@sponsio/sdk 0.1.0 → 0.2.0-alpha.10

package/contracts/capability/destructive.yaml

@@ -0,0 +1,213 @@
+# =============================================================================
+# sponsio/contracts/capability/destructive.yaml
+#
+# Capability pack — destructive / irreversible operations that the
+# other capability packs don't already cover.  Two LTL shapes, both
+# using existing grounding atoms (``called_with``, ``count``,
+# ``count_with``).
+#
+#   § A — unconditional deny.  ``G: arg_blacklist(...)`` compiles to
+#         ``G(called_with(tool, param, regex) -> false)``.  No
+#         override path; the only way to allow is an operator
+#         ``overrides:`` with ``disabled: true``.
+#
+#   § B — gated by per-call confirm marker.  Raw LTL of the form
+#         ``G(called_with(<tool>, <regex>) ->
+#            count(confirm_destructive_action) >=
+#            count_with(<tool>, <regex>))``.
+#         Every destructive call must be matched by a fresh
+#         ``confirm_destructive_action`` marker — agent cannot
+#         reuse one confirm to cover multiple destructives.
+#         Violation = host adapter's choice of how to surface
+#         (deny / ask).  Mode A hosts (Claude Code,
+#         OpenClaw) translate to ``permissionDecision: ask`` /
+#         ``requireApproval`` independently of the contract layer.
+#
+# Scope (deliberately narrow):
+#
+#   This pack only covers categories the other capability packs
+#   miss.  Specifically, it does NOT re-cover:
+#
+#     - DROP / TRUNCATE / DELETE / dropdb / FLUSHALL / alembic
+#       downgrade base / data-dir deletes  ── ``database.yaml``
+#       already bans these unconditionally; a confirm-marker
+#       version would be strictly weaker.
+#     - rm -rf of system roots, dd, mkfs, fork bomb  ── ``shell.yaml``
+#       already bans these unconditionally.
+#     - SSH key / dotenv / credentials reads or overwrites  ──
+#       ``credentials.yaml`` / ``filesystem.yaml``.
+#
+#   What this pack adds is the *infra control plane*, *git history*,
+#   *mass-file*, and *MCP-tool* layers — categories where the blast
+#   radius is "wipe production" but the surface (cloud CLI / HTTP
+#   API / MCP tool / git mutation) isn't a shell builtin or SQL
+#   statement and so isn't caught by the existing packs.
+#
+# Real-world incidents this pack defends against:
+#
+#   - PocketOS / Cursor / Claude Opus 4.6 (2026-04-27): agent in
+#     staging deleted production Railway volume + all backups in
+#     9 seconds.  § B gating on the Railway CLI form
+#     (``railway volume delete``) AND the HTTP API form
+#     (``curl -X DELETE backboard.railway.app/...``) would have
+#     demanded a per-call confirm marker first.  The third form —
+#     in-process SDK call from a Python/Node script — sits outside
+#     the shell-tool boundary; catching that requires Mode B
+#     (`sponsio.Sponsio()` wrapping the agent loop where the SDK
+#     `delete_volume` tool call is visible directly).
+#   - claude-code issue #30475 (closed-as-duplicate, recurring):
+#     "Agent commits and pushes changes without waiting for user
+#     approval."  § B on force-push to protected branches.
+#
+# Marker convention:
+#   ``confirm_destructive_action`` is the integration's signal that
+#   the user has explicitly approved a destructive operation
+#   through the host UI.  Sub-agents are not expected to emit it
+#   directly — their work product flows back to the main agent,
+#   which surfaces an ``ask``-style confirmation prompt and emits
+#   the marker on user approval.  Without the marker, every § B
+#   call fails the per-call count comparison.
+#
+#   This marker is independent of ``shell.yaml``'s
+#   ``confirm_reconfirmed`` marker — each pack defines its own so
+#   a single user click can't unintentionally satisfy multiple
+#   distinct gates.
+#
+# Include via:
+#   include:
+#     - sponsio:capability/destructive
+#
+# Tool naming:
+#   The pack uses canonical ``exec`` for the shell tool.  Both
+#   ``_host.yaml`` and ``_host_subagent.yaml`` rename ``exec: Bash``;
+#   ``_host_openclaw.yaml`` uses canonical ``exec`` directly.  For
+#   plugin tools (``mcp__<server>__<tool>``) the rule references
+#   the namespaced name verbatim.
+#
+# Source tag convention:
+#   library:tier1.destructive.{always,confirm}
+# =============================================================================
+
+version: "1"
+
+tools:
+  - name: exec
+    description: "Shell command execution"
+    params: "command: str"
+  - name: confirm_destructive_action
+    description: "Marker tool the integration emits when the user explicitly approves a destructive operation."
+    params: "operation: str"
+
+agents:
+  "*":
+    contracts:
+
+      # ===================================================================
+      # § A — unconditional deny (G(¬destructive))
+      # ===================================================================
+
+      - desc: "Ban git history rewrites that obliterate state silently (filter-branch / filter-repo)"
+        G:
+          pattern: arg_blacklist
+          args:
+            - exec
+            - command
+            - - "\\bgit\\b[^|;&]*?\\bfilter-(branch|repo)\\b"
+        source: "library:tier1.destructive.always"
+
+      # ===================================================================
+      # § B — per-call confirm marker required
+      # ===================================================================
+      #
+      # LTL idiom:  G(called_with(t, r) ->
+      #               count(confirm_destructive_action)
+      #                  >= count_with(t, r))
+      #
+      # Every match of the destructive regex must be matched by a
+      # fresh confirm marker — confirms are not reusable across
+      # different destructive ops within the same session.
