[bar-capsule]

Stacked on #485. Next: #487. The full stack is listed in #22.

What changed

• The destructive-command patterns and their bounded scans move, unchanged, from acs/guardian/example_guardian.py to acs/examples/destructive_bash.py; the example Guardian imports the matcher it uses.
• An import-linter contract keeps imports flowing integrations → client → core, and keeps all three from importing acs.guardian, acs.examples or acs.testing. CI runs uv run lint-imports.
• The README lists acs/examples and the import rule, and names ACS_REQUIRE_PROFILES among the settings Config reads. A security test patches the state directory instead of reloading acs.client._store.
• c59c00e8 qualifies the mapping pages' conformance claim to match the adapters README: they cover the floor their tables list, not full ACS-Core conformance, and name the three Core requirements from later specification changes that Align the adapters with the current spec #488 then implements (Fix the HMAC key derivation, define key_id, and record an unresolved request_id_ref #272, Record every decision failure and count them at session end #273, and a signature on every request).

Ariel's findings this answers

• Blocking: package layout: the examples/ split and the import-linter contract.

Which issue does this implement

Part of #134

Base branch

Stacked on #485, not on integration. It lands through #22; see the stack in #22.

Type of change

• Reference implementation or adapter

I tested this

At this slice's top (c59c00e8), with claude removed from PATH and ACS_LIVE_CLAUDE and ACS_SPEC_DIR unset: 456 passed and 3 expected skips with the NAT extra, 392 passed and 3 expected skips without it. The skips are the two opt-in live Claude Code tests and the manual Cursor procedure. CI passes on this PR, including lint-imports and the installed-wheel check on Python 3.11 and 3.12.

Checklist

• Commits are signed off with git commit -s (required by the DCO)
• Prose follows STYLE.md
• No secrets, tokens, or internal URLs in the diff

Security

Unchanged decisions; the example policy moves, and the import direction is checked.

[drk-ram]

Reviewed commit c59c00e8c7c37a019a09c802546bcd45fa3a036a against its stated stacked base.

No additional blocking finding in this slice.

The policy move preserves the pattern set, scan cap, and both scanner bodies exactly; I compared their parsed syntax trees against the parent, accounting only for the matcher's public rename. The Guardian imports the matcher it actually calls. Both import contracts pass and cover the intended dependency direction plus the prohibition on production-layer imports from Guardian, example, or testing packages. The lockfile adds only grimp and import-linter, with the corresponding local-package metadata update.

The focused matcher tests below passed on Windows/Python 3.11; lint-imports kept both contracts. The broader selection had 119 passed, 10 failed, and 4 setup errors, including the inherited Windows state-publication issue raised on #483 and POSIX-only permission/Guardian fixtures. This is approval of the extraction and import-rule delta, not clearance of those lower-stack issues.

Local validation (from adapters, Python 3.11):

python -m pytest tests/common/test_security.py -k "Item12 or Item13" -q --tb=short

Result: 7 passed, 39 deselected in 0.27s

[rocklambros]

Closing this slice because PR #22 (the reference adapters for Claude Code, Cursor and NAT) merged into integration as 2630ec2, and that merge carries every slice in this stack. The top of the stack had the same files as PR #22's final commit, so nothing in this slice was left behind. Thanks, Bar, for cutting the adapters into pieces this size, because it made the review possible.