hold `grep`/`glob` by tool name (`"tool": ["grep"]` → `ask`) if that matters to you — say so and we will ship it as an option |
+| Ask it to `cat` / `head` / `tail` the file through the shell | **held (ask)** by `SEC-005` before it runs; and from `prae-gate 0.6.0`, if it does run, the **output is withheld** (`SEC-004`, `phase: output`) | Two doors: the pilot pack holds the known dumpers for a human, and the result of any shell command is content-inspected before the model sees it. The command runs; the model gets a structured refusal saying so |
+| Ask it to `python3 -c "print(open(...).read())"`, `node -e`, `awk`, or a here-doc | **output withheld** (`SEC-004`) from `prae-gate 0.6.0` | No program list is involved: the result is scanned, not the command. Say it precisely — the process ran, the model saw nothing of what it printed. To stop the process itself, scope `proc:spawn` |
+| Ask it to `grep AKIA docs/` or search the directory | **output withheld** from `prae-gate 0.6.0` | Search results are lines, so nothing is inspected before the call; the lines it returns are, under the read rules |
 | Copy the file under `tests/fixtures/` first, then read it | **allowed, recorded** | That is the carve-out working as designed (`SEC-003` still writes a warn row). Tighten or remove the carve-out in the pack if your repos keep real secrets in fixtures |
 | Edit the ledger to hide the refusal | **chain breaks** on `prae verify` | And with a signing key configured, the signature fails without the private key — `prae keygen`, then `signingKey` in the plugin config |
 

package/lib/docs/secret-catcher.md

@@ -116,14 +116,23 @@ counterparty can check without trusting the machine it came from.
   it; the dsh plugin covers the harness's `read` tool. An agent with direct
   filesystem access outside both is covered only where its harness routes
   those calls through a gated seam.
-- **The shell is governed by scope, not by content.** `cat`, `python -c`,
-  `node -e`, a here-doc — the set of programs that can print a file is
-  unbounded, so shell output is never content-inspected. The pilot pack holds
-  the common dumpers (`SEC-005`, `ask`); the honest control for agents that
-  should not need a shell is to deny or hold `proc:spawn`.
-- **Search tools return lines, not files.** `grep`/`glob` results are not
-  content-inspected. Hold them by tool name (`"tool": ["grep"]` → `ask`) where
-  that matters; `docs/pilot-dsh.md` §4 lists this with the rest.
+- **The shell is content-inspected on the way out, not the way in.** `cat`,
+  `python -c`, `node -e`, `sed`, a here-doc — the set of programs that can
+  print a file is unbounded, so no list of them is a control. What is bounded
+  is the result: every tool result is scanned with the same detector before
+  the model sees it, and a result carrying a credential is withheld (`SEC-004`
+  in the shipped pack, `prae-gate ≥ 0.6.0`). Be exact about what that means:
+  **the command ran**; the model never saw what it printed. The ledger row says
+  `phase: output`, and the refusal the agent gets says `executed: true`. If a
+  process must not run at all, that is a scope rule on `proc:spawn`, not a
+  content rule.
+- **Search tools are covered by the same door.** `grep`/`glob` return lines,
+  not files, so nothing is inspected before they run; their output is, and a
+  matched line that carries a credential is withheld under the read rules.
+- **Shell rows carry a fingerprint, never the line.** `command: { program,
+  hash }` — the program word and a hash of the whole line — so an auditor can
+  see what ran and match repeats, while a line that carried a secret is never
+  quoted into the log.
 - **Detection is regex + entropy.** Same floor the mature at-rest scanners
   stand on; novel unformatted secrets can pass. The engine is an interface,
   not a ceiling.

