V3: All five dispositions, and both failure postures

[afogel]

Master doc: docs/shaping/acs-reference-impl-slices.md §V3 — authoritative for this slice's scope.

Demo: One bundle produces allow, deny, ask, a rewritten tool call, and a policy-fired allow that is AGT's warn. Kill the Guardian under proceed and the step proceeds with an audit event; under deny it blocks. Posture negotiated at handshake.

Blocked by: #3
Plan: docs/superpowers/plans/2026-08-10-v3-dispositions-and-postures.md

Implemented across 10 tasks. 320 tests (319 pass, 1 skip — the byte-identity check, which bun run verify:pin runs for real), typecheck clean, verify:pin green, policy/lib/ byte-untouched.

Amendments

• Blocker resolved — S13 gets a session-keyed file at .acs/sessions/<session_id>.json; one interface, two implementations (file-backed for subprocess hosts, in-memory for V5's in-process plugin) — a0ad0e7
• Demo corrected — ACS defer has no AGT verdict behind it, so it comes off the demo. ACS being the wider contract is the finding, not a gap to fill — a0ad0e7
• R1.3 qualified — annotations reaches AGT's policy input from a manifest-declared annotator, never from the snapshot, so AGT's warn gate is drivable only by a Guardian-originated score. One more cell for V7 to resolve — a0ad0e7
• AGT's stock approval gate is a single global switch, so several verdict classes need several config documents. Recorded as a mechanic of the demo, per R4.3 — a0ad0e7
• "Rest of the slice is data, not structure" corrected — the modify path needs two structural pieces: synthesizing modifications from an AGT transform, and applying them — a0ad0e7
• D8 closed on the spec default, proceed — a0ad0e7
• Risk row 11: AGT's stock warn gate has no ACS v0.1.0 wire source — a0ad0e7
• Risk row 12: V3's fixture bundles could fork the pinned bundle; the helper asserts per-file byte identity — a0ad0e7
• §V2's R5.2 import gate widened to forbid host-adapter, since N51 reads a host-side artifact — a0ad0e7
• §V7 gains a cell: warn is green for the Guardian, red for a wire consumer — a0ad0e7
• Plan's Global Constraint 2 amended in place — it contradicted constraint 3, the contradiction shipped as an unrecorded fail-open, and constraint 3 governs: an unauditable bypass is not one §6.4 permits — 5277b6d
• §V3 row corrected — the shim never "always exits 0 once a payload parses"; there is no exit-1 tier now — 5277b6d
• Risk row 13: seq is derived by reading the log, so concurrent hooks can duplicate a number — and V6 wants that index — 5277b6d
• Risk row 14: a ServerHello that cannot be persisted is now visible in the audit entry but still unused for the step that negotiated it — 5277b6d

[afogel]

Deferred backlog cleared. 347 tests (346 pass, 1 skip — the byte-identity check, which verify:pin runs for real), typecheck clean, verify:pin green with network, policy/lib/ still byte-untouched.

Two of the deferrals turned out to be fail-opens of the same shape as the seven already closed in this slice:

• A hookmap typo turned every deny into a proceed (2ec0857). loadHookmap validated that permissionDecision is a non-empty string but not that it is a value the host accepts — deliberately, since the adapter must not know any host's enum (R3.2). So permissionDecision: dney loaded cleanly and a real policy deny for rm -rf / rendered as {"permissionDecision":"dney"} with exit 0; Claude Code does not recognise the value, reads it as no decision, and proceeds. The shim — host-specific by definition — now validates against Claude Code's three accepted values and exits 2. Reproduced before and after.
• A negotiated posture that could not be persisted was known and unused (2ec0857). When store.set threw, the shim discarded the ServerHello handshake() had already returned, so a deployment declaring on_decision_failure: deny failed open on that step. The value in hand is now authoritative for the hook that negotiated it; persisting is an optimisation for later hooks. Closes risk row 14.

Audit accuracy (2b32cd0): an unrenderable decision was audited as "no decision arrived from the guardian" when one did arrive — same misattribution class as the pre-envelope case, now decision_unrenderable. And session_failure.kind distinguished nothing between "the handshake never reached the Guardian" and "the ServerHello could not be stored"; the second is the one that matters and now says so.

Also: the ServerHello is validated before storing (a malformed one silently re-handshook on every hook forever), modify gained the reason_from every sibling entry had so a rewrite reaches the transcript explained, both tailers stopped reporting a read failure once per tick, and the round-trip contract test gained the drift direction it could not catch.

Everything on the do-not-touch list was honoured — including the four runbook-quoted reasoning strings, which are byte-identical and now carry a comment warning against rewording them, since those captures were reproduced against a live Guardian.