@sponsio/sdk 0.1.0-alpha.3

package/contracts/capability/credentials.yaml

@@ -0,0 +1,188 @@
+# =============================================================================
+# sponsio/contracts/capability/credentials.yaml
+#
+# Capability pack — credential-shaped strings in file-write content.
+# Include when your agent exposes write / edit tools and you don't
+# want secrets to leak from the agent's working memory into committed
+# files, READMEs, or anywhere else that gets diff'd / pushed / shared.
+#
+# Real-world incidents this pack defends against:
+#
+#   - Cursor + ``.cursorignore`` bypass (Apr 2024 → Dec 2025): agent
+#     read ``.env`` (allowed by user) then included its content in
+#     prompts that were silently sent to AI providers.  Same pattern
+#     surfaces when a sub-agent is told "summarize the project setup"
+#     and writes the env values verbatim into a README.
+#   - Claude Code sub-agent leak pattern (recurring r/ClaudeAI):
+#     parent agent reads ``.env`` for setup verification, spawns a
+#     ``Task`` sub-agent with full context, sub-agent dutifully echoes
+#     ``STRIPE_SECRET_KEY=...`` into a generated file.  Then a final
+#     ``git commit && git push`` pushes secrets to a public repo.
+#   - Generic agent-in-IDE foot-guns: API keys ending up in commit
+#     messages, log lines, Slack messages composed by an agent.
+#
+# Threat model boundary: this pack catches credential SHAPES in tool
+# *arguments* — i.e. the content the agent is about to write.  It
+# does NOT catch:
+#   - Credentials reformatted (base64'd, split across lines, etc.)
+#   - Read tools (read of ``.env`` is allowed by default; the
+#     sensitive-path read denies live in ``_host.yaml`` for the
+#     cases that DO matter)
+#   - Token exfil via outbound HTTP that happens not to use
+#     ``Bash``/``Write`` (use ``capability/network`` for that —
+#     planned)
+#
+# Include via:
+#   include:
+#     - sponsio:capability/credentials
+#
+# Tool naming:
+#   The pack uses canonical ``write`` / ``edit`` / ``apply_patch``
+#   for the write surface.  Claude Code's ``_host.yaml`` adds
+#   ``write: Write`` / ``edit: Edit`` / ``apply_patch: MultiEdit``
+#   to its ``tool_rename`` block; OpenClaw's ``_host_openclaw.yaml``
+#   inherits canonical names directly.
+#
+# Source tag convention:
+#   library:tier1.credentials
+# =============================================================================
+
+version: "1"
+
+tools:
+  - name: write
+    description: "Write or overwrite a file (placeholder — replace with your tool's name)"
+    params: "path: str, content: str"
+  - name: edit
+    description: "In-place edit of an existing file"
+    params: "path: str, new_string: str"
+  - name: apply_patch
+    description: "Apply a unified diff to a file"
+    params: "path: str, diff: str"
+
+agents:
+  "*":
+    contracts:
+
+      # =================================================================
+      # § 1 — Block credential shapes in file-write CONTENT
+      # =================================================================
+      #
+      # The regex inventory targets the most common shapes that
+      # `git secrets`, gitleaks, trufflehog and friends recognise.
+      # Conservative on purpose: false positives here only block one
+      # write — the user can re-prompt with a redacted version.
+      # False negatives mean the secret ships, which is much worse.
