[maximalang]

What

Closes the F1 (HIGH) / F2 (MEDIUM) control-plane bypass: the F5 prose rule ("quoted spans are never targets") let sqlite3 "<board db>" "<mutation>" classify as allow:scoped_state_change and rm "<board db>" as allow:destructive_change — an in-process bypass of the protected-path guard. Defect confirmed LIVE 09.10.2026 by the company 23-case probe (C4/C5 allow instead of deny:policy_control_plane_mutation) and re-confirmed here on the pristine committed trunk base.

Change

_path_guard_subjects treats the FIRST quoted positional of an allowlisted file-operand program (sqlite3, cp, mv, rm, del, copy, move, xcopy, robocopy, tee) as a real filesystem target; sqlite3 is pinned to exactly one file positional (later positionals stay SQL prose). Extraction stays strictly allowlist-only: no unconditional quoted-span scan, the value-flag prose exclusion still applies, non-allowlisted programs keep quoted-prose behavior, quoted READ probes of policy-controlled stores stay allow:read_only via the guard's read arm.

Slice content is byte-identical to the never-merged PR #54 candidate (stale pin 1.2.35, dead anchor), re-anchored on the true trunk base and re-pinned to 1.2.57. PR #54 is closed by disposition; this PR supersedes it.

• Base: 9b09444 (trunk codex/company-os head at branch time)
• Reconciliation with merged v1.2.34 W4 prose-mask (PR fleet-policy v1.2.34: worker read-lane FP fixes W1-W5 (t_d94dde9d) #53): the value-flag corpus case git commit -m "delete kanban.db notes" now pins category repository_change (W4 strips the quoted span from the risk scan; was destructive_change on the 1.2.31 base). Decision (allow) and the no-protected-subject property unchanged — pinned in test_value_flag_quoted_message_stays_prose.

Evidence

• Final head: 887f20d (version re-pinned 1.2.37 -> 1.2.44 -> 1.2.57: CI version-collision race with open PRs fix(classifier): v1.2.37 quoted file-operand path-guard subjects F1/F2 (t_9e0d11f0) #66/fix(classifier): v1.2.37 narrow protected-ref gating to true target pushes (t_c0f25265) #64/fix(policy): v1.2.37 capture live lexical delta D1/D2/D2e — env-pin bindings + empty git -c options (t_9412d7d5) #56/fix(policy): v1.2.43 consolidation — read-lane FP residual + retention landing + one-time prune [t_40022daf] #65; label-only commits, double suite re-run below is on the final head)

• RED leg (pristine base 9b09444, policy.py sha256 17677819…): pytest tests/test_v1237_quoted_operands.py → 19 failed / 13 passed; 23-case corpus → C4/C5 DIFF (allow), 20 MATCH, +C17 benign drift (company-accepted 09.10).

• GREEN leg (this head, policy.py sha256 see final corpus log (head 887f20d)): 32/32 passed; corpus → C4/C5 deny:policy_control_plane_mutation, 22/23 MATCH, only C17 drift remains (decision allow preserved; pre-existing base drift from v1.2.34 W2(b), not this slice).

• Controls without regressions: C3, C6–C12, C15 deny; C1, C2, C13, C14, C16, C20, C22 allow read; C18 deny worker_self_approval; C19 approval_required — all MATCH on this head.

• Double suite on the exact head bytes (git status clean post-commit): normal 945 passed; simulated-worker 945 passed (HERMES_KANBAN_TASK/BOARD/PROFILE/RUN_ID set).

• No protected-store weakening, no self-approval path; no deploy, no live-tree mutation (live plugin tree untouched, verified by pre/post git status + rev-parse).

Rollback: revert this single commit; live plugin is not installed from this PR (rollout is a separate owner task).