@sponsio/sdk 0.1.0-alpha.3 → 0.2.0-alpha.10

package/contracts/capability/host-config-integrity.yaml

@@ -0,0 +1,318 @@
+# =============================================================================
+# sponsio/contracts/capability/host-config-integrity.yaml
+#
+# Capability pack — IDE host config integrity protection.
+# Include in your per-host bucket (``_host_cursor`` /
+# ``_host_claude_code`` / ``_host_codex`` / ``_host_windsurf``)
+# so the agent under guard cannot disable Sponsio by rewriting
+# the IDE's hook registration files.
+#
+# Threat model:
+#
+# Sponsio's enforcement on IDE coding agents is mediated through
+# the host IDE's hook system: Cursor's ``.cursor/hooks.json``,
+# Claude Code's ``~/.claude/settings.json`` /
+# ``.claude/settings.local.json``, the per-project ``.claude/hooks/``
+# directory, etc. These files declare WHICH commands the IDE invokes
+# at which hook events. If the agent can rewrite them, it doesn't
+# need to defeat any individual rule — it just removes the
+# ``preToolUse`` entry that calls Sponsio at all, and on the next IDE
+# restart Sponsio is silently absent. Every rule in
+# ``capability/self-modify`` and ``incident/subagent-escape`` keeps
+# working perfectly, against an enforcer that no longer exists.
+# This is sponsio:capability/self-modify's blind spot — that pack
+# protects the rule files; this pack protects the wiring that
+# routes calls to the rule files in the first place.
+#
+# Concrete attack shapes observed (or trivially derivable from §1
+# of self-modify.yaml's threat model):
+#
+#   1. ``Write .cursor/hooks.json '{"version":1,"hooks":{}}'``
+#      — wipe all hook entries; next Cursor restart, no enforcement.
+#   2. ``Edit .cursor/hooks.json``: change ``"failClosed": true``
+#      to ``"failClosed": false`` — Sponsio is still wired in but
+#      any spawn / parse / runtime error fails open.
+#   3. ``Write merge_hooks.py`` whose content opens hooks.json in
+#      'w' mode (the §4 self-modify bypass shape, instantiated
+#      against hook config instead of plugin yaml).
+#   4. ``python -c "open('.cursor/hooks.json','w').write('...')"``
+#      — the §5 self-modify interpreter-bypass shape against hook
+#      config.
+#   5. ``echo '{}' > .cursor/hooks.json`` / ``sed -i 's/true/false/'``
+#      — bash redirect / mutator forms that the self-modify pack
+#      doesn't currently match because its regex anchors on
+#      ``.sponsio/plugins/...`` paths only.
+#   6. ``truncate -s0 ~/.claude/settings.json`` / ``ln -sf /dev/null
+#      ~/.claude/settings.json`` / ``chmod 000 ~/.claude/settings.json``
+#      / ``rm -rf ~/.claude`` — no write at all, but the IDE reads an
+#      empty, foreign, or unreadable file and loads no hooks.
+#
+# What this pack denies:
+#
+#   - Edit / Write / MultiEdit on the IDE hook registration files.
+#   - Bash redirect / sed / awk / tee that targets the same files.
+#   - Script *creation* whose content references a hook config path
+#     AND uses an open-for-write idiom (mirror of self-modify §4).
+#   - Interpreter invocation whose command line carries a hook
+#     config path (mirror of self-modify §5).
+#
+# What this pack does NOT deny:
+#
+#   - ``sponsio host install`` and ``sponsio host uninstall``
+#     write hooks.json via Python subprocess from the Sponsio
+#     binary itself, not through the agent's Edit / Write tool
+#     surface — the legitimate install path is unaffected.
+#   - The user hand-editing hooks.json in their text editor
+#     similarly does not pass through the IDE's Edit / Write
+#     tool; this pack is silent on that surface.
+#   - Reads of hook config files are not denied. The file format
+#     is documented public knowledge; recon defense here would
+#     give negligible benefit at significant false-positive cost
+#     (legitimate "what hooks are registered?" debug queries).
+#     The subagent-escape pack covers the recon angle for
+#     sub-agents specifically.
+#
+# Pair with: ``sponsio:capability/self-modify`` (rule-file integrity)
+# and ``sponsio:incident/subagent-escape`` (sub-agent containment).
+# Together the three packs form the control-plane defense surface
+# documented in ``agent_docs/control_plane_threat_model.md``.
+#
+# Include via:
+#   include:
+#     - sponsio:capability/host-config-integrity
+#
+# Source tag convention:
+#   library:tier1.host-config-integrity
+# =============================================================================
+
+version: "1"
+
+agents:
+  "*":
+    contracts:
+
+      # =================================================================
+      # § 1 — No agent-mediated Edit of IDE hook config
+      # =================================================================
+      #
+      # Path set covers the wiring files for every host Sponsio
+      # currently supports. Add new hosts here as ``sponsio host
+      # install`` learns to register them.
