GJC SDK approved operations

This skill is for trusted local scripts. Its approval challenge is a procedural safety policy, not a security boundary; SDK core retains lifecycle and attachment authority.

Before every operation

1. Select an exact session ID through gjc sdk session list --json or a caller-provided stable ID, then fail closed when the Broker cannot prove it available.
2. Use only gjc sdk session raw query|control|global for SDK operations; static help and verified root error-evidence retrieval are discovery-only exceptions. Never scan state roots, read endpoint credentials, or open raw per-session WebSockets.
3. Validate the operation against the allowlist below. Do not expose arbitrary operation passthrough.
4. Pass all command data as argv values, never through a shell command string.
5. For every lifecycle operation, show the exact operation and session target to the human through the external host.
6. Obtain one explicit approval immediately before the call. Approval is single-use and becomes invalid if the operation, input, or target changes. The templates emit a nonce-bearing, input-bound APPROVE <session> <operation> <digest> <nonce> challenge and read the exact response once from the active process's standard input. Present it verbatim through the external host only after the human accepts that exact action.
7. On denial, cancellation, unavailable target, or changed input, send no CLI request.
8. Add --json explicitly to every machine CLI call. Successful session JSON is unchanged; default ordinary failures are text on stderr. Except for session.lookup, consume the single gjc.command-error version 1 stdout envelope on failure, preserve outcome certainty/references, and never publish raw stderr or interpret absent JSON as success. session.lookup deliberately returns a structured reconciliation DTO (ok, operation, status, certainty, error) on stdout and may exit 1 for outcomes such as not_found or conflict; preserve those fields instead of treating the DTO as a malformed failure envelope. Usage exits 2; operation failures exit 1.

Allowed per-session controls