tests:
  # ── Java safe invocations ───────────────────────────────────────
  - id: java-safe
    command: "java -jar app.jar"
    expected:
      decision: allow
  - id: javac-safe
    command: "javac Main.java"
    expected:
      decision: allow