+
+      - desc: "Block writes containing AWS / GCP / Azure / cloud creds"
+        E:
+          pattern: arg_blacklist
+          args:
+            - write
+            - content
+            - - "AKIA[A-Z0-9]{16}"                              # AWS access key
+              - "ASIA[A-Z0-9]{16}"                              # AWS temp creds
+              - "(?i)aws_secret_access_key\\s*=\\s*[A-Za-z0-9/+=]{40}"
+              - "AIza[A-Za-z0-9_-]{35}"                         # Google API key
+              - "ya29\\.[A-Za-z0-9_-]{20,}"                     # Google OAuth
+          source: "library:tier1.credentials"
+
+      - desc: "Block writes containing GitHub tokens"
+        E:
+          pattern: arg_blacklist
+          args:
+            - write
+            - content
+            - - "ghp_[A-Za-z0-9]{36,}"                          # personal access
+              - "ghu_[A-Za-z0-9]{36,}"                          # OAuth user
+              - "ghs_[A-Za-z0-9]{36,}"                          # server
+              - "gho_[A-Za-z0-9]{36,}"                          # OAuth app
+              - "github_pat_[A-Za-z0-9_]{82}"                   # fine-grained PAT
+          source: "library:tier1.credentials"
+
+      - desc: "Block writes containing payment-processor / SaaS API keys"
+        E:
+          pattern: arg_blacklist
+          args:
+            - write
+            - content
+            # Two key-prefix shapes co-exist in the wild:
+            #   underscore-style (Stripe):  sk_live_<base64ish>
+            #   dash-style (OpenAI / Anthropic): sk-proj-<base64-with-dashes>
+            # Both random suffixes are >= 20 chars in practice.
+            - - "sk_(live|test)_[A-Za-z0-9]{20,}"               # Stripe
+              - "sk-(live|test|proj|ant)-[A-Za-z0-9_-]{20,}"    # OpenAI / Anthropic
+              - "rk_(live|test)_[A-Za-z0-9]{20,}"               # Stripe restricted
+              - "xox[baprs]-[A-Za-z0-9-]{10,}"                  # Slack
+              - "SG\\.[A-Za-z0-9_-]{22}\\.[A-Za-z0-9_-]{43}"   # SendGrid
+              - "key-[a-f0-9]{32}"                              # Mailgun
+          source: "library:tier1.credentials"
+
+      - desc: "Block writes containing private keys / SSH material"
+        E:
+          pattern: arg_blacklist
+          args:
+            - write
+            - content
+            - - "-----BEGIN\\s+(RSA|OPENSSH|EC|DSA|PGP)\\s+PRIVATE KEY"
+              - "-----BEGIN\\s+ENCRYPTED\\s+PRIVATE KEY"
+          source: "library:tier1.credentials"
+
+      # =================================================================
+      # § 2 — Mirror rules for in-place edit (Claude Code's `Edit`)
+      # =================================================================
+      #
+      # Editing is the same threat surface as Write — sub-agents that
+      # leak secrets often do so by editing a README in place rather
+      # than creating a new file.  Same regex inventory; pinned to
+      # ``new_string`` (the canonical `edit` tool's payload field).
+
+      - desc: "Block edits containing AWS / GCP / Azure / cloud creds"
+        E:
+          pattern: arg_blacklist
+          args:
+            - edit
+            - new_string
+            - - "AKIA[A-Z0-9]{16}"
+              - "ASIA[A-Z0-9]{16}"
+              - "(?i)aws_secret_access_key\\s*=\\s*[A-Za-z0-9/+=]{40}"
+              - "AIza[A-Za-z0-9_-]{35}"
+              - "ya29\\.[A-Za-z0-9_-]{20,}"
+          source: "library:tier1.credentials"
+
+      - desc: "Block edits containing GitHub tokens"
+        E:
+          pattern: arg_blacklist
+          args:
+            - edit
+            - new_string
+            - - "ghp_[A-Za-z0-9]{36,}"
+              - "ghu_[A-Za-z0-9]{36,}"
+              - "ghs_[A-Za-z0-9]{36,}"
+              - "gho_[A-Za-z0-9]{36,}"
+              - "github_pat_[A-Za-z0-9_]{82}"
+          source: "library:tier1.credentials"
+
+      - desc: "Block edits containing payment-processor / SaaS API keys"
+        E:
+          pattern: arg_blacklist
+          args:
+            - edit
+            - new_string
+            - - "sk_(live|test)_[A-Za-z0-9]{20,}"
+              - "sk-(live|test|proj|ant)-[A-Za-z0-9_-]{20,}"
+              - "rk_(live|test)_[A-Za-z0-9]{20,}"
+              - "xox[baprs]-[A-Za-z0-9-]{10,}"
+              - "SG\\.[A-Za-z0-9_-]{22}\\.[A-Za-z0-9_-]{43}"
+              - "key-[a-f0-9]{32}"
+          source: "library:tier1.credentials"
+
+      - desc: "Block edits containing private keys / SSH material"
+        E:
+          pattern: arg_blacklist
+          args:
+            - edit
+            - new_string
+            - - "-----BEGIN\\s+(RSA|OPENSSH|EC|DSA|PGP)\\s+PRIVATE KEY"
+              - "-----BEGIN\\s+ENCRYPTED\\s+PRIVATE KEY"
+          source: "library:tier1.credentials"

package/contracts/capability/database.yaml

@@ -0,0 +1,141 @@
+# =============================================================================
+# sponsio/contracts/capability/database.yaml
+#
+# Capability pack — destructive database operations via shell.  Include
+# when your agent exposes a tool that runs arbitrary shell commands
+# (`exec`, `bash`, `Bash`, `run_command`, …) and the agent has database
+# credentials in its environment.
