M3.1: action classes and the fast path

Every execution tool call, the driver's and a helper's, gets a verdict
from code before it runs (P3, P4, D6).

- nisse_core.actions, nisse-core's first code: Action and Verdict, and
  reading shell commands statically, segment by segment (cd, wrappers,
  sh -c). What can't be read that way is unknown; a line is as bad as
  its worst command.
- nisse_dev.loop.actions, the rule table: reading, checks and tests are
  harmless; workspace edits, local git and installs on the build VM are
  contained; pushing, other hosts, uploads, publishing, the forge's own
  tools, deleting outside the workspace and wrecking the VM are
  dangerous; changing branches by hand is refused (the harness owns
  branches) with a pointer to the milestone tools.
- A dangerous call isn't run. The item waits on the operator with a
  question rendered from the action, and `allow` lets exactly that
  action run once. A helper can't ask, so it is refused and told to
  hand back. Unknown actions run, logged, until the classifier (M3.2).
- Every verdict is an action_verdict event, which no model sees, and an
  oplog line; `details` shows the counts and every action not simply
  run.
- The property walk gains dangerous_only_when_allowed (checked against
  a mutant that doesn't use the allow up); the slice e2e checks every
  call was judged and none needed an allow.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

nisse-dev/src/nisse_dev/loop/driver.py

@@ -36,6 +36,22 @@ class RunOutcome:
     note: str = ""
 
 
+# The waiting outcome a dangerous action ends a run with (P3): the harness
+# puts it to the operator, rendered from the action itself.
+ASK_ALLOW = "ask_allow"
+
+
+@dataclass(frozen=True)
+class Screening:
+    """What the fast path says about an execution call before it runs:
+    ``run`` it, ``refuse`` it (the result says why, and the run goes on), or
+    ``ask`` the operator (the run ends, waiting)."""
+
+    decision: Literal["run", "refuse", "ask"]
+    text: str = ""  # the call's result when not run; for ask, the question
+    key: str = ""  # for ask: what an allow would bind to (L3)
+
+
 class Driver:
     def __init__(
         self,
@@ -64,11 +80,14 @@ class Driver:
         checks: Mapping[str, Callable[[dict[str, Any]], str | None]] | None = None,
         model: str | None = None,
         on_turn: Callable[[str], None] | None = None,
+        screen: Callable[[ToolCall], Screening] | None = None,
     ) -> RunOutcome:
         """``handlers`` answer control tools that don't end the run (e.g.
         start_milestone): each returns a result and whether it succeeded.
         ``checks`` vet a waiting tool's arguments: a problem is the call's
-        failed result and the run goes on, so the model puts it right."""
+        failed result and the run goes on, so the model puts it right.
+        ``screen`` judges each execution call before it reaches the build VM
+        (P4)."""
         handlers = handlers or {}
         checks = checks or {}
         model = model or self._model  # the work item's pinned driver (L9)
@@ -143,6 +162,40 @@ class Driver:
                         False,
                     )
                 else:
+                    screening = screen(call) if screen else Screening("run")
+                    if screening.decision == "ask":
+                        transcript.append(
+                            ToolResult(
+                                call_id=call.call_id,
+                                result="not run: it needs the operator's agreement, "
+                                "and they've been asked; your turn has ended",
+                                success=False,
+                            )
+                        )
+                        skip_calls(
+                            transcript,
+                            calls[index + 1 :],
+                            "not run: the turn had ended",
+                        )
+                        return RunOutcome(
+                            "wait",
+                            ASK_ALLOW,
+                            {"question": screening.text, "key": screening.key},
+                        )
+                    if screening.decision == "refuse":
+                        transcript.append(
+                            ToolResult(
+                                call_id=call.call_id,
+                                result=f"not run: {screening.text}",
+                                success=False,
+                            )
+                        )
+                        skip_calls(
+                            transcript,
+                            calls[index + 1 :],
+                            "not run: fix the call above",
+                        )
+                        break
                     outcome = workspace.dispatch(call.tool, call.arguments)
                     result, ok = outcome.result, outcome.success
                 transcript.append(