Add executable live approval regressions

IMPLEMENTATION_PLAN.md

@@ -212,6 +212,8 @@ Done when:
   Eleven executable live cases pin the intended allow and prompt boundaries.
 - [x] Post-1952 live evidence froze 285 shell calls and 69 prompts.
   Twenty-one sanitized cases sample expected, guidance, and ShellSyntaxTree gaps.
+  The coordinator executes one identity-free regression for each sampled case.
+  Each regression locks its evidence source, approval shape, and actor contact.
 - [x] A safe pipeline stage can compose with a stored grant for each stage that
   still requires approval.
 - [x] A prompt excludes a safe stage from the approval candidates that the user

openspec/changes/extend-live-approval-regression-corpus/.openspec.yaml

@@ -0,0 +1,2 @@
+schema: spec-driven
+created: 2026-08-14

openspec/changes/extend-live-approval-regression-corpus/design.md

@@ -0,0 +1,121 @@
+## Context
+
+The existing policy fixture catalog executes D acceptance cases, A adversarial
+cases, and eleven earlier live regressions through the real shell policy
+coordinator. The post-1952 harvest adds 21 representative prompts, but its
+`commandShape` values are display-safe evidence. Several contain angle-bracket
+placeholders that would change Bash grammar if executed. Copying those strings
+into the coordinator fixture would therefore test the redaction syntax rather
+than the observed approval shape.
+
+This change affects only source-controlled evidence and tests. It does not
+change an actor boundary, policy stage, grant store, session history, public
+API, or persisted representation. The coordinator fixture continues to use an
+in-process approval actor stub and the canonical bundled safe catalog.
+
+## Goals / Non-Goals
+
+**Goals:**
+
+- represent every T01-T21 harvested case with an identity-free command that
+  preserves the policy-relevant shell structure;
+- execute each command through the real coordinator with exact expected
+  outcome, approval shape, and actor-contact count;
+- bind each regression to its source file, source evidence ID, classification,
+  and target outcome;
+- make accidental command or expectation drift visible through a locked digest;
+  and
+- preserve current strict behavior for expected approvals, agent-alignment
+  cases, and unresolved ShellSyntaxTree facts.
+
+**Non-Goals:**
+
+- changing production policy or reviewed-safe catalogs;
+- parsing `gh` operations, Docker behavior, or Bash arithmetic in Netclaw;
+- granting authority from an evidence classification;
+- claiming the 21 cases exhaust the source traffic window; or
+- changing actor messages, persistence, recovery, or runtime failure handling.
+
+## Decisions
+
+### Curate executable commands instead of executing display redactions
+
+Each new live regression will retain the command's control flow, executable
+chain, path boundaries, redirects, and dynamic constructs while replacing
+identities with ordinary quoted literals. Angle-bracket placeholders will not
+appear in executable commands because Bash treats them as redirects.
+
+The alternative was to execute `commandShape` directly. That would make cases
+such as `<known-file>` and `<old-range>` semantically false and could turn a
+read into a redirect or parse failure.
+
+### Bind every live row to an explicit evidence file
+
+`PolicyLiveRegressionCase` will add a required internal-only
+`SourceEvidenceFile` field. Contract validation will resolve the pair
+`(SourceEvidenceFile, SourceEvidenceId)` and compare the source classification
+with the fixture classification. This avoids relying on globally unique S/T
+identifiers and makes future harvest additions unambiguous.
+
+The field is test-only JSON. It does not affect a public or durable runtime
+contract.
+
+### Lock the executable live-regression section as one evidence artifact
+
+The contract test will compute a deterministic digest over the serialized
+`liveRegressionCases` section. The digest will also include each linked source
+`commandShape` and classification. A command, source shape, evidence link,
+classification, outcome, correction, option, or actor count change therefore
+requires an explicit evidence review. Semantic tests will still execute every
+row through the coordinator. The digest is a drift alarm, not a substitute for
+behavior.
+
+The alternative was a large hard-coded command dictionary in C#.
+That would duplicate the corpus and make review harder.
+
+### Preserve classifications without translating them into authority
+
+All new T rows currently target `RequiresApproval`. `ExpectedApproval` remains
+a product-appropriate prompt. `AgentAlignmentDebt` remains promptable because
+guidance, file tools, or session scratch are the preferred remedy.
+`ShellSyntaxTreeFactGap` remains promptable until a general parser-owned fact
+exists. No classification can directly cover a policy candidate.
+
+### Reuse the existing coordinator harness
+
+The new rows use `PolicyAdversarialCase` and
+`ShellPolicyEvidenceFixtureTests.Live_regression_fixtures_pin_current_policy_outcomes`.
+This preserves the real syntax analysis, path policy, safe-catalog,
+coordinator, approval-context, and actor-check route without adding a second
+evaluator or fixture-specific production seam.
+
+## Risks / Trade-offs
+
+- **Curated commands can diverge from live intent** -> Preserve the
+  policy-relevant structure, link every row to the source evidence, and review
+  the paired source and curated command together.
+- **A locked digest can be mechanically refreshed** -> Require the semantic
+  coordinator assertions and exact source-classification linkage to pass too.
+- **Platform-dependent paths can make fixtures flaky** -> Use the declared
+  Bash/Linux environment with canonical POSIX fixture roots and identity-free
+  external paths.
+- **A future parser release can legitimately change outcomes** -> Treat the
+  resulting fixture failure as an explicit corpus review, then update the
+  expectation and digest together if the new behavior is intended.
+
+## Migration Plan
+
+1. Extend the test-only fixture schema and existing L rows with explicit source
+   evidence files.
+2. Add L12-L32 for T01-T21 and record current coordinator results.
+3. Add linkage, digest, uniqueness, classification, and mutation coverage.
+4. Run focused coordinator and evidence suites plus the repository quality
+   gates.
+
+Rollback removes the new test-only rows and schema field. No runtime data or
+authority requires migration.
+
+## Open Questions
+
+None. Production changes for any future general parser fact require a separate
+ShellSyntaxTree and Netclaw change.

