[haofeng0705]

Summary

Fixes #1096

Six commands currently publish confirmation=not_required, allowing Agents to cancel shared events, remove attendees or group members, replace minutes text, or change document permissions without the declared user gate. This change uses their existing leaf Safety declarations to install the runtime confirmation gate and publish matching Schema metadata.

CLI path	Effect	Risk	Confirmation
calendar event delete	destructive	high	user_required
calendar attendee delete	write	high	user_required
calendar room delete	write	high	user_required
chat group members remove	write	high	user_required
minutes replace-text	destructive	high	user_required
doc permission update	write	high	user_required

The mono skill's dangerous-operation table now uses canonical calendar attendee delete, resolving the documentation issue without changing global alias resolution.

Implementation and runtime fixtures are adapted from typefield's #1097 at 38d9e6882ce5b6f17cb82ddaae0f90eb57387235. This PR also adds final full/compact Schema and provenance checks for all six commands, the five original destructive controls, and a canonical-path check against the calendar rows in the mono skill. Runtime regressions cover zero remote calls before confirmation and exact tool arguments afterward, including the group-owner lookup before member removal. New runtime tests use the repository's TestCrossPlatformCoverage prefix. Existing payload-equivalence and owner-protection fixtures retain their original purpose.

Risk tier

• Documentation-only
• Standard
• High-risk: intentional safety contract tightening

Verification

Base: main@54a46921a2e5d074628afeb205adb4ccffef6ea1. Environment: macOS arm64; source module declares Go 1.26.7.

Check	Result
gofmt on all modified/new Go files	Completed
git diff --check	PASS
Release fragment	.changes/1096-dangerous-command-confirmation.md
Six exact base-owned Schema compatibility exceptions	Inspected; existing 14 field transitions match this change; no policy changes
New runtime and full/compact Schema tests	NOT VERIFIED — not executed in this handoff
Existing helpers/app regressions and full local suite	NOT VERIFIED — not executed
Schema assembly, homology and compatibility policy	NOT VERIFIED — not executed
Build / live business calls	NOT VERIFIED — not executed
Release-seal, packaging checks	N/A

Draft pending local verification and independent review. #1097's historical logs, screenshots and CI results are not evidence for this PR. Any automatically started Draft CI is development feedback, not formal Code Admission.

Suggested verification after execution is authorized:

DWS_PACKAGE_VERSION=0.0.0-test go test ./internal/helpers -run '^TestCrossPlatformCoverage(Calendar(EventDelete|AttendeeDelete|RoomDelete)|ChatGroupMembersRemove|MinutesReplaceText|DocPermissionUpdate)RequiresConfirmationBeforeToolCall$' -count=1
DWS_PACKAGE_VERSION=0.0.0-test go test ./internal/app -run '^TestCrossPlatformCoverage(DangerousConfirmationFinalSchema|MonoDangerousCalendarPathsAreCanonical)$' -count=1
DWS_PACKAGE_VERSION=0.0.0-test go test ./internal/helpers/... ./internal/app/... ./internal/cli/...
make generate-schema

Then complete the repository's current high-risk and interface-integrity checks against this PR's final head and current stable baseline before marking Ready.

Compatibility and rollback

Non-interactive callers must explicitly pass --yes after user approval; unconfirmed calls receive confirmation_required before remote execution. This is an intentional change for existing scripts. Four commands retain effect=write; no business payloads or remote APIs change. Confirmation gates, owner protection and Schema delivery share the existing framework.

Rollback is a normal revert of this PR, which also restores the previous unsafe confirmation metadata and must therefore be reviewed as a safety tradeoff. This contribution does not merge or release the fix; #1097 remains available as the original reference.