@sponsio/sdk 0.1.0-alpha.3

package/contracts/capability/self-modify.yaml

@@ -0,0 +1,152 @@
+# =============================================================================
+# sponsio/contracts/capability/self-modify.yaml
+#
+# Capability pack — self-modification protection for the host agent.
+# Include in your host library (default ``_host``) so the agent
+# under guard cannot weaken or disable the very contracts about to
+# block its next call.
+#
+# Threat model:
+#
+# An agent that can edit its own ``~/.sponsio/plugins/_host/sponsio.yaml``
+# can append an ``customized:`` block to disable the rule about to
+# fire against it.  This is privilege escalation by self-rewriting:
+# the safety mechanism becomes the agent's own debuggable resource.
+# Observed in the wild during the development of this very pack —
+# the host agent (Claude Code in auto mode) attempted to add an
+# ``overrides`` block to disable a Bash rate_limit that had just
+# blocked it.  Caught by Claude Code's harness-level meta-deny that
+# time, but a sponsio-native rule is the right defense — it travels
+# with the user's config to any host (Cursor, Codex, custom MCP).
+#
+# What this pack denies:
+#   - Edit / Write / MultiEdit on the legacy host guard config:
+#     ``~/.sponsio/plugins/_host/sponsio.yaml``
+#   - Edit / Write / MultiEdit on ANY per-plugin / per-MCP-server
+#     library (``~/.sponsio/plugins/<plugin-id>/sponsio.yaml``
+#     where ``<plugin-id>`` does NOT start with ``_host``).
+#     The legitimate way to add or update these bundles is the
+#     ``sponsio plugin install`` / ``sponsio plugin scan --apply``
+#     CLI — those write via Python subprocess, not the agent's
+#     Edit/Write tool surface, so they aren't blocked.  The user
+#     hand-editing the file in their text editor is also fine.
+#     What's denied is the IDE coding agent reaching in with its
+#     own Edit/Write tools to weaken or rewrite a bundle that's
+#     about to fire against it.
+#
+# Per-host buckets (``_host_cursor`` / ``_host_claude_code`` / etc.)
+# carry their own targeted self-modify rules INSIDE their starter
+# yaml, scoped to that one bucket only. The split keeps the
+# legitimate "parent manages child policy" workflow alive — Cursor's
+# main agent can still edit ``_host_cursor_subagent/sponsio.yaml``
+# (tightening child rules from the parent context), and an operator
+# managing both Cursor and Claude Code from one IDE can edit the
+# OTHER host's bucket without being blocked.  Each agent only loses
+# write access to ITS OWN bucket — that's the privilege boundary
+# this pack family enforces.  The ``[^_]...`` regex below excludes
+# every ``_host*`` bucket from the per-plugin rule precisely so this
+# parent-child workflow stays open.
+#
+# What this pack does NOT deny:
+#   - Edits to per-host SUBAGENT buckets (``_host_*_subagent``).
+#     Parent tightening child policy is a sanctioned workflow.
+#   - Edits to a SIBLING host bucket (an operator on Claude Code
+#     editing ``_host_cursor/`` or vice versa).
+#   - Edits to the project's own ``sponsio.yaml`` (the one
+#     ``sponsio onboard`` writes into the user's repo).  That file
+#     IS supposed to evolve — onboard / scan / refresh all rewrite
+#     it.  Locking it would break the core happy path.
+#   - Direct edits via the user's IDE, terminal, or
+#     ``sponsio plugin install`` / ``plugin scan --apply`` CLI —
+#     those don't go through the ``Edit`` / ``Write`` tool surface
+#     that this pack inspects.  The legitimate path for "I really
+#     do want to change this" stays open; only the agent-mediated
+#     path is closed.
+#
+# Pair with: ``sponsio:incident/subagent-escape`` for the matching
+# subagent-side rule (sub-agents can't reach UP into the parent's
+# config tree at all).
+#
+# Include via:
+#   include:
+#     - sponsio:capability/self-modify
+#
+# Source tag convention:
+#   library:tier1.self-modify
+# =============================================================================
+
+version: "1"
+
+agents:
+  "*":
+    contracts:
+
+      # =================================================================
+      # § 1 — No agent-mediated Edit of own host guard config
+      # =================================================================
+
+      - desc: "Host agent must not edit any sponsio guard config (host bucket or per-plugin bundle) — use `sponsio plugin install` / `plugin scan --apply`, or hand-edit"
+        E:
+          pattern: arg_blacklist
+          args:
+            - Edit
+            - file_path
+            # Match every per-host bucket: ``_host`` (legacy),
+            # ``_host_cursor`` / ``_host_cursor_subagent``,
+            # ``_host_claude_code`` / ``_host_claude_code_subagent``,
+            # ``_host_openclaw``, plus any future bucket following the
+            # same naming scheme. Per-MCP-server libraries
+            # (``github``, ``filesystem``, ``<plugin-id>``) are not
+            # ``_host*``-prefixed and stay editable so the host can
+            # still manage downstream plugin policy.
