M3.1: action classes and the fast path

Every execution tool call, the driver's and a helper's, gets a verdict
from code before it runs (P3, P4, D6).

- nisse_core.actions, nisse-core's first code: Action and Verdict, and
  reading shell commands statically, segment by segment (cd, wrappers,
  sh -c). What can't be read that way is unknown; a line is as bad as
  its worst command.
- nisse_dev.loop.actions, the rule table: reading, checks and tests are
  harmless; workspace edits, local git and installs on the build VM are
  contained; pushing, other hosts, uploads, publishing, the forge's own
  tools, deleting outside the workspace and wrecking the VM are
  dangerous; changing branches by hand is refused (the harness owns
  branches) with a pointer to the milestone tools.
- A dangerous call isn't run. The item waits on the operator with a
  question rendered from the action, and `allow` lets exactly that
  action run once. A helper can't ask, so it is refused and told to
  hand back. Unknown actions run, logged, until the classifier (M3.2).
- Every verdict is an action_verdict event, which no model sees, and an
  oplog line; `details` shows the counts and every action not simply
  run.
- The property walk gains dangerous_only_when_allowed (checked against
  a mutant that doesn't use the allow up); the slice e2e checks every
  call was judged and none needed an allow.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

docs/Architecture.md

@@ -738,6 +738,9 @@ Installing on any other host is dangerous.
 | Contained (in scope) | Editing the workspace; milestone branches, pushes and PRs; commenting on its issues and PRs; filing agreed issues (D1); changing its build VM (D3) |
 | Dangerous | Merging to the default branch (unless the trust dial allows), deleting remote branches or others' work, changing repository settings, anything outside the item's repository or build VM |
 
+Changing branches by hand is neither: it is refused, with a pointer to the
+milestone tools, since the harness owns branches (D4).
+
 ### D7. Deployment and isolation
 
 **The agent** is a container on the agent host (X1) with its state, secrets and API

docs/Development-Plan.md

@@ -25,11 +25,11 @@ Only `nisse-dev` has real code; `nisse-core` and `nisse-ops` are placeholders.
 |---|---|---|
 | **L1** Work model | mostly done | Work items with an active pointer (M1.1); issue intake (M2.1); queue, parking and blocked items (M2.2) on the new loop; no grace period yet |
 | **L2** Agent loop | mostly done | The loop (Phase 2), the only one since the switch-over (M2.8): driver runs, waits, `stop`, `abandon`, question runs |
-| **L3** Authority | partial | Go-aheads bound to the restatement's revision, on the issue and its conversation (M2.1); no action classes yet (M3.1) |
-| **L4** Classifier | none | |
+| **L3** Authority | partial | Go-aheads bound to the restatement's revision, on the issue and its conversation (M2.1); action classes and the fast path, with `allow` bound to one dangerous action (M3.1); no trust dial yet (M3.3) |
+| **L4** Classifier | none | The fast path's verdicts are logged for its evaluation set (M3.1); unknown actions run until it exists (M3.2) |
 | **L5** Conversation | partial | Matrix transport, mentions, lenient commands; on the new loop, a thread per item, named and ambiguous commands, plain-language go-aheads (M2.3); little explanation |
 | **L6** Context | partial | Context fitting, per-role views and orchestrator facts (M1.2); no scope or agent memory |
-| **L7** Canonical log | partial | Work item and actor on every event, `fact` (M1.1, M1.2); no `classifier_verdict`, `knowledge_retrieved` |
+| **L7** Canonical log | partial | Work item and actor on every event, `fact` (M1.1, M1.2); `action_verdict` (M3.1); no `knowledge_retrieved` |
 | **L8** Durability | mostly done | WAL store, intents, boot reconciliation, PR adoption, comment redelivery; to move onto the new loop |
 | **L9** Models and roles | mostly done | LiteLLM, eval capture; on the new loop: `driver`/`helper`/`expert`/`classifier` pinned per item, capability profiles in briefings, delegation and `ask_expert` with triggers (M2.6) |
 | **L10** Knowledge vault | none | |
@@ -310,8 +310,26 @@ the live session's fixes in #119 and #122). `nisse-dev` runs only the loop.
 
 ### Phase 3 — Authority
 
-**M3.1 Action classes and the fast path.** *Needs discussion.* Harmless, contained
-and dangerous actions per agent (P3, D6), static fast-path rules.
+**M3.1 Action classes and the fast path.** *Needs discussion.* **Done** (this PR).
+Harmless, contained and dangerous actions per agent (P3, D6), static fast-path rules.
+- `nisse_core.actions` (the shared part, `nisse-core`'s first code): `Action`,
+  `Verdict`, and reading shell commands statically, segment by segment (`cd`,
+  wrappers like `sudo` and `timeout`, `sh -c`); what can't be read that way is
+  unknown, and a line is as bad as its worst command.
+- `nisse_dev.loop.actions`, the rule table: reading, checks and tests harmless;
+  workspace edits, local git and installs on the build VM contained; pushing,
+  other hosts, uploads, publishing, the forge's tools, deleting outside the
+  workspace and wrecking the VM dangerous; changing branches by hand refused.
+- Every execution call is screened before it runs, the driver's and the
+  helper's. A dangerous one isn't run: the item waits on the operator with a
+  question rendered from the action, and `allow` lets exactly that action run
+  once. A helper can't ask, so it is refused and told to hand back.
+- Every verdict is an `action_verdict` event (no model sees it) and an oplog
+  line; `details` shows the counts and every action not simply run.
+- Decided: unknown actions run, logged, until the classifier (M3.2), since this
+  is a project in progress, not production.
+- Deferred: the classifier and in-scope judgement (M3.2), the trust dial
+  (M3.3), egress enforcement (X2).
 
 **M3.2 The classifier.** *Needs discussion.* L4, its model, fail-closed verdicts,
 overrides as an evaluation set.