prefix_rule(
    pattern = ["powershell", "-NoProfile", "-ExecutionPolicy", "Bypass", "-File", ".\\verify.ps1"],
    decision = "allow",
    justification = "verify.ps1 is the project harness verification entrypoint.",
)

prefix_rule(
    pattern = ["powershell", "-NoProfile", "-ExecutionPolicy", "Bypass", "-File", ".\\env-check.ps1"],
    decision = "allow",
    justification = "env-check.ps1 is a harness environment readiness check.",
)

prefix_rule(
    pattern = ["powershell", "-NoProfile", "-ExecutionPolicy", "Bypass", "-File", ".\\codex-loop.ps1"],
    decision = "prompt",
    justification = "codex-loop.ps1 may edit files, update task state, write traces, and commit.",
)

prefix_rule(
    pattern = ["pwsh", "-NoProfile", "-Command"],
    decision = "prompt",
    justification = "Inline PowerShell can hide arbitrary operations; require review unless a narrower rule matches first.",
)

prefix_rule(
    pattern = ["powershell", "-NoProfile", "-Command"],
    decision = "prompt",
    justification = "Inline PowerShell can hide arbitrary operations; require review unless a narrower rule matches first.",
)
