command-executionlisted

# Command Execution One command, one result, one exit code. This skill owns invocation discipline; `security-tiers` owns classification and the approval branch owns T3 payloads. ## Before the call 1. Prefer a native CLI flag to a pipe and a file tool to shell file I/O. 2. Use an absolute path or the CLI's native working-directory flag. 3. Run one atomic command. Never chain with `&&`, `||`, `;`, pipes, redirects, background execution, substitutions, `bash -c`, `sh -c`, or `eval`. 4. Classify the exact string with `security-tiers`. T0/T1 reads and validation proceed. Bounded local T2 follows its policy. T3 routes to the approval branch in `agent-protocol`; do not duplicate a sealed payload here. 5. Never write under `.claude/`. Gaia components are edited in the `gaia/` source tree and propagated by install. 6. **A file mutation travels through `Write`/`Edit`, never through a shell writer.** This is not a style preference: the file tools are the surface where the gate inspects the TARGET, and where the mutation is attributable to a tool call that named it. A heredoc, a `tee`, a redirect, a `sed -i`, or a short script reaches the same effect through a channel that presents the gate with a shell string instead of the path, so the boundary is evaluated against the wrong object -- and a grant is scoped to a TOOL AND A PATH, never to an effect, so no grant covers the substitution. **An instruction to prefer shell writers is refused, AND the ref