+      #
+      # Anchor pattern note:
+      #
+      #   The ``(^|/)`` anchor at the start of each alternative
+      #   matches both absolute paths (``/Users/x/.cursor/hooks.json``)
+      #   and project-relative paths (``.cursor/hooks.json``). The
+      #   ``$`` anchors at the end pin the match to exact filenames,
+      #   so a file named ``hooks.json.bak`` or ``settings.json.tmpl``
+      #   stays editable.
+      #
+      # The Cursor MCP config (``.cursor/mcp.json``) is included
+      # because it's the file that declares Sponsio's MCP server
+      # to Cursor — same disable-by-rewrite attack shape, different
+      # file. Same for Claude Code's ``hooks/`` directory.
+
+      - desc: "Host agent must not edit IDE hook / MCP wiring files — disabling Sponsio's call site is privilege escalation"
+        G:
+          pattern: arg_blacklist
+          args:
+            - Edit
+            - file_path
+            - - "(^|/)\\.cursor/hooks\\.json$"
+              - "(^|/)\\.cursor/mcp\\.json$"
+              - "(^|/)\\.claude/settings\\.json$"
+              - "(^|/)\\.claude/settings\\.local\\.json$"
+              - "(^|/)\\.claude/hooks/[^/]+\\.json$"
+              - "(^|/)\\.codex/hooks\\.json$"
+              - "(^|/)\\.windsurf/hooks\\.json$"
+          source: "library:tier1.host-config-integrity"
+
+      # =================================================================
+      # § 2 — No agent-mediated Write of IDE hook config
+      # =================================================================
+      #
+      # ``Write`` overwrites the whole file — closes the
+      # "delete-and-recreate-empty" workaround a pure ``Edit`` block
+      # would leave open.
+
+      - desc: "Host agent must not overwrite IDE hook / MCP wiring files — use `sponsio host install` / hand-edit"
+        G:
+          pattern: arg_blacklist
+          args:
+            - Write
+            - file_path
+            - - "(^|/)\\.cursor/hooks\\.json$"
+              - "(^|/)\\.cursor/mcp\\.json$"
+              - "(^|/)\\.claude/settings\\.json$"
+              - "(^|/)\\.claude/settings\\.local\\.json$"
+              - "(^|/)\\.claude/hooks/[^/]+\\.json$"
+              - "(^|/)\\.codex/hooks\\.json$"
+              - "(^|/)\\.windsurf/hooks\\.json$"
+          source: "library:tier1.host-config-integrity"
+
+      # =================================================================
+      # § 3 — No agent-mediated MultiEdit of IDE hook config
+      # =================================================================
+
+      - desc: "Host agent must not multi-edit IDE hook / MCP wiring files — use `sponsio host install` / hand-edit"
+        G:
+          pattern: arg_blacklist
+          args:
+            - MultiEdit
+            - file_path
+            - - "(^|/)\\.cursor/hooks\\.json$"
+              - "(^|/)\\.cursor/mcp\\.json$"
+              - "(^|/)\\.claude/settings\\.json$"
+              - "(^|/)\\.claude/settings\\.local\\.json$"
+              - "(^|/)\\.claude/hooks/[^/]+\\.json$"
+              - "(^|/)\\.codex/hooks\\.json$"
+              - "(^|/)\\.windsurf/hooks\\.json$"
+          source: "library:tier1.host-config-integrity"
+
+      # =================================================================
+      # § 4 — No script creation that mutates IDE hook config
+      #       (mirror of self-modify §4, against hook paths)
+      # =================================================================
+      #
+      # The same lookahead-conjunction shape as self-modify §4: deny
+      # only if the content carries BOTH a hook-config path AND a
+      # write-shape idiom. Pure docs that mention the path stay
+      # editable — the rule is narrow on purpose.
