The LLM doesn't have direct access to the process env unless the harness forwards it (and it doesn't)