Module shadow_probe 

ShadowProbeExecutor: wraps an inner ToolExecutor and runs an LLM safety probe before delegating high-risk tool calls.

Wiring position (outermost first): ScopedToolExecutor → ShadowProbeExecutor → PolicyGateExecutor → …

The probe is skipped for low-risk tools, so the common path has zero latency overhead. On ProbeVerdict::Deny, returns ToolError::SafetyDenied immediately without running PolicyGateExecutor — the policy gate remains as a second defence-in-depth layer for calls that pass the probe.

Legacy path

execute() and execute_confirmed() bypass the probe (no structured tool id available). This is intentional — the structured execute_tool_call* path is the active dispatch path in the agent loop.

Structs

ShadowProbeExecutor

Wraps an inner ToolExecutor and applies an LLM safety probe before high-risk calls.

Enums

ProbeOutcome

Result of a probe gate evaluation.

Traits

ProbeGate

Probe interface required by ShadowProbeExecutor.