refactor(guard): use semantic command identifiers

[seonghobae]

Owner and bounded context

ContextualWisdomLab/EgressWeave owns the repository-local fail-closed autonomous product guard. Its trusted subprocess seam still exposed organization-owned generic identifiers (_run, args, cwd, env, text, check) even though the bounded context provides explicit command-execution meanings.

TDD lineage

• Protected base re-fetched immediately before the repair: main@978f65172a23d69a9d92bf58bbcbe363a459238f.
• RED commit c2f2c521e5559fb16eb19891943e2a5bd43e9ca7 adds an AST contract requiring _run_command(command_arguments, *, working_directory, command_environment, text_mode, check_result) and rejecting the old _run definition. Production remained unchanged at that exact RED head.
• GREEN commit e2cb6a4f0c106e13f2c2af0c4ee7a4a602705e8e renames the private helper and propagates every repository-local caller through ordinary non-force history.

Compatibility boundary

The underlying Python subprocess.run(...) keywords (cwd, env, check, text) are externally defined standard-library API names and remain unchanged at that adapter boundary. EgressWeave-owned identifiers immediately outside the adapter are semantic. No workflow command, CLI flag, patch format, Git invocation, persisted data, database object, network policy, or release contract changes.

Safety / verification

• Branch is two commits ahead of the unchanged protected base and zero commits behind at PR creation.
• Changed files are limited to scripts/ci/hourly_product_guard.py and tests/test_hourly_product_guard_semantic_identifiers.py.
• The existing guard self-test and full repository CI remain authoritative; fresh exact-head GitHub checks are required before integration.
• No branch protection, security rule, coverage gate, or failure behavior is weakened.

Merge contract

Keep Draft until the unchanged exact head has fresh terminal-success required checks, valid current-head review findings and threads are resolved, and the repository's independent non-author approval / ordinary merge policy is satisfied. Do not transfer predecessor evidence, self-approve, force-push, or bypass protection.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}