+#
+# Real-world incidents this pack defends against:
+#
+#   - Replit agent (Jul 2025): deleted live production DB during a code
+#     freeze, affecting 1,200+ companies.  The model executed
+#     ``psql -c "DROP DATABASE prod"`` after misinterpreting a
+#     freeze instruction.  Highest-profile data-loss incident from an
+#     LLM agent to date.
+#   - Anecdotal: agents running migration tools at the wrong scope —
+#     ``alembic downgrade base`` rolling back to an empty schema.
+#   - Anecdotal: agents using ``redis-cli FLUSHALL`` to "reset state"
+#     during debugging, wiping a shared dev cache.
+#
+# This pack is shell-only.  For per-MCP-server rules (e.g.
+# ``mcp__postgres__execute_sql.statement``), generate a per-plugin
+# library via ``sponsio plugin scan --introspect`` against that
+# server.
+#
+# Include via:
+#   include:
+#     - sponsio:capability/database
+#
+# Tool naming:
+#   The pack uses canonical ``exec``.  Rename if your agent's shell
+#   tool has a different name — Claude Code's ``Bash`` is auto-handled
+#   by the ``_host.yaml`` library's ``tool_rename:`` block.
+#
+# Source tag convention:
+#   library:tier1.database
+# =============================================================================
+
+version: "1"
+
+tools:
+  - name: exec
+    description: "Shell command execution (placeholder — replace with your tool's real name)"
+    params: "command: str"
+
+agents:
+  "*":
+    contracts:
+
+      # =================================================================
+      # § 1 — Destructive SQL via shell (psql / mysql / sqlite3 / ...)
+      # =================================================================
+
+      - desc: "Ban DROP DATABASE / DROP TABLE / DROP SCHEMA via shell"
+        E:
+          pattern: arg_blacklist
+          args:
+            - exec
+            - command
+            # Word boundaries on either side to avoid matching prose
+            # like ``"how to drop a table"``; case-insensitive because
+            # SQL is conventionally uppercase but agents often emit
+            # lowercase.
+            - - "(?i)\\bdrop\\s+(database|table|schema|view|index)\\b"
+          source: "library:tier1.database"
+
+      - desc: "Ban TRUNCATE TABLE via shell (whole-table wipe)"
+        E:
+          pattern: arg_blacklist
+          args:
+            - exec
+            - command
+            # Require the literal "TABLE" keyword to avoid colliding
+            # with the unrelated POSIX ``truncate`` command (which
+            # extends/shrinks files via ``truncate -s N file``).
+            - - "(?i)\\btruncate\\s+table\\s+\\w+"
+          source: "library:tier1.database"
+
+      - desc: "Ban unbounded DELETE FROM (no WHERE clause)"
+        E:
+          pattern: arg_blacklist
+          args:
+            - exec
+            - command
+            # ``DELETE FROM users;`` matches; ``DELETE FROM users
+            # WHERE id=1;`` does not, because the table name isn't
+            # immediately followed by a terminator.  Catches the
+            # canonical "wipe a whole table" foot-gun without false-
+            # positing real DELETE-by-key statements.
