CompressedExecutor/ToolFilter/Arc<ShellExecutor>-style shadow-impls have the same ToolExecutor forwarding gap as #5900/#5938/#5931

[bug-ops]

Description

Same defect class as #5899/#5905/#5906 (fixed by #5930) and #5900/#5938/#5931 (fixed by #6011): a wrapper's impl ToolExecutor block omits an override for a cross-cutting method, so it silently falls through to the trait default instead of forwarding to the inner/wrapped executor.

Found by an adversarial critique pass during #6011's review (verdict: minor, non-blocking — confirmed dormant, not a live vulnerability, because TrustGateExecutor is unconditionally the outermost confirmation authority in production wiring today).

Three sibling wrappers in crates/zeph-tools/ still have gaps:

1. CompressedExecutor — missing requires_confirmation override while it forwards its other cross-cutting siblings (is_tool_retryable, is_tool_speculatable, etc.). One-line fix, same shape as the #6011 PR's plain-delegate pattern.
2. ToolFilter (wraps the ACP FileExecutor) — forwards none of the cross-cutting methods (requires_confirmation, is_tool_speculatable, is_tool_retryable, set_skill_env, set_effective_trust, checkpoint trio). Currently perf-only impact (no confirmation-gating or checkpoint-capable executor is wrapped by ToolFilter in production), but the same class of gap.
3. Arc<ShellExecutor>-style shadow-impls — partial forwarding, the same shape as the Arc<ShellExecutor> checkpoint-forwarding bug fixed in checkpoint_undo/redo/list never reach ShellExecutor — Arc<ShellExecutor>'s own ToolExecutor impl doesn't forward them #5985/fix(tools): forward checkpoint methods through Arc<ShellExecutor> #5998, but for the requires_confirmation/is_tool_speculatable methods rather than checkpoints. Benign only because the leaf executor doesn't currently specialize these methods away from the trait default.

Expected Behavior

Each wrapper should forward every cross-cutting ToolExecutor method to its inner/wrapped executor, matching the pattern established by CompositeExecutor/AdversarialPolicyGateExecutor/PolicyGateExecutor/ScopedToolExecutor/ShadowProbeExecutor after #6011.

Suggested Fix

Add self.inner.<method>(...) (or equivalent) forwards for the missing methods in each of the three files, with regression tests mirroring the "spy/stub inner executor returns a distinguishable non-default value" pattern used in #5930 and #6011.

Impact / Current Exploitability

Dormant, not a live incident — same reasoning as #5900's original dormancy note: no leaf executor in the workspace currently sets is_tool_speculatable(tool_id) == true outside test code, and TrustGateExecutor is unconditionally wired as the outermost confirmation authority in production, so these gaps are not currently reachable with a live policy divergence. Worth closing before any future refactor composes a confirmation-gating executor as a leaf inside one of these three wrappers.

Related

• checkpoint_undo/redo/list not forwarded by TrustGateExecutor/PolicyGateExecutor/AdversarialPolicyGateExecutor, breaking /undo in standard production wiring #5899/checkpoint_undo/redo/list not forwarded by ScopedToolExecutor/ShadowProbeExecutor — breaks /undo even after #5899, since these sit outside the gated chain #5905/ScopedToolExecutor does not forward requires_confirmation, defaulting to false for the outermost wrapper #5906 (fixed by fix(tools): forward checkpoint and confirmation methods through executor wrappers #5930) — original checkpoint-forwarding instance of this defect class
• CompositeExecutor does not forward requires_confirmation; AdversarialPolicyGateExecutor does not forward is_tool_speculatable #5900/CompositeExecutor does not override execute_tool_call_confirmed, silently re-running the full confirmation check on the composed tree #5938/PolicyGateExecutor/AdversarialPolicyGateExecutor do not forward requires_confirmation #5931 (fixed by fix(tools): forward requires_confirmation/is_tool_speculatable/execute_tool_call_confirmed through remaining ToolExecutor wrappers #6011) — requires_confirmation/is_tool_speculatable/execute_tool_call_confirmed instance
• checkpoint_undo/redo/list never reach ShellExecutor — Arc<ShellExecutor>'s own ToolExecutor impl doesn't forward them #5985/fix(tools): forward checkpoint methods through Arc<ShellExecutor> #5998 — Arc checkpoint-forwarding instance (same shadow-impl shape as sibling M2: Skills system — SKILL.md loading and shell execution #3 above, different methods)
• skill required-secrets env injection silently no-ops through CompositeExecutor #3869 — original defect class (set_skill_env/set_effective_trust across CompositeExecutor)

[bug-ops]

Additional gap found during CI-1344 architecture review, not covered by the description above: CompressedExecutor (crates/zeph-tools/src/compression/decorator.rs) has zero checkpoint_* overrides — not just the noted requires_confirmation gap. Confirmed via grep -n checkpoint crates/zeph-tools/src/compression/decorator.rs returning no matches, versus ToolFilter/CompositeExecutor/etc. which do implement (or now correctly lack, by design) the trio.

This means when tools.compression.enabled = true and the wrapped chain includes a checkpoint-capable ShellExecutor (checkpoints_enabled = true), /undo//redo/checkpoint-list dispatched against the outermost CompressedExecutor (see build_compressed_executor in src/agent_setup.rs:629-676, which wraps composite — the full tool chain — as the last decorator before returning ToolSetup.executor) would silently report CheckpointActionResult::unsupported()/CheckpointListResult::default() even though the inner ShellExecutor does support checkpoints. Same shape and same production call path as the original #5899/#5905 findings, just on a decorator that sits outside those three gate wrappers.

Currently not reachable in the project's default .local/config/testing.toml (compression is enabled there but checkpoints_enabled defaults to false and is not overridden), so still dormant today — but it is a live combination away from breaking /undo, unlike the is_tool_speculatable/ToolFilter gaps which need an as-yet-nonexistent leaf executor to specialize away from the trait default. Recommend folding the checkpoint trio into whatever fix lands for this issue's CompressedExecutor item.