Suggested Checks describe verification work; they do not execute it from the gateway. GDP Desktop evaluates local policy, runs eligible commands locally, and records check-run evidence.
Suggested Checks are requests, not shell authority
An AI client can attach structured verification commands to a patch or submit a standalone check bundle. The hosted gateway validates and transports those suggestions; it does not execute them.
Commands are represented as argv tokens rather than an opaque shell string.
Working directory and command policy remain bounded by GDP Desktop.
Active policy may wait for review; eligible AFK, Custom, or Run Everything policy may run safe checks locally.
Read the evidence that actually ran
A GDP check run can record the working directory, exit code, duration, bounded output, and correlation to a patch or task. That recorded result—not the model’s expectation—is the basis for a pass or failure claim.
Foreground checks stay user-controlled
Checks that require native foreground UI are not AFK Auto-Run work simply because Run Everything is enabled. GDP keeps them available for explicit local Run or Run All instead of repeatedly stealing focus in the background.
Always Run trust is explicit and scoped. A previous successful command does not silently authorize a broader command family.
