Module bash_command 

Minimal, conservative classification of Bash command strings for policy decisions. The first consumer is the verification-phase gate, which must recognize a standalone tracevault verify-start (the command that opens the phase) WITHOUT being fooled by compounds that hide other commands.

Functions

is_standalone_tracevault_subcommand

True iff command is a single, simple invocation of tracevault <subcommand> — no shell compounding of any kind. Rejecting compounds is the security crux: tracevault verify-start && rm -rf / must NOT match, or the gate could be tricked into ignoring a hidden command.