[dmoliveira]

Summary

• Retain all direct-shell probe fixtures and replace pathname-based trace, gate, and witness writes with bounded authenticated localhost controls.
• Correlate shell identity, successful exit, and captured output; require a positive witness control and distinguish the shell-create 500 from owner-verification or later status failures.
• Document the bounded observation, same-user and process-group limitations, and the 2.2.5/2.2.6 version scope. No gateway adapter is enabled.

Validation

• Ruff lint and format, Python compilation, 11 focused unit tests, git diff --check, and static pre-commit hooks passed.
• A tmux-backed 2.2.5 live run under verified localhost/write/signal restrictions returned MEASURED with the fixture retained. This is measurement, not protection or proof against delayed effects.
• Local pre-commit make validate was skipped: its suite touches a shared fixed-name configuration lock and other probe fixtures; exact-head CI runs make validate and selftest in an isolated runner, plus gateway build/tests and both pinned live hosts.
• OpenCode 2.2.6 was not available locally; the pinned CI matrix supplies that executable-specific run.