+            - - "(?i)\\bdelete\\s+from\\s+\\w+\\s*;"
+          source: "library:tier1.database"
+
+      # =================================================================
+      # § 2 — Destructive DB CLI tools
+      # =================================================================
+
+      - desc: "Ban dropdb / mysqladmin drop / redis FLUSHALL / FLUSHDB"
+        E:
+          pattern: arg_blacklist
+          args:
+            - exec
+            - command
+            - - "(?i)\\bdropdb\\b"
+              - "(?i)\\bmysqladmin\\b.{0,80}\\bdrop\\b"
+              - "(?i)\\bredis-cli\\b.{0,80}\\b(flushall|flushdb)\\b"
+              - "(?i)\\bmongo\\s.{0,80}\\bdropDatabase\\s*\\("
+          source: "library:tier1.database"
+
+      - desc: "Ban migration rollback to empty schema"
+        E:
+          pattern: arg_blacklist
+          args:
+            - exec
+            - command
+            # ``downgrade base`` rolls schema back to the very
+            # beginning of migration history — irreversible without
+            # backups.  Single-step downgrades (``-1``) stay allowed.
+            - - "(?i)\\balembic\\s+downgrade\\s+base\\b"
+              - "(?i)\\bflask\\s+db\\s+downgrade\\s+base\\b"
+              - "(?i)\\bdjango-admin\\s+flush\\b"
+          source: "library:tier1.database"
+
+      # =================================================================
+      # § 3 — Deletion of database data directories
+      # =================================================================
+
+      - desc: "Ban deletion of database data directories"
+        E:
+          pattern: arg_blacklist
+          args:
+            - exec
+            - command
+            # Common data-dir locations across distros; covers the
+            # "rm -rf /var/lib/postgresql/data" foot-gun that the
+            # capability/shell pack's ``rm -rf /`` rule misses
+            # because the path doesn't end at the root delimiter.
+            - - "rm\\s+-[rRf]+\\s+/var/lib/(postgresql|mysql|mongodb|redis|elasticsearch|cassandra|couchdb)\\b"
+              - "rm\\s+-[rRf]+\\s+/var/data/(postgresql|mysql|mongodb)\\b"
+              - "rm\\s+-[rRf]+\\s+/data/db\\b"
+              - "rm\\s+-[rRf]+\\s+/opt/(postgresql|mysql|mongodb)\\b"
+          source: "library:tier1.database"

package/contracts/capability/filesystem-strict.yaml

@@ -0,0 +1,101 @@
+# =============================================================================
+# sponsio/contracts/capability/filesystem-strict.yaml
+#
+# Capability pack — strict workspace scoping for filesystem tools.  Add
+# alongside ``sponsio:capability/filesystem`` when you want every
+# read/write/edit/apply_patch confined to an explicit workspace
+# prefix.
+#
+# Why this pack is opt-in (not part of the base ``capability/filesystem``):
+#
+#   - These rules require an absolute ``<workspace>/`` placeholder
+#     resolved at load time.  Configs without a ``workspace:`` field
+#     can't satisfy them and produce silent "no path matched"
+#     evaluations on every call.
+#   - Recorded-trajectory demos and replay test fixtures often use
+#     RELATIVE paths (``src/components/UserList.tsx``).  ``scope_limit``
+#     interprets these as outside the workspace, which generates
+#     "WOULD-BLOCK" noise on every benign read in observe mode and
+#     wedges the agent at step 1 in enforce mode.
+#   - For agents whose actual filesystem footprint is broad
+#     (CI/CD pipelines, system-administration assistants, monorepo
+#     refactor tools), workspace scope is wrong-by-design — they
+#     legitimately operate across many directories.
+#
+# In short: the sensitive-path blacklists in the base pack are the
+# universal "every agent needs this" rules.  Workspace scoping is
+# the opinionated "I know my agent stays in one tree" addition.
+# Include this pack when (a) your agent does stay in one tree AND
+# (b) your traces use absolute paths under that tree.