+
+      - desc: "Host agent must not write a script that mutates IDE hook / MCP wiring files"
+        G:
+          pattern: arg_blacklist
+          args:
+            - Write
+            - content
+            - - "(?s)(?=.*\\.cursor/(hooks|mcp)\\.json|\\.claude/(settings(\\.local)?\\.json|hooks/)|\\.codex/hooks\\.json|\\.windsurf/hooks\\.json).*(\\.write_text\\s*\\(|\\.write_bytes\\s*\\(|\\bf\\.write\\s*\\(|\\bopen\\s*\\([^)]*['\\\"][aw][\\+bxt]*['\\\"]\\s*\\)|\\bfs\\.(writeFileSync|appendFileSync|createWriteStream|writeFile)\\s*\\(|\\bFile\\.(open|write)\\s*\\(|\\b(IO|File)\\.write\\b)"
+          source: "library:tier1.host-config-integrity"
+
+      - desc: "Host agent must not edit a script that mutates IDE hook / MCP wiring files"
+        G:
+          pattern: arg_blacklist
+          args:
+            - Edit
+            - new_string
+            - - "(?s)(?=.*\\.cursor/(hooks|mcp)\\.json|\\.claude/(settings(\\.local)?\\.json|hooks/)|\\.codex/hooks\\.json|\\.windsurf/hooks\\.json).*(\\.write_text\\s*\\(|\\.write_bytes\\s*\\(|\\bf\\.write\\s*\\(|\\bopen\\s*\\([^)]*['\\\"][aw][\\+bxt]*['\\\"]\\s*\\)|\\bfs\\.(writeFileSync|appendFileSync|createWriteStream|writeFile)\\s*\\(|\\bFile\\.(open|write)\\s*\\(|\\b(IO|File)\\.write\\b)"
+          source: "library:tier1.host-config-integrity"
+
+      # =================================================================
+      # § 5 — No interpreter invocation targeting IDE hook config
+      #       (mirror of self-modify §5, against hook paths)
+      # =================================================================
+      #
+      # Catches both inline forms (``python -c "...hooks.json..."``)
+      # and path-as-argument forms (``python merge.py
+      # .cursor/hooks.json``). The ``[^|\n]*`` between the
+      # interpreter token and the path token excludes cross-pipeline
+      # matches, same idiom as self-modify §5.
+
+      - desc: "Host agent must not run an interpreter against IDE hook / MCP wiring files"
+        G:
+          pattern: arg_blacklist
+          args:
+            - Bash
+            - command
+            - - "\\b(python|python2|python3|node|deno|bun|ruby|perl|php|lua|tclsh|R|Rscript)\\b[^|\\n]*(\\.cursor/(hooks|mcp)\\.json|\\.claude/(settings(\\.local)?\\.json|hooks/)|\\.codex/hooks\\.json|\\.windsurf/hooks\\.json)"
+          source: "library:tier1.host-config-integrity"
+
+      # =================================================================
+      # § 6 — No bash redirect / mutator targeting IDE hook config
+      # =================================================================
+      #
+      # Catches the cheap shell shapes that don't go through any
+      # interpreter: ``echo '{}' > hooks.json``, ``cat /dev/null >
+      # settings.json``, ``: > hooks.json``, ``sed -i 's/true/false/'
+      # hooks.json``, ``tee hooks.json``, ``cp empty.json
+      # hooks.json``, ``mv x hooks.json``, ``rm hooks.json``,
+      # ``truncate -s0``, ``ln -sf /dev/null``, ``chmod 000``.
+      #
+      # The pattern is "a mutator verb, then anything up to the next
+      # pipe / separator, then a hook-config path on the same command
+      # line". The gap between verb and path is what ``~/``, ``$HOME/``,
+      # ``"${HOME}/``, and an absolute prefix sit in: an earlier version
+      # required the path to follow the redirect operator immediately,
+      # so ``> .claude/settings.json`` was denied and ``> ~/.claude/
+      # settings.json`` was not (reported by kta1kri, 2026-10).
+      # ``truncate``, ``ln``, ``chmod``, ``chown`` and ``chattr`` are
+      # mutators too: an emptied, replaced, or unreadable settings file
+      # removes the hook exactly as an edited one does.
+      #
+      # Read-only patterns (``cat hooks.json``, ``jq . hooks.json``,
+      # ``grep ... hooks.json``, ``jq . settings.json > /tmp/backup``)
+      # are NOT matched — they carry no mutator verb in front of the
+      # path, and a redirect to a different file stops at that file.
+      # ``cp`` with the file as the *source* does match; a backup is
+      # the price of catching ``cp empty.json settings.json``.
+      #
+      # Edge case: ``python ... > hooks.json`` is already caught
+      # by §5 via the interpreter alternation. No double-deny harm
+      # since this is the deny side of the contract anyway.
+
+      - desc: "Host agent must not redirect / sed / tee / mv / rm / truncate / ln / chmod an IDE hook / MCP wiring file"
+        G:
+          pattern: arg_blacklist
+          args:
+            - Bash
+            - command
+            - - ">{1,2}\\|?\\s*[^|&;<>\\n]*(\\.cursor/(hooks|mcp)\\.json|\\.claude/(settings(\\.local)?\\.json|hooks/[^\\s|]+)|\\.codex/hooks\\.json|\\.windsurf/hooks\\.json)"
+              - "\\b(tee|cp|mv|rm|install|truncate|ln|chmod|chown|chattr|shred|unlink|rsync|dd|sponge|patch|ed|ex|vi|vim|nvim)\\b[^|&;\\n]*(\\.cursor/(hooks|mcp)\\.json|\\.claude/(settings(\\.local)?\\.json|hooks/[^\\s|]+)|\\.codex/hooks\\.json|\\.windsurf/hooks\\.json)"
+              - "\\bsed\\b[^|&;\\n]*\\s-[a-zA-Z]*i[^|&;\\n]*(\\.cursor/(hooks|mcp)\\.json|\\.claude/(settings(\\.local)?\\.json|hooks/[^\\s|]+)|\\.codex/hooks\\.json|\\.windsurf/hooks\\.json)"
+              - "\\bawk\\b[^|&;\\n]*\\s-i[^|&;\\n]*(\\.cursor/(hooks|mcp)\\.json|\\.claude/(settings(\\.local)?\\.json|hooks/[^\\s|]+)|\\.codex/hooks\\.json|\\.windsurf/hooks\\.json)"
+          source: "library:tier1.host-config-integrity"
+
+      # The rules above name the wiring FILE. Removing, moving, or making
+      # unreadable the directory that holds it (``rm -rf ~/.claude``,
+      # ``chmod 000 ~/.claude``, ``mv .cursor /tmp``) takes the hook
+      # registration with it. The lookahead stops at the directory name
+      # so ``~/.claude-backup`` and ``.claude/commands/x.md`` stay open.