package/lib/index.d.ts

@@ -32,7 +32,12 @@ declare function defaultProfile(name?: string): Profile;
  * was in force at the time.
  */
 declare function praeRow(options: {
-  readonly pack: string;
+  /** The pack inline, as JSON text. */
+  readonly pack?: string;
+  /** The pack as a file the gate watches (hot reload); wins over `pack`. */
+  readonly packFile?: string;
+  /** `shadow` seals every verdict and lets every call through. */
+  readonly mode?: 'enforce' | 'shadow';
   readonly ledger?: string;
   readonly approver?: string;
 }): string;

package/lib/index.js

@@ -1,6 +1,6 @@
 import "./evaluate-CkYySl7T.js";
-import "./views-CAD9738P.js";
-import { a as planWrite, i as dshHome, n as applyWrite, o as praeRow, r as defaultProfile, s as profileAt, t as main } from "./cli-BUgU-LpN.js";
+import "./views-UODslKwu.js";
+import { a as planWrite, i as dshHome, n as applyWrite, o as praeRow, r as defaultProfile, s as profileAt, t as main } from "./cli-chtNj_el.js";
 import "./src-Ciggx9ja.js";
 
 export { applyWrite, defaultProfile, dshHome, main, planWrite, praeRow, profileAt };

package/lib/{instructions-oGCdVxHM.js → instructions-C104EUaE.js}

@@ -1,4 +1,4 @@
-import { c as renderShell, o as esc, s as renderNav, t as navFor } from "./views-CAD9738P.js";
+import { c as renderNav, l as renderShell, s as esc, t as navFor } from "./views-UODslKwu.js";
 
 //#region src/console/instructions.ts
 const STYLE = `

package/lib/secret-catcher.prae.json

@@ -59,6 +59,23 @@
         "kind": "warn",
         "because": "a possible credential was noticed in this file; where no stronger rule fired, the read proceeded and this row is the record"
       }
+    },
+    {
+      "id": "SEC-004",
+      "title": "Shell output carrying credentials is withheld",
+      "when": {
+        "capability": "proc:spawn",
+        "secrets": {
+          "minConfidence": 0.8
+        }
+      },
+      "effect": {
+        "kind": "deny",
+        "because": "the command ran and its output contained a protected credential; the output was withheld from the model"
+      },
+      "frameworks": {
+        "owasp-llm-top-10-2026": ["LLM02"]
+      }
     }
   ]
 }