+            - - "(^|/)\\.sponsio/plugins/_host/sponsio\\.yaml$"
+              - "(^|/)\\.sponsio/plugins/[^_/][^/]*/sponsio\\.yaml$"
+          source: "library:tier1.self-modify"
+
+      # =================================================================
+      # § 2 — No agent-mediated Write of own host guard config
+      # =================================================================
+      #
+      # ``Write`` is the "create or overwrite whole file" tool —
+      # blocking it shuts the "delete the file then re-create with
+      # rules removed" workaround a pure ``Edit`` block would leave
+      # open.
+
+      - desc: "Host agent must not overwrite any sponsio guard config (host bucket or per-plugin bundle) — use the CLI or hand-edit"
+        E:
+          pattern: arg_blacklist
+          args:
+            - Write
+            - file_path
+            - - "(^|/)\\.sponsio/plugins/_host/sponsio\\.yaml$"
+              - "(^|/)\\.sponsio/plugins/[^_/][^/]*/sponsio\\.yaml$"
+          source: "library:tier1.self-modify"
+
+      # =================================================================
+      # § 3 — No agent-mediated MultiEdit of own host guard config
+      # =================================================================
+
+      - desc: "Host agent must not multi-edit any sponsio guard config (host bucket or per-plugin bundle) — use the CLI or hand-edit"
+        E:
+          pattern: arg_blacklist
+          args:
+            - MultiEdit
+            - file_path
+            - - "(^|/)\\.sponsio/plugins/_host/sponsio\\.yaml$"
+              - "(^|/)\\.sponsio/plugins/[^_/][^/]*/sponsio\\.yaml$"
+          source: "library:tier1.self-modify"
+
+# -----------------------------------------------------------------------------
+# Integration requirements
+# -----------------------------------------------------------------------------
+#
+# - Path matching is regex on the file_path arg.  Hosts whose Edit /
+#   Write / MultiEdit tool uses a different param name will need a
+#   per-host adjustment (Claude Code uses ``file_path`` — handled).
+#
+# - The ``"*"`` agent scope means these rules apply to every agent
+#   in any library that includes this pack.  In practice the only
+#   include site is ``_host`` (the main session) — a sub-agent
+#   trying to touch this same file is covered by the broader
+#   ``sponsio:incident/subagent-escape`` pack, which denies the
+#   ENTIRE ``~/.sponsio/`` tree to sub-agents.

package/contracts/capability/shell.yaml

@@ -0,0 +1,246 @@
+# =============================================================================
+# sponsio/contracts/capability/shell.yaml
+#
+# Capability pack — shell execution.  Include when your agent exposes a
+# tool that runs arbitrary shell commands (`exec`, `bash`, `run_command`,
+# `execute`, Claude Code's Bash tool, etc.).  Rename the tool in your
+# config if it's not called `exec`.
+#
+# Real-world incidents this pack defends against:
+#
+#   - Claude Code Issue #10077 (Oct 2025): agent ran recursive delete,
+#     wiped user home directory.  The Reddit r/ClaudeAI post garnered
+#     1,500+ upvotes.
+#   - Claude Code Issue #49464: agent tried `rm -f ~/` when a file named
+#     literally "~" was present.  Requested fix: "pattern detection for
+#     dangerous commands."
+#   - Replit agent (Jul 2025): deleted live production DB during a code
+#     freeze, affecting 1,200+ companies.  Agent admitted "catastrophic
+#     error in judgment."
+#   - Ansible + undefined-variable expansion: `rm -rf {foo}/{bar}` → `rm
+#     -rf /` on 1,535 production servers (Server Fault / Marco Marsala).
+#   - OpenClaw ClawHavoc: ClickFix prereqs running curl|bash in users'
+#     terminals via malicious SKILL.md.
+#   - OpenClaw CVE-2026-28460: approval allowlist bypassed with shell
+#     line-continuation (`\\\n`).
+#
+# Every contract here targets a single tool name (`exec` by default).
