Adaptive Trust-Oriented Runtime Security for AI-Generated Shell Scripts

Large language models now write shell scripts that reach production with little review, and a script that lints cleanly can still wipe a disk, open a reverse shell, or ship credentials off the host. We present ACTE (Adaptive Context-aware Trust Execution), a pre-execution trust gate that scores a script through a transparent thirteen-feature logistic risk model over semantic, execution-context, and threat-signature evidence, and compiles the verdict into an enforcement policy. We lead with the honest generalisation numbers. On a reproducible corpus of 420 labelled scripts, five-fold cross-validation gives F1 = 0.887 ± 0.025 at the default operating point; a stricter leave-template-out protocol that forbids any template from spanning train and test yields F1 = 0.823 ± 0.101, and cluster (block) bootstrap intervals that respect the template structure are about twice as wide as naive ones (F1 in [0.79, 0.99]). Recall on the genuinely hard malicious class is 0.75, not the 0.855 aggregate, and the false-positive rate at the default threshold is approximately 0.10, not the 0.011 of a single tuned split. Trained only on synthetic data and frozen, ACTE clears every safe script in an independent 41-script real holdout (0 of 20 false positives, Wilson 95% CI [0, 0.16]) but misses evasive payloads its signatures do not cover (recall 0.81). Against strong learned baselines - TF-IDF logistic regression, a linear SVM, a random forest, a gradient-boosted tree on the same features, and a feature+TF-IDF union - ACTE is competitive, not dominant, on raw F1 (a GBDT on its own features matches it; the union reaches 0.99 on this near-separable corpus). Its value is elsewhere: the lowest false-positive rate, an auditable decision, and a really-enforced policy - on Linux we compile a content-derived syscall deny-set into an actual seccomp-BPF filter and show the kernel enforce it end-to-end. Under adaptive evasion the two model families show complementary blind spots: additive benign camouflage collapses the lexical baseline but not ACTE, whereas behaviour-preserving semantic substitution evades ACTE (recall 0.86 to 0.58) but not the lexical baseline, so neither is robustly superior. We are candid about the limits: the training corpus is synthetic and author-generated, the score is only moderately calibrated (ECE 0.076, 0.055 after isotonic recalibration), the online-learning loop shows no demonstrated benefit and is poisonable with a handful of mislabelled updates, and there is no independent human labelling. We position ACTE as a reproducible, honestly-evaluated framework - interpretable content-to-policy trust gating with real enforcement - rather than a finished detector.