fix(safety): deny unavailable confirmation capability and pin schema coverage

[dnlrsls]

PR Type

• Bug fix (type:bug)

Summary

Fail closed when confirmation capability is unavailable; preserve strict approval, rejection lifecycle and original error behavior. Pin the installed six-tool schema with top-level/nested drift witnesses. Do not duplicate inherited dangling-link or malformed-root corrections.

Changes

Edit surface	Outcome
extensions/gentle-ai.ts; tests/gentle-ai.test.ts; tests/path-consent-fence.test.ts; docs/path-consent-safety.md; odd/tasks/path-fence-1659-1660.md (passive tracking evidence)	security work unit

Test Plan

Independent security confirmation2/2, path-fence17/17, malformed-root1/1, no skips. Native RDD4/4 approved; lineage review-7d6d3e35350d1ce1 exact acknowledgement completed/authority burned for source commit f0e4409 (114 lines). Later tracking-only doc commit3dbac8aed is outside that source review. Two nonblocking advisories at path-fence test:47/:50, no correction or rerun.

Chain Context

Field	Value
Chain	path-fence safety follow-ups
Tracker PR	#2048 (draft/no-merge)
Position	3 of3
Base	test/path-fence-launcher-fixtures
Depends on	#2050; #1610 approved pin
Follow-up	None
Review budget	124 /400
Starts at	immediate parent branch; inherited foundation excluded
Ends with	security unit commit f0e44094719105b4fa47963712cb745d912828da

#1610 approved pin -> #2048 tracker
  #2049 filesystem
    #2050 launcher
      📍 #2051 security

Scope / rollback / autonomy

Includes only security unit and accompanying tests/docs. Rollback reverts this unit's listed files/commit without reverting prior slices. Excludes new production launcher/history/registry changes, unclassified corpus fixes, merge and automatic base update. CI expected-green is NOT asserted; drafts remain blocked from integration until CI/base decisions.

Linked Issue

Closes #1660
Related: #1659 (primary fix is inherited from #1610, not authored here). Both issues retain status:approved.

Verification limits

• Windows local affected-file seam: 178 pass, 0 fail, 8 existing skips. Typecheck: no regressions (187 recorded diagnostics).
• Independent filesystem unit: 38/38. Independent launcher: 122 pass/1 isolation failure/8 unchanged skips; a separately authorized single-case recheck passed1/1 after removing ancestor-dependency contamination. This is not rewritten as a full-file-green verifier run.
• Initial full pnpm test was stopped with181 provisional failure records, without a final summary. Remaining corpus is unclassified; no blanket inherited-failure or full-suite-green claim.
• Local POSIX-host execution was not run; Ubuntu CI verify has now succeeded. Actual Windows console Ctrl+C E2E remains unexecuted. Windows interruption uses a modeled event on the real launcher, with real child termination.
• Provider contract, runtime harness and generated-module checks passed locally. Remote CI completed: tracker docs(odd): track pinned path-consent safety correction chain #2048, filesystem test(fixtures): isolate unreadable history and repository discovery #2049 and security fix(safety): deny unavailable confirmation capability and pin schema coverage #2051 green (including their package/packed-install jobs). Launcher test(launcher): make Windows execution and interruption fixtures faithful #2050 fails macOS cleanup in tests/gentle-agents.test.ts:5430 (ENOTEMPTY); its other jobs pass. Cause not classified; no retry or source correction. Chain integration remains blocked.
• No shell scripts or skills changed; shellcheck/skill-change validation are N/A.
• Draft/no-merge: fix(safety): require consent for path tools outside the session worktree (#1305) #1610 is OPEN and moved to e262890dcb5f69ff6b7289f7baa491ec72a9bc03; this chain retains the explicitly approved pin 162c9bda89242a73f5ed55d7383a8d96ad19660d. Reconcile the base before integration.

Contributor Checklist

• Linked approved issue and added exactly one matching type label.
• Conventional commits; no Co-Authored-By trailers.
• Tests/docs accompany their behavior; no production launcher/history/registry changes in fixture units.
• Modified-shell/skill checks: N/A, none modified.
• Complete CI green and base reconciled before merge.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}