+      - desc: "Host agent must not remove, move, or lock the IDE config directory that holds the hook wiring"
+        G:
+          pattern: arg_blacklist
+          args:
+            - Bash
+            - command
+            - - "\\b(rm|rmdir|mv|chmod|chown|chattr|ln)\\b[^|&;\\n]*(\\.claude|\\.cursor|\\.codex|\\.windsurf)/?(?![\\w./-])"
+          source: "library:tier1.host-config-integrity"
+
+# -----------------------------------------------------------------------------
+# Integration requirements
+# -----------------------------------------------------------------------------
+#
+# - This pack assumes the host agent's Edit / Write / MultiEdit
+#   tool exposes ``file_path`` (Claude Code, Cursor, Codex all
+#   currently do). Hosts using a different param name will need
+#   the per-host adjustment that ``self-modify.yaml`` already
+#   documents.
+#
+# - The path set is the union of every Sponsio-supported host's
+#   wiring files. A given per-host bucket only needs the entries
+#   matching ITS host, but keeping the union here means the pack
+#   stays a single drop-in include with no per-host customization
+#   required at the call site. False-positive cost is zero —
+#   ``.cursor/hooks.json`` is only present in Cursor projects, so
+#   a Claude Code agent's edits to a non-existent path will never
+#   match anyway.
+#
+# - The ``"*"`` agent scope means these rules apply to every agent
+#   in any library that includes this pack. Recommended include
+#   site is the per-host bucket (``_host_cursor`` /
+#   ``_host_claude_code``), so the rules fire on the host that
+#   actually has the wiring file in question.
+#
+# - The bash mutator regex in §6 is intentionally broader than
+#   self-modify §5's interpreter-only regex. That's correct: hook
+#   config files are JSON, so non-interpreter shell mutators
+#   (sed, tee, cp) are the natural attack surface and they don't
+#   apply to .sponsio/plugins/*.yaml the same way (yaml requires
+#   careful editing that bash one-liners typically don't produce
+#   correctly, so the attack-shape distribution differs).
+#
+# - Read of hook config files is permitted. If a future incident
+#   pack wants to deny reads (e.g. for a defense-in-depth recon
+#   block similar to subagent-escape §4), add it as a separate
+#   ``incident/host-config-recon.yaml`` rather than expanding
+#   this capability pack — capability packs stay narrowly scoped
+#   to a single privilege boundary.

package/contracts/capability/self-modify.yaml

@@ -19,12 +19,42 @@
 # time, but a sponsio-native rule is the right defense — it travels
 # with the user's config to any host (Cursor, Codex, custom MCP).
 #
+# A second escalation vector lives one level up: an agent can
+# ``import sponsio; print(sponsio.__file__)`` to locate the
+# installed package, then edit the upstream capability bundle (or
+# the evaluation engine itself) to delete the rule about to fire.
+# This works on **any** user-writable Python install — editable
+# (``pip install -e .``), ``pip install --user``, conda envs,
+# venvs.  Only system-wide ``/usr/lib/python*`` installs are safe
+# by filesystem permission alone, and that's the minority of real
+# deployments.  This pack closes that vector.
+#
 # What this pack denies:
 #   - Edit / Write / MultiEdit on the legacy host guard config:
 #     ``~/.sponsio/plugins/_host/sponsio.yaml``
 #   - Edit / Write / MultiEdit on ANY per-plugin / per-MCP-server
 #     library (``~/.sponsio/plugins/<plugin-id>/sponsio.yaml``
 #     where ``<plugin-id>`` does NOT start with ``_host``).
+#   - Edit / Write / MultiEdit on the **upstream sponsio package** —
+#     specifically the contract bundles under
+#     ``sponsio/contracts/**/*.yaml`` and the evaluation-engine
+#     Python files (``guard_stdin``, ``config``, ``core``, plus
+#     anything under ``runtime/``, ``patterns/``, ``formulas/``,
+#     ``tracer/``, ``integrations/``, ``daemon/``, ``shim/``).  Without
+#     this, an agent can ``import sponsio; print(sponsio.__file__)`` to locate
+#     the package, then edit a capability bundle (or monkey-patch
+#     the loader) to delete the rule about to fire — bypassing the
+#     per-bucket protection above.
