Pipeline increments for the tool safety guardrail: an allowed-tools short-circuit rail that fail-closed rejects unlisted tools, and a read-only decision observer rail that emits ALLOW/DENY audit summaries through a host-injected listener. Consumes the permissions snapshot supplied by the host; owns no decision logic.