package/lib/{views-CAD9738P.js → views-UODslKwu.js}

@@ -67,17 +67,74 @@ function cite(rule) {
 }
 
 //#endregion
-//#region src/console/logo.ts
+//#region ../tokens/src/mark.ts
 /**
-* The mark, inlined.
+* The mark — Guardians — as code.
+*
+* Four corner brackets around a core that none of them touch: the Guardians
+* PRAE assembles around an agent, and the agent, green because what is
+* inside has been verified. The console, the site and the CLI draw it from
+* here, so there is one geometry and no copies to drift. `brand/` holds the
+* same shapes as files, for places that need a file.
 *
-* A P drawn as a door: the product is the moment permission is granted,
-* and the glyph is the gate it comes through. Inlined as a data URI rather
-* than linked because these pages are read offline and mailed around as
-* evidence — a page that fetches an image renders wrong on the machine that
-* matters.
+* Grid 32u. Arms 11u long, 5u thick. Core 8u, centred, 5u clear. Radius 0.
 */
-const LOGO = "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAgAAAAIACAYAAAD0eNT6AAAABHNCSVQICAgIfAhkiAAAAAlwSFlzAAAOxAAADsQBlSsOGwAAABl0RVh0U29mdHdhcmUAd3d3Lmlua3NjYXBlLm9yZ5vuPBoAABJQSURBVHic7d1frKR1fcfxD+zyR0BQC13FKrKWViANf0ypcRcQxYhpL+oFaUxqk15Ir/ovXtCkvbBNmlTvSNq0tjdIm8bSq9akCbKosGwRagVModDELbSW5Y/CsssuC7tAL54Z5+xwlnPOzHPmNzPf1yt5wjm7uvsFVp/3PM/M90kAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgYWxpPQAwsYuSfCbJ7yV5IsnTPf7aH03y5STbkhxO8qMef20AYAO2J7kpyW3pTvhvrDiu6fn3umHs138xyZ1Jbk6yM8mpPf9+wIxtbT0AsKotST6UZEeS65N8LMl5Dec5ezDH9YPvDyW5L8meJPcOjiNtRgMmIQBgPmxJcnm6V9c7knwiybuaTvTWzszxQXA0yfeT7EoXBfeku2oAzCkBAG1sTXJZuhPoziRXJzmn6UTTOSXJhwdHkryW5KGMrhB8M8mP24wGAO2cke5Ef3O6e+mHc/w99mmPzX4PQB/HD5J8JclvJHlfz/MCwFw4K92r+y+mO+EfSf8n1EULgNWC4LZ0b2zc3vP8wBrcAoB+nJ3kqowu6V+V7rI4J7Z9cHxu8P2+dLcLhrcNvpcuFIBNIABgMtvSneSH79K/IsnJTSdafO9JcuPgSJJnkzyQLgZ2JXkwyettRoPlIwBgfc5Pd7Ifvkv/yiQnNZ1o+f10kl8ZHElyMMn9GV0h2J3klTajweITALC67Rmd7K+Pe9Tz4O05/qOHh9NdFRheIdiT5OU2owGwqFZu2Xsym/8GOG8C7P84muS7SW5JdxvhnT3/M4Gl4goAFY1v2bsuyblNJ6IPWzPaRfA76XYRPJ7RFYJvxTMN4CcEABUs2pY9+rElySWD46bBj+3N6HbB3emu9kBJAoBltGxb9ujP8FbPMAiGHz0cRsEjjeaCmRMALIMz0r0rf3hJf2eS05tOxKIY/+jh0+k+XTD8pIGPHrK0BACL6KwkH8nokv7VSU5rOhHL4t05PggOpNtFMLxCcH+6NxvCwhMALAJb9mhl/DHILyX5TjwGmSUgAJhHtuwxr4bPePAYZBaeAGAeDLfsDV/hXxxb9lgM449BPpbk4YyuENyV5Pk2o8FbEwC0YMsey2p8F8HrSR7L6CFH30ryv82mgxUEALOwPaNX99cmeX/bcWBmTs7quwiGVwjuTPLfbUajOgFA32zZg7fmMcjMBQHAtIZLd1Ze0reDHdZvfBfBM0n+LR6DzCYTAGyULXuwubblrR+DfE+SV9uMxjIRAKzlzHQfw7NlD9oYfwzyoSQPxWOQmZIAYNz4lr1rkpzadCJgpTPT/W9zR5KbM/ro4TAGdifZ32w6FoYAwJY9WGwrP3qYeAwy6yQA6nl3uvv2w