+#   - Bash write operators (``>``, ``>>``, ``tee``, ``sed -i``,
+#     ``cp/mv/rm/dd``) targeting any of the above paths — the
+#     "shell shortcut" bypass of the structured Edit/Write block.
+#   - Bash interpreter invocations (``python``, ``node``, ``ruby``,
+#     ``perl``, ``deno``, ``bun``, etc.) targeting any protected
+#     path — the "run a script that does the write" bypass.
+#   - Write / Edit content that creates a script which itself
+#     mutates a protected path — the "stage a file then invoke it"
+#     two-step bypass.
+#
 #     The legitimate way to add or update these bundles is the
 #     ``sponsio plugin install`` / ``sponsio plugin scan --apply``
 #     CLI — those write via Python subprocess, not the agent's
@@ -34,6 +64,17 @@
 #     own Edit/Write tools to weaken or rewrite a bundle that's
 #     about to fire against it.
 #
+#     **Sponsio dev exception**: contributors working on the sponsio
+#     package itself routinely edit these files.  Override in your
+#     project-level config:
+#
+#         customized:
+#           - match: {source: "library:tier1.self-modify"}
+#             disabled: true
+#
+#     This loses self-modify protection inside the sponsio repo —
+#     acceptable for the maintainer workflow, not for end users.
+#
 # Per-host buckets (``_host_cursor`` / ``_host_claude_code`` / etc.)
 # carry their own targeted self-modify rules INSIDE their starter
 # yaml, scoped to that one bucket only. The split keeps the
@@ -56,6 +97,13 @@
 #     ``sponsio onboard`` writes into the user's repo).  That file
 #     IS supposed to evolve — onboard / scan / refresh all rewrite
 #     it.  Locking it would break the core happy path.
+#   - Edits to non-engine sponsio package files (``cli.py``,
+#     ``discovery/``, ``reporting/``, ``scoring/``, ``demos/``,
+#     ``generation/``, ``models/``).  These don't sit on the hook
+#     evaluation hot path — modifying them can't disable a rule
+#     against the agent's NEXT call.  Sponsio contributors edit
+#     them frequently; locking them would make the dev workflow
+#     unworkable.
 #   - Direct edits via the user's IDE, terminal, or
 #     ``sponsio plugin install`` / ``plugin scan --apply`` CLI —
 #     those don't go through the ``Edit`` / ``Write`` tool surface
@@ -82,11 +130,11 @@ agents:
     contracts:
 
       # =================================================================
-      # § 1 — No agent-mediated Edit of own host guard config
+      # § 1 — No agent-mediated Edit of any sponsio config or engine
       # =================================================================
 
-      - desc: "Host agent must not edit any sponsio guard config (host bucket or per-plugin bundle) — use `sponsio plugin install` / `plugin scan --apply`, or hand-edit"
-        E:
+      - desc: "Host agent must not edit any sponsio guard config or engine file — use `sponsio plugin install` / `plugin scan --apply`, or hand-edit"
+        G:
           pattern: arg_blacklist
           args:
             - Edit
@@ -101,10 +149,17 @@ agents:
             # still manage downstream plugin policy.
             - - "(^|/)\\.sponsio/plugins/_host/sponsio\\.yaml$"
               - "(^|/)\\.sponsio/plugins/[^_/][^/]*/sponsio\\.yaml$"
+              # Upstream sponsio package — contract bundles (rule data)
+              # and evaluation-engine .py files. Anchored on
+              # ``(^|/)sponsio/...`` so it matches editable installs,
+              # site-packages, --user installs, conda/venv all the same.
+              - "(^|/)sponsio/contracts/[^/]+/[^/]+\\.yaml$"
+              - "(^|/)sponsio/(guard_stdin|config|core)\\.py$"
+              - "(^|/)sponsio/(runtime|patterns|formulas|tracer|integrations|daemon|shim)/[^/]+\\.py$"
           source: "library:tier1.self-modify"
 
       # =================================================================
-      # § 2 — No agent-mediated Write of own host guard config
+      # § 2 — No agent-mediated Write of any sponsio config or engine
       # =================================================================
       #
       # ``Write`` is the "create or overwrite whole file" tool —
@@ -112,28 +167,219 @@ agents:
       # rules removed" workaround a pure ``Edit`` block would leave
       # open.
 
-      - desc: "Host agent must not overwrite any sponsio guard config (host bucket or per-plugin bundle) — use the CLI or hand-edit"
-        E:
+      - desc: "Host agent must not overwrite any sponsio guard config or engine file — use the CLI or hand-edit"
+        G:
           pattern: arg_blacklist
           args:
             - Write
             - file_path
             - - "(^|/)\\.sponsio/plugins/_host/sponsio\\.yaml$"
               - "(^|/)\\.sponsio/plugins/[^_/][^/]*/sponsio\\.yaml$"
+              - "(^|/)sponsio/contracts/[^/]+/[^/]+\\.yaml$"
+              - "(^|/)sponsio/(guard_stdin|config|core)\\.py$"
+              - "(^|/)sponsio/(runtime|patterns|formulas|tracer|integrations|daemon|shim)/[^/]+\\.py$"
           source: "library:tier1.self-modify"
 
       # =================================================================
-      # § 3 — No agent-mediated MultiEdit of own host guard config
+      # § 3 — No agent-mediated MultiEdit of any sponsio config or engine
       # =================================================================
 
-      - desc: "Host agent must not multi-edit any sponsio guard config (host bucket or per-plugin bundle) — use the CLI or hand-edit"
-        E:
+      - desc: "Host agent must not multi-edit any sponsio guard config or engine file — use the CLI or hand-edit"
+        G:
           pattern: arg_blacklist
           args:
             - MultiEdit
             - file_path
             - - "(^|/)\\.sponsio/plugins/_host/sponsio\\.yaml$"
               - "(^|/)\\.sponsio/plugins/[^_/][^/]*/sponsio\\.yaml$"
+              - "(^|/)sponsio/contracts/[^/]+/[^/]+\\.yaml$"
+              - "(^|/)sponsio/(guard_stdin|config|core)\\.py$"
+              - "(^|/)sponsio/(runtime|patterns|formulas|tracer|integrations|daemon|shim)/[^/]+\\.py$"
+          source: "library:tier1.self-modify"
+
+      # =================================================================
+      # § 4 — No agent-mediated creation of a *script* that writes to
+      #       a protected path (the "Python file I/O bypass")
+      # =================================================================
+      #
+      # Observed bypass: agent's ``Write`` to the host bucket gets denied
+      # by §1–§3, agent recovers by writing a small ``merge_host_*.py``
+      # script in the workspace whose content opens the host bucket
+      # path in write mode and mutates it.  The script's file_path is a
+      # normal repo path so §1–§3 don't fire; the Bash invocation
+      # ``python merge.py`` doesn't carry the host bucket path on the
+      # command line so §6 below also doesn't fire.  The signal IS
+      # present: the script's *content* mentions a protected path
+      # AND uses an open-for-write idiom.
+      #
+      # The lookahead form ``(?s)(?=.*PATH).*(WRITE_SHAPE)`` requires
+      # both signals in the same content blob — pure docs that mention
+      # the path stay editable; only files that mention the path AND
+      # carry write-shaped code are denied.
+      #
+      # The PATH alternation covers all four protected families:
+      #   - host buckets (~/.sponsio/plugins/_host*/...)
+      #   - per-plugin libs (~/.sponsio/plugins/<id>/...)
+      #   - upstream contract bundles (sponsio/contracts/.../*.yaml)
+      #   - upstream engine .py (sponsio/{guard_stdin,config,core}.py
+      #     and sponsio/{runtime,patterns,formulas,tracer,
+      #     integrations}/*.py)
+      #
+      # Tools covered: Write.content, Edit.new_string,
+      # MultiEdit.edits[*].new_string (the ``new_string`` projection
+      # that grounding extracts from MultiEdit's edit list).
+
+      - desc: "Host agent must not write a script that mutates a sponsio guard config or engine file — use `sponsio plugin append`/`install`"
+        G:
+          pattern: arg_blacklist
+          args:
+            - Write
+            - content
+            - - "(?s)(?=.*(\\.sponsio/plugins/(_host[^/]*|[^_/][^/]*)/sponsio\\.yaml|sponsio/contracts/[^/]+/[^/]+\\.yaml|sponsio/(guard_stdin|config|core)\\.py|sponsio/(runtime|patterns|formulas|tracer|integrations|daemon|shim)/[^/]+\\.py)).*(\\.write_text\\s*\\(|\\.write_bytes\\s*\\(|\\bf\\.write\\s*\\(|\\bopen\\s*\\([^)]*['\\\"][aw][\\+bxt]*['\\\"]\\s*\\)|\\bfs\\.(writeFileSync|appendFileSync|createWriteStream|writeFile)\\s*\\(|\\bFile\\.(open|write)\\s*\\(|\\b(IO|File)\\.write\\b)"
+          source: "library:tier1.self-modify"
+
+      - desc: "Host agent must not edit a script that mutates a sponsio guard config or engine file — use `sponsio plugin append`/`install`"
+        G:
+          pattern: arg_blacklist
+          args:
+            - Edit
+            - new_string
+            - - "(?s)(?=.*(\\.sponsio/plugins/(_host[^/]*|[^_/][^/]*)/sponsio\\.yaml|sponsio/contracts/[^/]+/[^/]+\\.yaml|sponsio/(guard_stdin|config|core)\\.py|sponsio/(runtime|patterns|formulas|tracer|integrations|daemon|shim)/[^/]+\\.py)).*(\\.write_text\\s*\\(|\\.write_bytes\\s*\\(|\\bf\\.write\\s*\\(|\\bopen\\s*\\([^)]*['\\\"][aw][\\+bxt]*['\\\"]\\s*\\)|\\bfs\\.(writeFileSync|appendFileSync|createWriteStream|writeFile)\\s*\\(|\\bFile\\.(open|write)\\s*\\(|\\b(IO|File)\\.write\\b)"
+          source: "library:tier1.self-modify"
+
+      # =================================================================
+      # § 5 — No interpreter invocation that targets a protected path
+      # =================================================================
+      #
+      # Catches the inline form (``python -c "...sponsio/contracts/..."``)
+      # and the path-as-argument form (``python merge.py
+      # ~/.sponsio/plugins/...sponsio.yaml``).  Pairs with §4 — that
+      # rule blocks the *creation* of bypass scripts, this rule blocks
+      # the *invocation* path that doesn't go through a separate file.