openspec/changes/extend-live-approval-regression-corpus/proposal.md

@@ -0,0 +1,30 @@
+## Why
+
+PRD-002 SEC-009 requires shell authorization to remain fail-closed, while live approval-fatigue work requires evidence that ordinary diagnostics are not prompted unnecessarily. The post-1952 harvest classifies 21 representative prompts, but those sanitized command shapes are not executed through the coordinator and therefore cannot protect later policy simplification.
+
+## What Changes
+
+- Curate parse-preserving, identity-free commands for all 21 post-1952 evidence cases.
+- Bind every curated command to its source evidence ID, classification, intended outcome, approval shape, and actor-contact count.
+- Execute the cases through the real shell policy coordinator alongside the existing D, A, and L matrices.
+- Keep expected approvals and current ShellSyntaxTree fact gaps strict; do not reinterpret executable-private arguments or convert agent-alignment guidance into authority.
+- Add mutation checks for source shapes, links, classifications, commands, outcomes, corrections, approval shapes, and actor counts.
+
+Out of scope: changing production policy, widening a safe catalog, parsing `gh` operations in Netclaw, adding Bash arithmetic grammar, or claiming the sample represents every prompt in the source window.
+
+## Capabilities
+
+### New Capabilities
+
+None.
+
+### Modified Capabilities
+
+- `tool-approval-gates`: Extend the executable sanitized approval corpus with post-1952 live prompt regressions and exact evidence linkage.
+
+## Impact
+
+- **Tests and evidence:** `netclaw-policy-fixtures.json`, its source-generated models, coordinator fixture tests, evidence-contract tests, and the post-1952 harvest linkage.
+- **Security:** The change adds no authority. Expected approvals and unresolved general parser facts remain promptable through the real coordinator.
+- **Operations:** Future policy and refactor pull requests receive a broader should-prompt/should-allow regression gate derived from live traffic.
+- **APIs and persistence:** No public API, actor protocol, approval store, session history, configuration, or dependency change.

openspec/changes/extend-live-approval-regression-corpus/specs/tool-approval-gates/spec.md

