Every terminal command passes review before the shell

Your production terminal is a URL, which means the traffic to it is HTTP, which means something can sit in the path.

So something does: commands route through a hoody-exec script before they reach the shell. The script pattern-matches the obvious catastrophes: rm -rf outside a whitelist, a DROP TABLE against the wrong host, a force-push to main: and for anything on the list, it refuses and says why. Everything else passes through with a log line. The contractor with prod access this sprint operates inside the same rules as everyone, because the rules live in the path, not in a wiki page about being careful.