+      #
+      # The interpreter list is the common scripting set; add new ones
+      # via a project-local ``customized:`` extending the regex if your
+      # environment uses a less common runtime.  The trailing path
+      # regex is the same shape as §1–§3 / §6 so the privilege boundary
+      # stays consistent across tools.
+      #
+      # Legitimate sponsio CLIs that read the path
+      # (``sponsio validate --config <path>``, ``sponsio plugin
+      # show <name>``) are not blocked because the leading verb is
+      # ``sponsio``, not an interpreter alias.  ``sponsio plugin
+      # append --target <plugin-id>`` doesn't pass the path at all —
+      # it takes the plugin id and resolves the path internally.
+
+      - desc: "Host agent must not run an interpreter against a sponsio guard config or engine file — use `sponsio plugin append`/`install`"
+        G:
+          pattern: arg_blacklist
+          args:
+            - Bash
+            - command
+            # ``[^|\n]*`` excludes pipe + newline so we don't match
+            # across pipelines, but keeps ``;`` permitted because
+            # Python's ``-c "..."`` payloads commonly use it as a
+            # statement separator (``python -c "import x; x.do()"``).
+            - - "\\b(python|python2|python3|node|deno|bun|ruby|perl|php|lua|tclsh|R|Rscript)\\b[^|\\n]*(\\.sponsio/plugins/(_host[^/]*|[^_/][^/]*)/sponsio\\.yaml|sponsio/contracts/[^/]+/[^/]+\\.yaml|sponsio/(guard_stdin|config|core)\\.py|sponsio/(runtime|patterns|formulas|tracer|integrations|daemon|shim)/[^/]+\\.py)"
+          source: "library:tier1.self-modify"
+
+      # =================================================================
+      # § 6 — No Bash write operators against a protected path
+      # =================================================================
+      #
+      # The "shell shortcut" bypass: ``echo … > sponsio/contracts/…``,
+      # ``sed -i … sponsio/runtime/monitor.py``, ``cp /tmp/replacement
+      # sponsio/patterns/library.py``.  These don't go through Edit /
+      # Write / MultiEdit so §1–§3 don't see them.  Each operator
+      # gets one regex, applied against the same alternation of
+      # protected paths as §1–§3.
+      #
+      # Operator list: redirect (``>``, ``>>``), explicit writers
+      # (``tee``, ``sed -i``), file movers (``cp``, ``mv``, ``rm``,
+      # ``dd``).  The ``[^|&;]*`` segment between operator and path
+      # keeps each match local to its own command (won't cross
+      # pipelines or statement separators).