@@ -0,0 +1,68 @@
+## ADDED Requirements
+
+### Requirement: Executable post-1952 live approval regression corpus
+
+The shell-policy evidence catalog SHALL contain one executable live regression
+for each representative post-1952 evidence case T01 through T21. Each
+regression SHALL identify its source evidence file and source evidence ID. It
+SHALL retain the source classification and intended policy outcome.
+
+Executable commands SHALL be identity-free and SHALL preserve the
+policy-relevant shell grammar of the source shape. Display-only redactions that
+would become shell operators SHALL NOT be executed as literal fixture input.
+
+The real shell policy coordinator SHALL evaluate every regression. Each row
+SHALL assert the final outcome, deny reason, approval candidates, messy status,
+approval option keys, and approval-actor contact count that are applicable to
+that outcome. Evidence classifications SHALL NOT grant authority.
+
+#### Scenario: Every representative post-1952 case executes once
+
+- **WHEN** the live regression fixture loads
+- **THEN** source evidence IDs T01 through T21 each occur exactly once
+- **AND** policy case IDs L12 through L32 each occur exactly once
+- **AND** every case executes through the real coordinator
+
+#### Scenario: Source evidence remains exactly linked
+
+- **WHEN** the evidence contract validates a live regression
+- **THEN** its source file and evidence ID resolve to one harvested case
+- **AND** its digest includes the harvested command shape
+- **AND** its classification equals the harvested classification
+- **AND** its target outcome equals its executable policy expectation
+
+#### Scenario: Display redaction does not change executable grammar
+
+- **WHEN** a harvested command shape contains a display-only placeholder
+- **THEN** the executable fixture uses an identity-free shell literal
+- **AND** it preserves the original command chain, path boundary, redirect,
+  or dynamic construct under test
+- **AND** it does not interpret an angle-bracket placeholder as a redirect
+
+#### Scenario: Current fact gaps remain strict
+
+- **WHEN** the coordinator evaluates the curated default-GET `gh api` cases
+  or the static Bash arithmetic echo case
+- **THEN** it requires approval under the current parser facts
+- **AND** Netclaw does not infer executable-private operation semantics
+
+#### Scenario: Agent-alignment cases do not gain authority
+
+- **WHEN** the coordinator evaluates a case classified as
+  `AgentAlignmentDebt`
+- **THEN** the classification does not provide candidate coverage
+- **AND** the current call remains approval-gated
+
+#### Scenario: Executable evidence drift is explicit
+
+- **WHEN** a source shape, executable command, evidence link, classification,
+  expected outcome, correction, approval shape, or actor-contact count changes
+- **THEN** the locked live-regression digest changes
+- **AND** the evidence contract fails until the new artifact is reviewed and
+  deliberately accepted
+
+#### Scenario: Corpus contains no source identity
+
+- **WHEN** the PII contract scans the added executable fixtures
+- **THEN** it finds no local username, private repository, channel, thread,
+  host, email, token, or secret

openspec/changes/extend-live-approval-regression-corpus/tasks.md

@@ -0,0 +1,27 @@
+## 1. Evidence Schema and Linkage
+
+- [x] 1.1 Add a source evidence file to every live regression fixture.
+- [x] 1.2 Resolve each evidence pair and verify its harvested classification.
+- [x] 1.3 Digest source shapes, commands, links, outcomes, corrections, options, and actor counts.
+
+## 2. Post-1952 Executable Corpus
+
+- [x] 2.1 Curate identity-free, parse-preserving commands for T01-T07 as L12-L18.
+- [x] 2.2 Curate identity-free, parse-preserving commands for T08-T14 as L19-L25.
+- [x] 2.3 Curate identity-free, parse-preserving commands for T15-T21 as L26-L32.
+- [x] 2.4 Record exact coordinator outcomes, corrections, approval shapes, and actor counts for L12-L32.
+
+## 3. Executable and Adversarial Verification
+
+- [x] 3.1 Execute L01-L32 through the real coordinator and require declared outcomes.
+- [x] 3.2 Keep three ShellSyntaxTree fact-gap rows strict without private parsing.
+- [x] 3.3 Keep agent-alignment rows strict without classification-derived authority.
+- [x] 3.4 Mutate source shapes, links, classifications, commands, outcomes, corrections, approval shapes, and actor counts.
+- [x] 3.5 Prove display-only angle-bracket placeholders do not appear in executable L12-L32 commands.
+
+## 4. Quality Gates and Delivery
+
+- [x] 4.1 Run focused Security evidence-contract and Actors coordinator-fixture suites.
+- [x] 4.2 Run OpenSpec, JSON, headers, diff, formatting, Slopwatch, and PII gates.
+- [x] 4.3 Complete an adversarial review of fixture truthfulness, parser fidelity, and authority neutrality.
+- [x] 4.4 Rebase, rerun interaction gates, deliver the pull request, and enable auto-merge.