Why a binary and not a prompt ============================= A model that is asked "may this run?" will sometimes say yes. The gate reads argv. This crate is that process: argv in, a one-line verdict out. The harness hook calls it. A Janet pack can deny more after this verdict. A model cannot be the mediator. An agent that can talk its way past the check is the threat, and indirect prompt injection shows that instructions carried in data change what a model permits (Greshake et al., doi:10.48550/arXiv.2302.12173). No matching rule in this table is an allow. This table judges the argv it is given. Saltzer and Schroeder would deny in that case (`Saltzer and Schroeder, 1975 `__). This table does not. The fail-closed switch is ``POLICYD_REQUIRED=1``, and it covers a missing binary. The next layer may deny more. It cannot allow what this table refused. First deny wins =============== The built-in list is the argv TCB from phronesis (Ali Akber Saifee / indynull, HaoZeke; MIT): privilege runners, remote-exec, recursive delete off tmp, force-push, setuid, raw disk. A later pack rule can deny more. A pack may only deny more. ``python -c`` is allow: this hook sits on a general agent shell, not a uv-only product seat. Cap'n is the typed verdict ========================== ``Decision`` / ``PolicyDecision`` / ``checkShell(argv)`` follow phronesis ``schema/policy.capnp``. The hook still reads a one-line text verdict. ``ljos-policyd capnp -- argv`` writes the packed message. Seat, model, and audio planes stay in phronesis. A missing binary leaves the line open ===================================== A seat without the binary still sits. Doctor names the row. The hook and ``ljos policy`` print the line and any pack rule. Setting ``POLICYD_REQUIRED=1`` is the fail-closed seat: then a missing binary is a deny. That switch belongs to the operator. A check is the argv verdict =========================== A Janet file, a comment, a stamp, a ticket id written into a policy pack: those are file writes. This crate prints a verdict. Pack rules live in packset and are composed by ``ljos policy`` after this verdict. Remember and Prefer stay in packset =================================== Remember and Prefer are speech acts in the pack. A deed is a frozen product. A ticket is a heading. A claim is a lease. This crate answers one question: may this command line run? Mixing that answer into a memory store is how a hook starts writing. Where the seat puts it ====================== ``ljos doctor`` lists a ``policyd`` row when the binary answers. ``ljos policy -- argv`` prints the line, then this verdict, then any pack rule. ``ljos hook`` is the same answer on the runner's PreToolUse path. The public crate is this one. ``https://leidarljos.github.io`` teaches sitting; this site teaches the binary.