+# If your agent calls it something else, do a find-and-replace before
+# including this file.
+#
+# Include via:
+#   include:
+#     - sponsio:capability/shell
+#
+# Source tag convention:
+#   library:tier1.shell
+# =============================================================================
+
+version: "1"
+
+tools:
+  - name: exec
+    description: "Shell command execution (placeholder — replace with your tool's real name)"
+    params: "command: str"
+
+agents:
+  "*":
+    contracts:
+
+      # =================================================================
+      # § 1 — Destructive command blacklist
+      # =================================================================
+
+      - desc: "Ban recursive deletes of sensitive roots"
+        E:
+          pattern: arg_blacklist
+          args:
+            - exec
+            - command
+            # Targets:
+            #   rm -rf /          (Marsala / Ansible expansion)
+            #   rm -rf ~          (Claude Code #49464 tilde bug)
+            #   rm -rf $HOME      (env expansion variant)
+            #   rm -rf /*         (glob to root)
+            #   rm -rf /home/...  (direct home path)
+            #   rm -rf /root/...
+            #   rm -rf /Users/... (macOS home)
+            - - "rm\\s+-[rRf]+\\s+(/|\\$HOME|~)(\\s|;|&|\\||$)"
+              - "rm\\s+-[rRf]+\\s+/\\*"
+              - "rm\\s+-[rRf]+\\s+/(home|root|Users)"
+              - "rm\\s+-[rRf]+\\s+\\$\\{?HOME\\}?"
+          source: "library:tier1.shell"
+
+      - desc: "Ban fork-bomb and obvious denial-of-service patterns"
+        E:
+          pattern: arg_blacklist
+          args:
+            - exec
+            - command
+            # Fork bomb:      :(){ :|:& };:
+            # dd if=/dev/zero  (disk fill)
+            # mkfs             (filesystem format)
+            # shred -vfz       (irrecoverable overwrite)
+            - - ":\\s*\\(\\)\\s*\\{\\s*:\\s*\\|\\s*:\\s*&\\s*\\}\\s*;\\s*:"
+              - "dd\\s+if=/dev/zero"
+              - "\\bmkfs\\."
+              - "shred\\s+-[vfz]+"
+          source: "library:tier1.shell"
+
+      - desc: "Ban curl-to-shell and wget-to-shell (ClawHavoc ClickFix vector)"
+        E:
+          pattern: arg_blacklist
+          args:
+            - exec
+            - command
+            - - "curl[^|]+\\|\\s*(ba)?sh"
+              - "wget[^|]+\\|\\s*(ba)?sh"
+              - "curl[^|]+\\|\\s*python"
+              - "wget\\s+-O-[^|]*\\|"
+          source: "library:tier1.shell"
+
+      - desc: "Ban outbound reverse-shell / exfiltration primitives"
+        E:
+          pattern: arg_blacklist
+          args:
+            - exec
+            - command
+            - - "nc\\s+-e"
+              - "bash\\s+-i\\s*>&\\s*/dev/tcp"
+              - "python.*socket\\.socket"
+              - "curl[^|]+--upload-file"
+          source: "library:tier1.shell"
+
+      # Line-continuation `\<newline>` is a common evasion for approval
+      # allowlists: the approver sees `ls` but the shell executes
+      # `ls\<newline>; rm -rf /`.  Rather than banning EVERY backslash-
+      # newline (multi-line Makefiles, Docker RUN blocks, shell scripts
+      # all use it legitimately), we only flag continuation followed by
+      # a privilege-sensitive command token.  Keeps the CVE coverage
+      # while eliminating the biggest day-1 false-positive source.
+      - desc: "Ban shell line-continuation chained into a privileged command (CVE-2026-28460)"
+        E:
+          pattern: arg_blacklist
+          args:
+            - exec
+            - command
+            - - "\\\\\\n\\s*(sudo|su\\s|rm\\s+-[rRf]|dd\\s+if=|chmod\\s|chown\\s|mount\\s|curl\\s|wget\\s)"
+              - "\\\\\\r?\\n\\s*(sudo|su\\s|rm\\s+-[rRf]|dd\\s+if=|chmod\\s|chown\\s|mount\\s|curl\\s|wget\\s)"
+          source: "library:tier1.shell"
+
+      - desc: "Ban undefined-variable-looking patterns that expand to empty in shell"
+        # rm -rf {undefined}/{also_undefined} → rm -rf /
+        E:
+          pattern: arg_blacklist
+          args:
+            - exec
+            - command
+            - - "rm\\s+-[rRf]+\\s+\\{[^}]*\\}/?"
