Merge nucleic/rustic-meadow-koala-wtwq into dev

2026-07-27 02:26:30 -07:00
parent 684858ae26
commit ea257181dd
3 changed files with 38 additions and 3 deletions
@@ -1,4 +1,8 @@
-# narOS shell environment (nash-default-shell). NUCLEIC_REAL_BASH is nash's
-# parse-failure fallback + NUCLEIC_NASH_DISABLE target (NASH.md §4.1).
-export NUCLEIC_REAL_BASH=/usr/bin/bash.real
+# narOS shell environment (nash-default-shell).
+#
+# Deliberately does NOT export NUCLEIC_REAL_BASH: nash's fallback target is an operator
+# lever, and operator levers now come from the trusted policy file (/etc/nucleic/nash.conf,
+# NASH.md §4.3), never from the environment — which is the agent's to write. nash carries
+# /usr/bin/bash.real as its compiled-in default anyway, so the export bought nothing but a
+# published bypass.
 [ -n "${SHELL:-}" ] || export SHELL=/usr/local/bin/nash