The likely failure is a contract mismatch around process invocation, argv construction, shell-vs-direct execution, quoting, escaping, spaces, Unicode, environment expansion, and platform command differences. I would reconstruct one canonical invariant, identify the layer violating it, apply the smallest bounded repair, and add deterministic boundary/failure/control tests. Existing policy would be preserved. If repository files are available I can map the repair to exact paths; otherwise I would provide concrete pseudocode and a verification plan without claiming execution.