+              - "rm\\s+-[rRf]+\\s+\\$\\{[^}]*\\}/?"
+          source: "library:tier1.shell"
+
+      # =================================================================
+      # § 2 — Blast-radius limits
+      # =================================================================
+
+      - desc: "Reject exec commands with suspiciously long inline payloads (injection indicator)"
+        E:
+          pattern: arg_length_limit
+          args: [exec, command, 2000]
+          source: "library:tier1.shell"
+
+      - desc: "Cap exec calls per session"
+        E:
+          pattern: rate_limit
+          args: [exec, 50]
+          source: "library:tier1.shell"
+
+      # Threshold tuned for shell specifically. Earlier 5 was inherited
+      # from narrow-tool defaults (apply_patch / merge_pr) where 5
+      # consecutive same-tool calls is genuinely suspicious. Shell is a
+      # swiss-army-knife — a normal coding agent doing a refactor will
+      # routinely run pytest → git status → git diff → git add → git
+      # commit → git push back-to-back without ever leaving the shell
+      # tool, which is 6 consecutive calls of legitimate work. 20 still
+      # trips on the runaway pattern (a genuinely stuck self-rewrite
+      # loop hits 20 in a few seconds) without false-positiving real
+      # development workflows. The session-wide rate_limit(exec, 50)
+      # below remains the harder backstop.
+      - desc: "No more than 20 consecutive exec calls (runaway loop cap)"
+        E:
+          pattern: loop_detection
+          args: [exec, 20]
+          source: "library:tier1.shell"
+
+      # =================================================================
+      # § 3 — Privileged commands require confirmation
+      #
+      # The pattern library's must_confirm gates an entire tool; we want
+      # the gate to fire only when the *argument* matches a dangerous
+      # pattern.  Count-dominance over a confirm_reconfirmed marker is
+      # the cleanest LTL form and doesn't require a new pattern.
+      # =================================================================
+
+      - desc: "Privileged exec patterns (sudo, chmod 777, dd if=) require preceding human confirmation"
+        E:
+          ltl: 'G(called_with(exec, "(sudo\\s|dd\\s+if=|chmod\\s+777|chown\\s+-R|mount\\s)") -> count(confirm_reconfirmed) >= count_with(exec, "(sudo\\s|dd\\s+if=|chmod\\s+777|chown\\s+-R|mount\\s)"))'
+          source: "library:tier1.shell"
+
+      # =================================================================
+      # § 4 — Approval integrity (CVE-2026-29607 wrapper bypass, general form)
+      #
+      # A single confirm_reconfirmed cannot authorize two exec actions.
+      # count-dominance is a proxy for principal identity until a
+      # principal() atom ships.
+      #
+      # NOTE on batch approvals: this rule enforces a strict 1:1
+      # confirmation-to-exec ratio.  Some workflows legitimately
+      # batch-approve (CI pipelines, planned migrations).  If your
+      # workflow does, override this rule in your config:
+      #
+      #     customized:
+      #       - match: {desc: "Each exec call needs its own confirm_reconfirmed (no confirmation reuse)"}
+      #         disabled: true
+      #     contracts:
+      #       - desc: "Batch confirm — one confirm authorizes the next 5 execs"
+      #         E:
+      #           ltl: "G(called(exec) -> count(confirm_batch_5) > 0)"
+      #
+      # The batch marker (e.g. `confirm_batch_5`) must be emitted by
+      # your integration when the human signs off on a batch.
+      #
+      # ASSUMPTION gate: this rule only activates once the agent's
+      # integration has ever emitted `confirm_reconfirmed` in the
+      # current trace.  Agents that haven't wired the marker tool in
+      # at all (the common day-1 state) see this rule as vacuously
+      # true — otherwise every exec call would violate and drown the
+      # observe-mode report in noise.  When an integration adopts
+      # confirm_reconfirmed, the first emission flips the assumption
+      # true for that trace and the 1:1 guarantee begins applying.
+      # =================================================================
+
+      - desc: "Each exec call needs its own confirm_reconfirmed (no confirmation reuse)"
+        A: "called `confirm_reconfirmed`"
+        E:
+          ltl: "G(called(exec) -> count(confirm_reconfirmed) >= count(exec))"
+          source: "library:tier1.shell"
+
+# -----------------------------------------------------------------------------
+# Integration requirements
+# -----------------------------------------------------------------------------
+#
+# - `exec` is a placeholder tool name.  If your agent calls its shell
+#   tool something else (Bash, run_command, execute, etc.), rewrite the
+#   tool name at include time.
