Whether a gate BLOCKS on a deny (enforce, the default) or only RECORDS what
it WOULD block while letting everything through (observe — the shadow / rollout
mode: trust a new gate by watching it first, then promote to enforce). This is
the WAF "shadow mode" pattern, the one essential mode (block vs don't-block-but-
record) — not a vocabulary of on-fail actions. HARNESS-NEUTRAL by construction:
observe just exits 0 and writes a local record, so it behaves identically on
Claude Code and Codex (no harness-specific field names involved).
Whether a gate BLOCKS on a
deny(enforce, the default) or only RECORDS what it WOULD block while letting everything through (observe— the shadow / rollout mode: trust a new gate by watching it first, then promote toenforce). This is the WAF "shadow mode" pattern, the one essential mode (block vs don't-block-but- record) — not a vocabulary of on-fail actions. HARNESS-NEUTRAL by construction: observe just exits 0 and writes a local record, so it behaves identically on Claude Code and Codex (no harness-specific field names involved).