Forged action requests for locked, unknown and ask-only capabilities and a
hostile model emitting tool calls and policy in perception output all end
in denial or an approval request; nothing executes and policy is unchanged.
Non-JSON and wrong-shape model output falls back to the deterministic path.
Drives, goal kinds and the capability registry contain nothing about
self-preservation, replication, permissions or the mind's own lifecycle.
Andy Dixon
f4f4d75ccb