Reference shim: how is the §4.1 startup posture (proceed / refuse) meant to be configured?

[hadisoufi20]

While running the AGT reference implementation (integration, commit d1ad294) I tried to make a session fail closed. With ACS_ON_DECISION_FAILURE=deny on the Guardian:

• a session whose handshake had already completed was blocked when the Guardian went away (posture_source: negotiated in .acs/audit.jsonl);
• a session started while the Guardian was down proceeded, and rm -rf / was allowed (posture_source: default).

This matches §4.1 as I read it (startup posture is configured out of band, default proceed), and the fail-open is recorded in the audit log. Two questions:

1. Is a host-side setting to choose refuse in scope for the reference shim? None of the host variables I found in the Claude Code shim and host adapter (ACS_AUDIT_LOG, ACS_GUARDIAN_URL, ACS_HOOKMAP_PATH, ACS_SESSION_DIR, ACS_DEBUG) sets the startup posture.
2. conformance-claim-template.md asks for "Startup posture on handshake failure: proceed / refuse". Should the README note that the Guardian-side deny does not cover sessions that start while the Guardian is unreachable?

Reproduction: start the Guardian with ACS_ON_DECISION_FAILURE=deny; pipe one hook for session A through hosts/claude-code/acs-hook.ts; stop the Guardian; pipe rm -rf / for session A (denied by the negotiated posture, not by policy) and for a new session B (allowed).