+#
+# Include via:
+#   include:
+#     - sponsio:capability/filesystem        # base — credential blacklists
+#     - sponsio:capability/filesystem-strict # this pack — workspace scope
+#
+# Source tag convention:
+#   library:tier1.filesystem-strict
+# =============================================================================
+
+version: "1"
+
+agents:
+  "*":
+    contracts:
+
+      # =================================================================
+      # Workspace scoping — writes / edits / apply_patch.
+      #
+      # ``<workspace>/`` is a literal placeholder.  The integration
+      # layer (or a hand-edited config) substitutes the actual root
+      # before load.  Without resolution, scope_limit on relative
+      # paths is a silent always-pass.
+      # =================================================================
+
+      - desc: "Writes restricted to workspace"
+        E:
+          pattern: scope_limit
+          args:
+            - write
+            - ["<workspace>/"]
+          source: "library:tier1.filesystem-strict"
+
+      - desc: "In-place edits restricted to workspace"
+        E:
+          pattern: scope_limit
+          args:
+            - edit
+            - ["<workspace>/"]
+          source: "library:tier1.filesystem-strict"
+
+      - desc: "Patch application restricted to workspace"
+        E:
+          pattern: scope_limit
+          args:
+            - apply_patch
+            - ["<workspace>/"]
+          source: "library:tier1.filesystem-strict"
+
+      # Read scope is broader than write scope: agents legitimately
+      # inspect system state (/etc/hosts, /var/log/*), link headers
+      # (/usr/include/), and read stdlib for grounding.  The
+      # sensitive-path blacklist in the base ``filesystem`` pack
+      # keeps secrets hard-denied under any of these roots.
+      - desc: "Reads restricted to workspace, /tmp, and read-only system paths"
+        E:
+          pattern: scope_limit
+          args:
+            - read
+            - - "<workspace>/"
+              - "/tmp/"
+              - "/etc/"
+              - "/var/log/"
+              - "/usr/include/"
+              - "/usr/local/include/"
+              - "/usr/lib/"
+              - "/usr/local/lib/"
+              - "/usr/share/"
+              - "/opt/"
+              - "/proc/"
+              - "/sys/"
+          source: "library:tier1.filesystem-strict"

package/contracts/capability/filesystem.yaml

@@ -0,0 +1,239 @@
+# =============================================================================
+# sponsio/contracts/capability/filesystem.yaml
+#
+# Capability pack — filesystem access.  Include when your agent exposes
+# read / write / edit / apply_patch tools against the host filesystem.
+#
+# Real-world incidents this pack defends against:
+#
+#   - OpenClaw "weather-skill" incident: skill exfiltrated
+#     ~/.clawdbot/.env, leaking paid AI API keys.
+#   - OpenClaw AMOS payload: stole SSH keys, keychain, browser creds.
+#   - Cursor forum (Apr 2024 → Dec 2025): `.cursorignore` not honored in
+#     Auto Context; .env content silently sent to AI server.
+#   - Claude Code Issue #10077: recursive delete wiped /home files.
+#   - OpenClaw agent editing its own AGENTS.md / SOUL.md bootstrap files
+#     → persistent-prompt-injection at bootstrap time.
+#
+# Tool name conventions in this file:
+#   - read, write, edit, apply_patch  (OpenClaw / Claude Code default)
+# Rename to match your agent (e.g. Cursor uses edit_file/read_file).
+#
+# Include via:
+#   include:
+#     - sponsio:capability/filesystem
+#
+# Source tag convention:
+#   library:tier1.filesystem
+# =============================================================================
+
+version: "1"
+
+tools:
+  - name: read
+    description: "Read file contents"
+    params: "path: str"
+  - name: write
+    description: "Create or overwrite a file"
+    params: "path: str, content: str"
+  - name: edit
+    description: "In-place edit of an existing file"
+    params: "path: str, patch: str"
+  - name: apply_patch
+    description: "Apply a unified diff"
+    params: "path: str, diff: str"
+
+agents:
+  "*":
+    contracts:
+
+      # =================================================================
+      # § 1 — Sensitive-path hard denies
+      #
+      # These paths never have a legitimate reason to appear in an agent
+      # trace.  If the agent needs one of them (e.g. a git credential
+      # rotator that legitimately reads .aws/credentials), the including
+      # config overrides this section.