1f4tuzBcvEYZNZFACw/W/YAj0HmTQTA8lm5Ze+TSS5sOw4wh8Y/emgXQUECYPHZsgdMazwIPAa5AAGwWGzZA2Zhrccg707ySpvR6IsAmG+27AHzYPwxyIfTbSgc3jbwGOQFJADmiy17wCI4I6NdBInHIC8kAdCWLXvAMhh/DPLKXQR7knwzyQ+bTceqBMBs2bIHVHCiXQQegzxHBMDmOi/dCX/4Ct/SHaCqEz0GefhJg0fjo4czJQD6Nb5l78pYugOwGo9BbkwATMeWPYB+nOgxyMMrBA/EY5B7JQA2xpY9gNlY6zHI9yY50ma05SAA1vaBJF9O94a9bW1HAShr/DHIR9LdMrg73WKif023sIh1EgBruyCje1QAzIfT073n6urB98fSPcNgd7rFRLvSLSziBLwjHYBlsDXJVUm+kOSfkvxi23HmnwAAgIIEAAAUJAAAoCABAAAFCQAAKEgAAEBBAgAAChIAAFCQAACAggQAABQkAACgIAEAAAUJAAAoSAAAQEECAAAKEgAAUJAAAICCBAAAFCQAAKAgAQAABQkAAChIAABAQQIAAAoSAABQkAAAgIIEAAAUJAAAoCABAAAFCQAAKEgAAEBBAgAAChIAAFCQAACAggQAABQkAACgIAEAAAUJAAAoSAAAQEECAAAKEgAAUJAAAICCBAAAFCQAAKAgAQAABQkAAChoa+sBAJbUU0m+muT+JP+R5I0kpyV5b5KfTXJRkp8b/PXCJKe2GZOqBABAv15I8vtJ/j7J0VV+/j+T7Br7sa1JLsibw+CiwY/7/2p65w8VQH/uS3Jjkv/b4H/vWJIfDI47xn7ulCTbMwqClcf74lYuExIAAP14OMkvp7sC0KejSR4fHONOTfIz6QJhe5JLk1wy+PoDEQe8BQEAML0DST6d/k/+a3k1yd7BMe7MdFcJLk/yqSS/muT02Y3GvFOHANP74yT7Wg8x5lCSh5LcmuSz6a4I3JruzYggAACm9GKSv2g9xDo8k+Q3B8dqb06kGAEAMJ1/TvJK6yE24KtJPhdXAsoTAADTuaf1ABP4hyR/3noI2hIAANP5YesBJvSHSX7cegjaEQAA03mu9QATOpjkb1oPQTsCAGA6i3wv/S+z2PMzBQEAUNf/JHms9RC0IQAAaruv9QC0IQAAanu69QC0IQAAanu99QC0IQAAoCABAAAFCQAAKEgAAEBBAgAAChIAAFCQAACAggQAABQkAACgIAEAAAUJAAAoSAAAQEECAAAKEgAAUJAAAICCBAAAFCQAAKAgAQAABQkAAChIAABAQQIAAAoSAABQkAAAgIIEAAAUJAAAoCABAAAFCQAAKEgAAEBBAgAAChIAAFCQAACAggQAABQkAACgIAEAAAUJAAAoSAAAQEECAAAKEgAAUJAAAICCBAAAFCQAAKAgAQAABQkAAChIAABAQQIAAAoSAABQkAAAgIIEAAAUJAAAoCABAAAFCQAAKEgAAEBBAgAAChIAAFCQAACAggQAABQkAACgIAEAAAUJAAAoSAAAQEECAAAKEgAAUJAAAICCBAAAFCQAAKAgAQAABQkAAChIAABAQQIAAAoSAABQkAAAgIIEAAAUJAAAoCABAAAFCQAAKEgAAEBBAgAAChIAAFCQAACAggQAABQkAACgIAEAAAUJAAAoSAAATGdr6wFgEgIAYDrbWg8wpZNaD0AbAgBgOhe2HmBKP9V6ANoQAADTuaH1AFN6b+sBaEMAAEzn40nObz3EhLYm+WjrIWhDAABM57Qkf9R6iAldE7cAyhIAANP7rSSfaj3EBP6g9QC0IwAApndykr9LcmnrQTbgM0k+2XoI2hEAAP04N8meJJ9uPcg6/EKSW1sPQVsCAKA/5yT5lyS3Z36vBnw8yR1Jzm49CG3ZYAXQvxsHx8NJdid5LMmzSQ4kOTQ4Xkzy0orvN9tFSb6Q5PPx4o8IAIDNdNngWI/9GcXAwYxi4fDg51bGwv4VP3dglf/s4XS3JD6YZEe6e/3XxomfFQQAwHx4x+CAmVCDAFCQAACAggQAABQkAACgIAEAAAUJAAAoSAAAQEECAAAKEgAAUJAAAICCBAAAFCQAAKAgAQAABQkAAChIAABAQQIAAAoSAABQkAAAgIIEAAAUJAAAoCABAAAFCQAAKEgAAEBBAgAAChIAAFCQAACAggQAABQkAACgIAEAAAUJAAAoSAAAQEECAAAKEgAAUJAAAICCBAAAFCQAAKAgAQAABQkAAChIAABAQQIAAAoSAABQkAAAgIIEAAAUJAAAoCABAAAFCQAAKEgAAEBBAgAAChIAAFCQAACAggQAABQkAACgIAEAAAUJAAAoSAAAQEECAAAKEgAAUJAAAICCBAAAFCQAAKAgAQAABW1tPQAA9Ojw4Hi59SDzTgAA0NKRJC+kO2Gv9vVa36/8+kdJXp3t+ItLAACwXkfSz4l6+P3+JG/M9O+AnxAAAMurrxP1kSTPJTk62/HZTAIAYD6Mv7qe9ET9QpLnB1/DCQkAgM3zYJLdSf4rybNJDiQ5NDheTPLSiu9hpgQAQL/eSHJ7kj9J8mjjWeCEBABAf/Yn+bUk32g9CKxFAAD047kk1yV5pPUgsB42AQJM77Ukvx4nfxaIAACY3l/FZX8WjAAAmM4rSf609RCwUQIAYDp3JdnXegjYKAEAMJ07Wg8AkxAAANPZ23oAmIQAAJjOs60HgEkIAIDpHGs9AExCAABAQQIAAAoSAABQkAAAgIIEAAAUJAAAoCABAAAFCQAAKEgAAEBBAgAAChIAAFCQAACAggQAABQkAACgIAEAAAUJAAAoSAAAQEECAAAKEgAAUJAAAICCBAAAFCQAAKAgAQAABQkAAChIAABAQQIAAAoSAABQkAAAgIIEAAAUJAAAoCABAAAFCQAAKEgAAEBBAgAAChIAAFCQAACAggQAABQkAACgIAEAAAUJAAAoSAAAQEECAAAKEgAAUJAAAICCBAAAFCQAAKAgAQAABQkAAChIAABAQQIAAAoSAABQkAAAgIIEAAAUJAAAoCABAAAFCQAAKEgAAEBBAgAAChIAAFCQAACAggQAABQkAACgIAEAAAUJAAAoSAAAQEECAAAKEgAAUJAAAICCBAAAFCQAAKAgAQAABQkAAChIAABAQQIAAAoSAABQkAAAgIIEAAAUJAAAoCABAAAFCQAAKEgAAEBBAgAAChIAAFCQAACAggQAABQkAACgIAEAAAUJAAAoSAAAQEECAAAKEgAAUJAAAICCBAAAFCQAAKAgAQAABQkAAChIAABAQQIAAAoSAABQkAAAgIIEAAAUJAAAoCABAAAFCQAAKEgAAEBBAgAAChIAAFCQAACAggQAABQkAACgIAEAAAUJAAAoSAAAQEECAAAKEgAAUJAAAICCBAAAFCQAAKAgAQAABQkAAChIAABAQQIAAAoSAABQkAAAgIIEAAAUJAAAoCABAAAFCQAAKEgAAEBBAgAAChIAAFCQAACAggQAABQkAACgIAEAAAUJAAAoSAAAQEECAAAKEgAAUJAAAICCBAAAFCQAAKAgAQAABQkAAChIAABAQQJgbU8m+VqSp1oPAgB92dp6gAXwRJLPDr4+P8mOJNcn2ZnkkkYzAcBUBMDGPJXkHwdHkrwnXQjsTBcGVyY5qc1oALB+AmA6+3J8EGxLclVGVwmuiNssAMwhAdCvZ5J8fXAkyduT/FJGtwyuSnJKm9EAYEQAbK6DSXYNjiQ5K8lHMrplcHWS09qMBkBlAmC2XsrxQXBGuvcNDG8Z7EjytjajAVCJAGjrcJJ7B8eX0v37uCyjWwY7k7yj2XQALC0BMF+OJfn3wfGlJFuSXJ7RLYNPJHlXs+kAWBoCYL69llEQ3JLuEwUXZ3TL4GNJzms1HACLSwAslteTPDI4/nrwY9szumVwTZIL2owGwCIRAItvb7oYGAaBbYUArEkALB/bCgFYkwBYfrYVAvAmAqCe8W2FZ6cLAtsKAQoRAByIbYUA5QgAxq21rXBnktPbjAZAXwQAa1lrW+HVSc5pNh0AExEAbJRthQBLQAAwrfFthVuSfCijWwbXJTm32XQArEoA0LfXYlshwNwTAMzC+LbC7RndMrh+8D0AMyQAaGHv4Lht8P1wfbFthQAzIgCYB6utL7423ScMrk33PANBwDx6OckrrYeASQgA5tG+JF8bHIlthcyPQ0nuS7Ino4/HHmk6EUxIALAIbCuklYNJ7k/3Z29PkgeSvNp0IuiJAGAR2VbIZnk6yXfTvbLfleTBJK83nQg2iQBgGdhWyKT2ZXSy35Pk0SRvNJ0IZkQAsIxsK+RE9mZ0//4bSZ5oOg00JACowLbCml5L8nhGr/C/neS5lgPBPBEAVLTWtsJrk7y/zWhM4ViShzN6hX9XkuebTgRzTABAx7bCxXM43Zv07k130r873SdGgHUQALC6E20rHF4luDiWE83aS0m+k9Er/N2xhAcmJgBgfca3FW5Lt5BoGAVXJDm5zWhL60C6z90P36F/f5KjTSeCJSIAYDLPJPn64EhsK+zD0+le1Q9f4X8vPpIHm0YAQD9sK9y48c/gP9J2HKhFAMDmsK3wzfZmdLK/O8mTbccBgNnbmuTDSW5Odxthf7rL3ZMe1/Q83w1TznMs3Sv6ryS5MfYsAMCqhkHwu0luT/f59UUKgKPpdujfku6E/86e5wGAErYkuTTJTemC4LnMVwAcSnf//s/S3dJ4W8+/PwAwsD1dENyW7v75LAPgYJI7k3wx3QnfGxoBoJGfT/L5JH+bbg9Bn3ak23nw2+merGjHAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACt/D8OdL0ResTTzQAAAABJRU5ErkJggg==";
+const MARK = {
+	viewBox: "0 0 32 32",
+	brackets: "M2 2H13V7H7V13H2ZM19 2H30V13H25V7H19ZM2 19H7V25H13V30H2ZM25 19H30V30H19V25H25Z",
+	corners: [
+		{
+			d: "M2 2H13V7H7V13H2Z",
+			dx: -14,
+			dy: -14
+		},
+		{
+			d: "M19 2H30V13H25V7H19Z",
+			dx: 14,
+			dy: -14
+		},
+		{