+#
+# - `confirm_reconfirmed` is a marker tool — your integration must emit
+#   a `tool_call` event with name="confirm_reconfirmed" whenever a human
+#   actually approves an action.  Without that emission, any contract
+#   using confirm_reconfirmed will fail closed (nothing is ever
+#   confirmed → everything requiring confirmation is blocked).
+#
+# - The LTL contracts in §3 and §4 depend on the `ltl:` schema field
+#   being supported by the config parser.  Until the LTL parser lands,
+#   these can be temporarily commented out; the arg_blacklist contracts
+#   in §1 and the rate_limit / loop_detection / arg_length_limit
+#   contracts in §2 work on current master.

package/contracts/capability/subagent.yaml

@@ -0,0 +1,184 @@
+# =============================================================================
+# sponsio/contracts/capability/subagent.yaml
+#
+# Capability pack — privilege boundary for Task-spawned sub-agents.
+# Include in your sub-agent host library (default ``_host_subagent``)
+# in addition to the regular shell / database / credentials packs.
+#
+# Rationale:
+#
+# A Claude Code Task-spawned sub-agent receives a *task description*
+# from the main agent, not the user's original prompt.  It has no
+# access to the conversation that authorised the task and cannot
+# surface a confirmation prompt back to the user.  This means
+# alignment-style "wait, is this what the user actually wanted?"
+# refusals don't fire — sub-agents execute their task with high
+# compliance, even when the task description was over-broad
+# ("set up the dev environment" → may interpret as drop-and-recreate
+# the database).
+#
+# Sponsio's response: the SAME tool call that's allowed for the main
+# agent (where the user can review every action in the conversation
+# transcript) gets denied for sub-agents (where the user has no
+# visibility).  This forces side-effect work to flow through the
+# main conversation, where the user can intervene.
+#
+# Threat model boundary:
+#
+#   - This pack relies on Claude Code's PreToolUse payload field
+#     ``agent_id`` (present iff the call originates from a sub-agent).
+#     Sponsio's ``derive_plugin_id`` reads this and routes to
+#     ``_host_subagent``; rules in this pack therefore only ever
+#     evaluate against sub-agent calls.
+#   - It does NOT block sub-agents from doing useful work
+#     (read, search, summarize).  It blocks side-effects whose
+#     authorization should travel back through the main conversation:
+#     git mutations, filesystem writes outside scratch space, network
+#     calls, destructive shell, package installs.
+#
+# Real-world incidents this pack defends against:
+#
+#   - Recurring r/ClaudeAI: sub-agent runs ``npm install -g <pkg>``
+#     to fix a broken setup, mutating global state without user
+#     approval.
+#   - "Refactor agent" pattern: parent dispatches Explore to fix a
+#     broken test; Explore commits its fix without showing diff to
+#     user.  Force-push later overwrites work.
+#   - Database setup overreach: parent says "init the db", Explore
+#     runs ``psql DROP DATABASE && CREATE DATABASE``, wiping prod.
+#
+# Include via:
+#   include:
+#     - sponsio:capability/subagent
+#
+# Tool naming:
+#   The pack uses canonical ``exec`` for the shell tool.  Claude
+#   Code's ``_host_subagent.yaml`` adds ``tool_rename: exec: Bash``
+#   so the rules apply to Claude Code's first-party Bash.
+#
+# Source tag convention:
+#   library:tier1.subagent
+# =============================================================================
+
+version: "1"
+
+tools:
+  - name: exec
+    description: "Shell command execution (placeholder — replace with your tool's real name)"
+    params: "command: str"
+
+agents:
+  "*":
+    contracts:
+
+      # =================================================================
+      # § 1 — Sub-agents may not commit, push, or rewrite git history
+      # =================================================================
+      #
+      # Forces the work product to flow back through the main
+      # conversation where the user sees every diff before it lands
+      # in version control.  Sub-agent edits remain in the working
+      # tree; main agent (with user-visible reasoning) decides
+      # whether to commit.
+
+      - desc: "Sub-agents may not commit, push, force-push, or rewrite git history"
+        E:
+          pattern: arg_blacklist
+          args:
+            - exec
+            - command
+            # ``git\b[^|;&]*?\b<verb>\b`` matches the verb anywhere
+            # in the same shell command — defeats the
+            # ``git -c core.hooksPath=/dev/null commit`` bypass an
+            # earlier brittle ``git\s+commit`` regex missed.  The
+            # ``[^|;&]*?`` keeps us inside the same command (won't
+            # cross ``|``, ``;``, ``&`` so ``git status; cat
+            # commit.log`` still passes).