+      # =================================================================
+
+      # The .env regex deliberately *excludes* the conventional
+      # non-secret variants (.env.example / .env.sample / .env.template
+      # / .env.dist) — those files exist to be committed to git and
+      # serve as documentation of expected variables.  Blocking them
+      # would generate noisy false positives on day 1, which is the
+      # fastest way to get a security pack disabled.  All other
+      # `.env` and `.env.<suffix>` paths are still blocked.
+      #
+      # `crontab` is end-anchored to avoid matching paths like
+      # `/projects/crontab-tests/` or `mycrontab.txt`.
+      - desc: "Deny reads of SSH keys, AWS credentials, browser keychains, dotenv secrets"
+        E:
+          pattern: arg_blacklist
+          args:
+            - read
+            - path
+            - - "(^|/)\\.ssh/"
+              - "(^|/)\\.aws/credentials"
+              - "(^|/)\\.aws/config"
+              - "(^|/)\\.env(\\.(?!example$|sample$|template$|dist$)[\\w.-]+)?$"
+              - "(^|/)\\.netrc"
+              - "(^|/)\\.pgpass"
+              - "(^|/)\\.kube/config"
+              - "(^|/)\\.docker/config\\.json"
+              - "(^|/)Library/Keychains"
+              - "(^|/)\\.gnupg/"
+              - "(^|/)id_rsa($|\\.)"
+              - "(^|/)id_ed25519($|\\.)"
+              # /etc/ is permitted for reads in §2 (hosts, resolv.conf,
+              # os-release are routinely needed for diagnostics) but
+              # these specific entries under /etc hold credentials or
+              # escalation config and must stay hard-denied:
+              - "^/etc/shadow($|/)"
+              - "^/etc/sudoers($|\\.d/|$)"
+              - "^/etc/ssh/ssh_host_"
+              - "^/etc/ssl/private/"
+              - "^/etc/krb5\\.keytab$"
+          source: "library:tier1.filesystem"
+
+      - desc: "Deny writes / edits into sensitive paths (prevent persistence or cred overwrite)"
+        E:
+          pattern: arg_blacklist
+          args:
+            - write
+            - path
+            - - "(^|/)\\.ssh/"
+              - "(^|/)\\.aws/"
+              - "(^|/)\\.bashrc$"
+              - "(^|/)\\.zshrc$"
+              - "(^|/)\\.profile$"
+              - "(^|/)crontab$"
+              - "(^|/)LaunchAgents/"
+              - "(^|/)LaunchDaemons/"
+              - "/etc/"
+              - "/usr/local/bin/"
+          source: "library:tier1.filesystem"
+
+      - desc: "Same denial applies to in-place edits"
+        E:
+          pattern: arg_blacklist
+          args:
+            - edit
+            - path
+            - - "(^|/)\\.ssh/"
+              - "(^|/)\\.aws/"
+              - "(^|/)\\.bashrc$"
+              - "(^|/)\\.zshrc$"
+              - "(^|/)\\.profile$"
+              - "(^|/)crontab$"
+              - "(^|/)LaunchAgents/"
+              - "(^|/)LaunchDaemons/"
+              - "/etc/"
+          source: "library:tier1.filesystem"
+
+      - desc: "And to unified-diff patches"
+        E:
+          pattern: arg_blacklist
+          args:
+            - apply_patch
+            - path
+            - - "(^|/)\\.ssh/"
+              - "(^|/)\\.aws/"
+              - "/etc/"
+          source: "library:tier1.filesystem"
+
+      # =================================================================
+      # § 2 — Workspace scoping (moved to filesystem-strict)
+      #
+      # The four ``scope_limit`` rules that used to live here
+      # (Writes / Edits / Patch / Reads restricted to workspace +
+      # system-read paths) are now in
+      # ``sponsio:capability/filesystem-strict``.  Reason: they
+      # require an absolute workspace prefix that many real agents
+      # don't have, and they false-positive on relative-path traces
+      # (e.g. ``src/components/UserList.tsx``).
