[dmoliveira]

The experimental V2 tool-error adapter previously copied a prototype from an untrusted error after checking only its shape. A forged prototype could expose sensitive data through custom inspection.

Require a separately trusted, host-created permission-decline sample before registering the adapter. Capture its prototype once at registration, build a clean cause from that prototype, and reject a missing or structurally invalid sample before installing a hook. Incoming error prototypes are never used. Add a live negative control for the forged prototype and an independently constructed Effect error, plus CI coverage on OpenCode 2.2.5 and 2.2.6.

This adapter remains unconfigured. The caller must authenticate the sample: the current public V2 plugin API does not expose the host decline constructor. The live fixture obtains one through its own controlled permission assertion; that fixture is not a production bootstrap. Other gateway and fail-closed boundary work remains outstanding.

Validation:

• Gateway lint and full Node 22 suite: 1,447 tests passed.
• Isolated OpenCode 2.2.5 and 2.2.6 permission rejection, feedback, cancellation, forged-prototype, tool-error and shell smoke tests passed.
• Python control tests, targeted Ruff checks and git diff --check passed.
• Full repository pre-commit hook (make validate).