+            - - "(?:^|[\\s;&|])git\\b[^|;&]*?\\b(commit|push|rebase|reflog|filter-branch|filter-repo)\\b"
+              - "(?:^|[\\s;&|])git\\b[^|;&]*?\\breset\\b[^|;&]*?\\b--hard\\b"
+              - "(?:^|[\\s;&|])git\\b[^|;&]*?\\b--force\\b"
+              - "(?:^|[\\s;&|])git\\b[^|;&]*?\\b-f\\b"
+              - "(?:^|[\\s;&|])git\\b[^|;&]*?\\brm\\b"
+          source: "library:tier1.subagent"
+
+      # =================================================================
+      # § 2 — Sub-agents may not install packages globally
+      # =================================================================
+      #
+      # Global package installs leak side-effects beyond the project
+      # working tree — they affect the user's whole machine.  Main
+      # agent can request these explicitly with user visibility;
+      # sub-agents shouldn't decide unilaterally.
+
+      - desc: "Sub-agents may not install packages globally or system-wide"
+        E:
+          pattern: arg_blacklist
+          args:
+            - exec
+            - command
+            - - "(?:^|[\\s;&|])npm\\s+install\\s+(?:-g|--global)\\b"
+              - "(?:^|[\\s;&|])yarn\\s+global\\s+add\\b"
+              - "(?:^|[\\s;&|])pnpm\\s+add\\s+(?:-g|--global)\\b"
+              - "(?:^|[\\s;&|])pip\\s+install\\s+(?:-U\\s+)?[^-]"
+              - "(?:^|[\\s;&|])pipx\\s+install\\b"
+              - "(?:^|[\\s;&|])brew\\s+install\\b"
+              - "(?:^|[\\s;&|])apt(?:-get)?\\s+install\\b"
+              - "(?:^|[\\s;&|])sudo\\b"
+          source: "library:tier1.subagent"
+
+      # =================================================================
+      # § 3 — Sub-agents may not make outbound network calls
+      # =================================================================
+      #
+      # Curl / wget / ssh-out from a sub-agent context is a common
+      # exfiltration / supply-chain vector — the sub-agent doesn't
+      # have user-conversation context to know whether contacting an
+      # arbitrary host is appropriate.
+
+      - desc: "Sub-agents may not make outbound HTTP / shell-tunneled network calls"
+        E:
+          pattern: arg_blacklist
+          args:
+            - exec
+            - command
+            - - "(?:^|[\\s;&|])curl\\b"
+              - "(?:^|[\\s;&|])wget\\b"
+              - "(?:^|[\\s;&|])nc\\s+-"
+              - "(?:^|[\\s;&|])ssh\\s+\\S+@"
+              - "(?:^|[\\s;&|])scp\\b"
+              - "(?:^|[\\s;&|])rsync\\s+\\S+@"
+          source: "library:tier1.subagent"
+
+      # =================================================================
+      # § 4 — Sub-agents may not write outside scratch / project paths
+      # =================================================================
+      #
+      # System paths (/etc, /var, ~/, /usr/) are out of scope for any
+      # sub-agent task; if the work product needs them, the main
+      # agent should do it with user visibility.
+
+      - desc: "Sub-agents may not write to system / user-home paths"
+        E:
+          pattern: arg_blacklist
+          args:
+            - write
+            - file_path
+            - - "^/(etc|var|usr|opt|root|boot)/"
+              - "^/Users/[^/]+/[^/]"             # macOS user home (any non-cwd)
+              - "^/home/[^/]+/[^/]"              # Linux user home
+              - "^~/"                            # tilde-expanded home
+              - "^[A-Za-z]:\\\\\\\\Users\\\\\\\\"  # Windows user home
+          source: "library:tier1.subagent"
+
+      - desc: "Sub-agents may not edit system / user-home paths"
+        E:
+          pattern: arg_blacklist
+          args:
+            - edit
+            - file_path
+            - - "^/(etc|var|usr|opt|root|boot)/"
+              - "^/Users/[^/]+/[^/]"
+              - "^/home/[^/]+/[^/]"
+              - "^~/"
+              - "^[A-Za-z]:\\\\\\\\Users\\\\\\\\"
+          source: "library:tier1.subagent"