+      #
+      # Add the strict pack alongside this one when you actually
+      # want workspace bounding:
+      #
+      #     include:
+      #       - sponsio:capability/filesystem
+      #       - sponsio:capability/filesystem-strict
+      # =================================================================
+
+      # =================================================================
+      # § 3 — Operational hygiene
+      # =================================================================
+
+      - desc: "Must read a file before editing it (no blind patches)"
+        E:
+          pattern: must_precede
+          args: [read, edit]
+          source: "library:tier1.filesystem"
+
+      - desc: "Must read a file before apply_patch (no blind diffs)"
+        E:
+          pattern: must_precede
+          args: [read, apply_patch]
+          source: "library:tier1.filesystem"
+
+      # =================================================================
+      # § 4 — Self-modification guardrails
+      #
+      # Agents with a persistent workspace often have "bootstrap" files
+      # whose contents get injected into the system prompt every
+      # session (OpenClaw: AGENTS.md, SOUL.md, IDENTITY.md, USER.md;
+      # Claude Code: CLAUDE.md; Cursor: .cursorrules).  The agent
+      # editing these is persistent prompt injection — an attacker who
+      # compromises one session can seed instructions that fire every
+      # future session.
+      #
+      # We gate self-modification behind a confirm_reconfirmed marker.
+      # =================================================================
+
+      - desc: "Editing bootstrap / system-prompt files requires human confirmation"
+        E:
+          ltl: 'G(called_with(edit, "(AGENTS|SOUL|IDENTITY|USER|CLAUDE|\\.cursorrules)\\.md?") -> count(confirm_reconfirmed) >= count_with(edit, "(AGENTS|SOUL|IDENTITY|USER|CLAUDE|\\.cursorrules)\\.md?"))'
+          source: "library:tier1.filesystem"
+
+      - desc: "apply_patch against bootstrap files requires confirmation"
+        E:
+          ltl: 'G(called_with(apply_patch, "(AGENTS|SOUL|IDENTITY|USER|CLAUDE|\\.cursorrules)\\.md?") -> count(confirm_reconfirmed) >= count_with(apply_patch, "(AGENTS|SOUL|IDENTITY|USER|CLAUDE|\\.cursorrules)\\.md?"))'
+          source: "library:tier1.filesystem"
+
+      # =================================================================
+      # § 5 — Data-leak prevention
+      #
+      # Generic no-data-leak from read → external sinks.  The including
+      # config must name the external sinks (send_message, http_post,
+      # etc.) — we can't enumerate them here since sink inventory is
+      # agent-specific.  The `send_message` form below is the most
+      # common instance and OpenClaw-derived; it's harmless to keep
+      # here because if the agent doesn't have send_message the formula
+      # is vacuously satisfied.
+      # =================================================================
+
+      - desc: "Data read from filesystem must not flow to outbound messages"
+        E:
+          pattern: no_data_leak
+          args: [read, send_message]
+          source: "library:tier1.filesystem"
+
+# -----------------------------------------------------------------------------
+# Integration requirements
+# -----------------------------------------------------------------------------
+#
+# - `<workspace>/` is a literal prefix — resolve it at include time or
+#   pre-process the YAML with a sed substitution before handing to
+#   config.load().  A cleaner fix is a resolver hook in the include
+#   mechanism; tracked as future work.
+#
+# - `confirm_reconfirmed` must be emitted by the integration on human
+#   approval.  Same marker convention as capability/shell.yaml.
+#
+# - If your agent's filesystem tools aren't named read/write/edit/
+#   apply_patch, rename them at include time or at config-load.
+#
+# - The sensitive-path blacklists are conservative.  Agents with a
+#   legitimate reason to touch one of those paths (e.g. an SSH key
+#   rotator, a cron editor) should narrow the blacklist in their own
+#   config rather than removing this file from the include chain.