+			d: "M25 19H30V30H19V25H25Z",
+			dx: 14,
+			dy: 14
+		},
+		{
+			d: "M2 19H7V25H13V30H2Z",
+			dx: -14,
+			dy: 14
+		}
+	],
+	core: {
+		x: 12,
+		y: 12,
+		width: 8,
+		height: 8
+	},
+	colour: {
+		graphite: "#0E1114",
+		ink: "#FFFFFF",
+		signal: "#98ED49",
+		signalOnLight: "#0C6800"
+	}
+};
+/** The inner drawing: brackets and, unless absent, the core. */
+function markShapes({ surface = "graphite", core = "verified", mono = false } = {}) {
+	const ink = surface === "graphite" ? MARK.colour.ink : MARK.colour.graphite;
+	const green = surface === "graphite" ? MARK.colour.signal : MARK.colour.signalOnLight;
+	const coreFill = mono || core === "unverified" ? ink : green;
+	const { x, y, width, height } = MARK.core;
+	const rect = core === "absent" ? "" : `<rect class="prae-core" x="${x}" y="${y}" width="${width}" height="${height}" fill="${coreFill}"/>`;
+	return `${MARK.corners.map((c, i) => `<path class="prae-corner" style="--i:${i};--dx:${c.dx};--dy:${c.dy}" d="${c.d}" fill="${ink}"/>`).join("")}${rect}`;
+}
+/** A complete SVG document of the mark. */
+function markSvg(options = {}) {
+	const size = options.size ?? 32;
+	return `<svg xmlns="http://www.w3.org/2000/svg" viewBox="${MARK.viewBox}" width="${size}" height="${size}">${markShapes(options)}</svg>`;
+}
+/** The mark as a data URI, for an `<img>` that must not fetch anything. */
+function markDataUri(options = {}) {
+	return `data:image/svg+xml;utf8,${encodeURIComponent(markSvg(options))}`;
+}
 
 //#endregion
 //#region ../tokens/src/palette.ts
@@ -345,6 +402,10 @@ const VERDICT_LABEL = {
 	correct: "CORRECTED"
 };
 
+//#endregion
+//#region src/console/logo.ts
+const LOGO = markDataUri({ size: 26 });
+
 //#endregion
 //#region src/console/shell.ts
 function esc(value) {
@@ -1073,4 +1134,4 @@ ${history}`;
 }
 
 //#endregion
-export { renderPacks as a, renderShell as c, cite as d, renderOverview as i, VERDICT_LABEL as l, renderApprovals as n, esc as o, renderCompliance as r, renderNav as s, navFor as t, FRAMEWORKS as u };
+export { renderPacks as a, renderNav as c, FRAMEWORKS as d, cite as f, renderOverview as i, renderShell as l, renderApprovals as n, CONTROLS as o, renderCompliance as r, esc as s, navFor as t, VERDICT_LABEL as u };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prae-cli",
-  "version": "0.6.1",
+  "version": "0.7.0",
   "description": "Operator policy for agent harnesses: validate packs, explain a decision, test a pack against security invariants, verify a decision log, and provision a governed DSH profile.",
   "keywords": [
     "dsh-plugin",