Module shadow_probe 

ShadowProbeExecutor: wraps an inner ToolExecutor and runs an LLM safety probe before delegating high-risk tool calls.

Wiring position (outermost first): ScopedToolExecutor → ShadowProbeExecutor → PolicyGateExecutor → …

The probe is skipped for low-risk tools, so the common path has zero latency overhead. On ProbeVerdict::Deny, returns ToolError::SafetyDenied immediately without running PolicyGateExecutor — the policy gate remains as a second defence-in-depth layer for calls that pass the probe.

Quarantine short-circuit (#5740)

Because ShadowProbeExecutor sits outside TrustGateExecutor (deep in the PolicyGateExecutor chain), a quarantine-denied call would otherwise reach the LLM probe first, which frequently denies it with a generic reason instead of TrustGateExecutor’s named, deterministic quarantine_denial_message. To avoid this, execute_tool_call/execute_tool_call_confirmed check the turn’s effective trust and the tool id against the same QUARANTINE_DENIED set TrustGateExecutor uses, and short-circuit to the identical denial message before invoking the probe. The outcome is still recorded via ProbeGate::record (as "quarantine short-circuit: {reason}"), so cross-session shadow-event detection (#5494/#5449) keeps seeing these denials even though the LLM probe itself never ran. All other trust levels and non-quarantine-denied tools still go through the LLM probe exactly as before.

Legacy path

execute() and execute_confirmed() bypass the probe (no structured tool id available). This is intentional — the structured execute_tool_call* path is the active dispatch path in the agent loop.

Structs

ShadowProbeExecutor

Wraps an inner ToolExecutor and applies an LLM safety probe before high-risk calls.

Enums

ProbeOutcome

Result of a probe gate evaluation.

Traits

ProbeGate

Probe interface required by ShadowProbeExecutor.