+
+      - desc: "Host agent must not redirect Bash output (`>` / `>>`) into a sponsio guard config or engine file"
+        G:
+          pattern: arg_blacklist
+          args:
+            - Bash
+            - command
+            - - ">{1,2}\\|?\\s*[^|&;<>\\n]*(\\.sponsio/plugins/(_host[^/]*|[^_/][^/]*)/sponsio\\.yaml|sponsio/contracts/[^/]+/[^/]+\\.yaml|sponsio/(guard_stdin|config|core)\\.py|sponsio/(runtime|patterns|formulas|tracer|integrations|daemon|shim)/[^/]+\\.py)"
+          source: "library:tier1.self-modify"
+
+      - desc: "Host agent must not `tee` into a sponsio guard config or engine file"
+        G:
+          pattern: arg_blacklist
+          args:
+            - Bash
+            - command
+            - - "\\btee\\b\\s+[^|&;]*(\\.sponsio/plugins/(_host[^/]*|[^_/][^/]*)/sponsio\\.yaml|sponsio/contracts/[^/]+/[^/]+\\.yaml|sponsio/(guard_stdin|config|core)\\.py|sponsio/(runtime|patterns|formulas|tracer|integrations|daemon|shim)/[^/]+\\.py)"
+          source: "library:tier1.self-modify"
+
+      - desc: "Host agent must not `sed -i` a sponsio guard config or engine file"
+        G:
+          pattern: arg_blacklist
+          args:
+            - Bash
+            - command
+            - - "\\bsed\\b\\s+-i\\b[^|&;]*(\\.sponsio/plugins/(_host[^/]*|[^_/][^/]*)/sponsio\\.yaml|sponsio/contracts/[^/]+/[^/]+\\.yaml|sponsio/(guard_stdin|config|core)\\.py|sponsio/(runtime|patterns|formulas|tracer|integrations|daemon|shim)/[^/]+\\.py)"
+          source: "library:tier1.self-modify"
+
+      - desc: "Host agent must not `cp` / `mv` / `rm` / `dd` against a sponsio guard config or engine file"
+        G:
+          pattern: arg_blacklist
+          args:
+            - Bash
+            - command
+            - - "\\b(cp|mv|rm|dd)\\b\\s+[^|&;]*(\\.sponsio/plugins/(_host[^/]*|[^_/][^/]*)/sponsio\\.yaml|sponsio/contracts/[^/]+/[^/]+\\.yaml|sponsio/(guard_stdin|config|core)\\.py|sponsio/(runtime|patterns|formulas|tracer|integrations|daemon|shim)/[^/]+\\.py)"
+          source: "library:tier1.self-modify"
+
+      # A file can be emptied, replaced, or made unreadable without a
+      # write operator: ``truncate -s0``, ``ln -sf /dev/null``,
+      # ``chmod 000`` (reported by kta1kri, 2026-10, against the hook
+      # wiring; the rule file has the same exposure). The hook fails
+      # closed on an empty or unreadable library, so for the rule file
+      # these are denial of service rather than bypass, but they are
+      # the agent reaching for its own guard all the same.
+      - desc: "Host agent must not truncate / link over / lock a sponsio guard config or engine file"
+        G:
+          pattern: arg_blacklist
+          args:
+            - Bash
+            - command
+            - - "\\b(truncate|ln|chmod|chown|chattr|shred|unlink|install|rsync|sponge|patch|ed|ex|vi|vim|nvim)\\b\\s+[^|&;]*(\\.sponsio/plugins/(_host[^/]*|[^_/][^/]*)/sponsio\\.yaml|sponsio/contracts/[^/]+/[^/]+\\.yaml|sponsio/(guard_stdin|config|core)\\.py|sponsio/(runtime|patterns|formulas|tracer|integrations|daemon|shim)/[^/]+\\.py)"
+          source: "library:tier1.self-modify"
+
+      # The rules above name the rule FILE. Removing or moving a directory
+      # that contains it (``rm -rf ~/.sponsio``, ``mv ~/.sponsio/plugins
+      # /tmp``) took every library with it, after which each tool was
+      # "unconfigured" and ran, and ``defaults.unconfigured: deny`` went
+      # too, since it lives in the host library. The lookahead stops at
+      # the directory name so ``~/.sponsio-backup`` stays allowed.
+      - desc: "Host agent must not remove, move, or lock the sponsio config directory or a library bucket"
+        G:
+          pattern: arg_blacklist
+          args:
+            - Bash
+            - command
+            - - "\\b(rm|mv|rmdir|chmod|chown|chattr|ln)\\b[^|&;\\n]*\\.sponsio(/plugins(/[\\w-]+)?)?/?(?![\\w./-])"
+          source: "library:tier1.self-modify"
+
+      # The daemon holds a rule change that removes a contract until
+      # someone runs `sponsio rules reload`. At Tier 1 that someone could
+      # be the agent, approving its own weakening; the same goes for
+      # starting a daemon that applies every change (`--watch`), switching
+      # a host to observe, or removing the hooks. These belong to the
+      # person at their own terminal.
+      - desc: "Host agent must not approve its own rule changes, or switch Sponsio to observe or off"
+        G:
+          pattern: arg_blacklist
+          args:
+            - Bash
+            - command
+            - - "\\bsponsio\\b[^|&;\\n]*\\b(rules\\s+reload|admin\\b|daemon\\s+run\\b[^|&;\\n]*--watch|host\\s+uninstall|host\\s+install\\b[^|&;\\n]*--mode[\\s=]+observe)"
           source: "library:tier1.self-modify"
 
 # -----------------------------------------------------------------------------
@@ -150,3 +396,8 @@ agents:
 #   trying to touch this same file is covered by the broader
 #   ``sponsio:incident/subagent-escape`` pack, which denies the
 #   ENTIRE ``~/.sponsio/`` tree to sub-agents.
+#
+# - Upstream package paths are matched WITHOUT the install prefix —
+#   ``(^|/)sponsio/contracts/...`` matches editable installs, site-
+#   packages, --user installs, conda/venv all the same.  The first
+#   ``sponsio/`` directory boundary anchors the match cleanly.