diff --git a/.jules/sentinel.md b/.jules/sentinel.md
new file mode 100644
index 000000000..2f27547d4
--- /dev/null
+++ b/.jules/sentinel.md
@@ -0,0 +1,4 @@
+## 2026-08-04 - False Positive Subprocess Launch Findings
+**Vulnerability:** Found uses of `exec.Command` and `exec.CommandContext` with variable inputs (gosec G204) that were false positives or necessary design choices, rather than security risks, such as invoking `git` locally with args array.
+**Learning:** We need to be careful when assessing G204 in gosec as it flags any subprocess launched with a variable without verifying the provenance. When the invocation originates from trusted local configuration or literal constants, we should suppress the warning via `/* #nosec G204 -- [reason] */` instead of removing the capability which limits valid shell pipes or expanding variables.
+**Prevention:** Apply `/* #nosec G204 -- reason */` selectively to known safe subprocess invocations where arguments are controlled or trusted.
diff --git a/internal/config/command.go b/internal/config/command.go
index 0113135a5..0c9d36cf1 100644
--- a/internal/config/command.go
+++ b/internal/config/command.go
@@ -197,8 +197,10 @@ func shellCommand(command string) *exec.Cmd {
 		if strings.HasPrefix(strings.TrimSpace(command), `"`) {
 			command = "call " + command
 		}
+		/* #nosec G204 -- command originates from trusted local configuration; shell invocation is intended for pipe/env support */
 		return exec.Command("cmd", "/C", command)
 	}
+	/* #nosec G204 -- command originates from trusted local configuration; shell invocation is intended for pipe/env support */
 	return exec.Command("sh", "-c", command)
 }