Order by severity and regression-test with an attack corpus

Implement result selection precisely: deny beats everything; among asks, parser-mismatch severity beats informational (a command flagged for both redirection and an escaped-operator trick must report the trick - the finding that means 'this will not execute the way it parses'); informational asks are deferred and only surface if nothing worse fired. Build the attack corpus: every attack class from your validators plus real transcripts, each labeled with expected outcome and expected reporting validator. Add benign-command cases asserting allow/passthrough to keep false positives visible. Run the corpus in CI; any change to a validator must keep the whole corpus green. Document the known-false-positive policy (e.g. find -exec's escaped semicolon asks once) - deliberate asks are fine, undocumented ones erode trust.