+
+      - desc: "git force-push to protected branches needs per-call confirm_destructive_action (PocketOS-class blast radius)"
+        G:
+          ltl: >-
+            G(called_with(exec, "\\bgit\\b[^|;&]*?\\bpush\\b[^|;&]*?(--force|--force-with-lease|\\s-f\\b)[^|;&]*?\\b(main|master|release|prod|production)\\b")
+              -> count(confirm_destructive_action)
+                  >= count_with(exec, "\\bgit\\b[^|;&]*?\\bpush\\b[^|;&]*?(--force|--force-with-lease|\\s-f\\b)[^|;&]*?\\b(main|master|release|prod|production)\\b"))
+        source: "library:tier1.destructive.confirm"
+
+      - desc: "git reset --hard / clean -fdx needs per-call confirm_destructive_action (drops local work)"
+        G:
+          ltl: >-
+            G(called_with(exec, "\\bgit\\b[^|;&]*?\\b(reset\\b[^|;&]*?\\b--hard|clean\\b[^|;&]*?\\b-[fdx]+)\\b")
+              -> count(confirm_destructive_action)
+                  >= count_with(exec, "\\bgit\\b[^|;&]*?\\b(reset\\b[^|;&]*?\\b--hard|clean\\b[^|;&]*?\\b-[fdx]+)\\b"))
+        source: "library:tier1.destructive.confirm"
+
+      - desc: "Cloud volume / cluster delete needs per-call confirm_destructive_action (PocketOS Railway pattern)"
+        G:
+          ltl: >-
+            G(called_with(exec, "\\b(railway\\s+(volume|service|environment|project)\\s+delete|aws\\s+ec2\\s+delete-volume|aws\\s+rds\\s+delete-(db-instance|db-cluster|db-snapshot)|aws\\s+s3\\s+rb|gcloud\\s+(sql|compute|container)\\s+\\S+\\s+delete|kubectl\\s+delete\\s+(pv|pvc|namespace|cluster)|fly\\s+(volumes|apps)\\s+destroy|heroku\\s+apps:destroy|terraform\\s+destroy|pulumi\\s+destroy|docker\\s+volume\\s+rm)\\b")
+              -> count(confirm_destructive_action)
+                  >= count_with(exec, "\\b(railway\\s+(volume|service|environment|project)\\s+delete|aws\\s+ec2\\s+delete-volume|aws\\s+rds\\s+delete-(db-instance|db-cluster|db-snapshot)|aws\\s+s3\\s+rb|gcloud\\s+(sql|compute|container)\\s+\\S+\\s+delete|kubectl\\s+delete\\s+(pv|pvc|namespace|cluster)|fly\\s+(volumes|apps)\\s+destroy|heroku\\s+apps:destroy|terraform\\s+destroy|pulumi\\s+destroy|docker\\s+volume\\s+rm)\\b"))
+        source: "library:tier1.destructive.confirm"
+
+      - desc: "GitHub MCP delete_repository needs per-call confirm_destructive_action"
+        G:
+          ltl: >-
+            G(called(mcp__github__delete_repository)
+              -> count(confirm_destructive_action) >= count(mcp__github__delete_repository))
+        source: "library:tier1.destructive.confirm"
+
+      - desc: "Railway MCP delete_volume needs per-call confirm_destructive_action (PocketOS pattern)"
+        G:
+          ltl: >-
+            G(called(mcp__railway__delete_volume)
+              -> count(confirm_destructive_action) >= count(mcp__railway__delete_volume))
+        source: "library:tier1.destructive.confirm"
+
+      - desc: "AWS MCP delete_volume needs per-call confirm_destructive_action"
+        G:
+          ltl: >-
+            G(called(mcp__aws__delete_volume)
+              -> count(confirm_destructive_action) >= count(mcp__aws__delete_volume))
+        source: "library:tier1.destructive.confirm"
+
+      - desc: "Supabase MCP delete_database needs per-call confirm_destructive_action"
+        G:
+          ltl: >-
+            G(called(mcp__supabase__delete_database)
+              -> count(confirm_destructive_action) >= count(mcp__supabase__delete_database))
+        source: "library:tier1.destructive.confirm"
+
+      - desc: "GitHub repo deletion via gh CLI needs per-call confirm_destructive_action"
+        G:
+          ltl: >-
+            G(called_with(exec, "\\b(gh\\s+repo\\s+delete|hub\\s+delete)\\b")
+              -> count(confirm_destructive_action)
+                  >= count_with(exec, "\\b(gh\\s+repo\\s+delete|hub\\s+delete)\\b"))
+        source: "library:tier1.destructive.confirm"
+
+      - desc: "Mass file delete (find -delete / xargs rm) needs per-call confirm_destructive_action"
+        G:
+          ltl: >-
+            G(called_with(exec, "\\bfind\\s+\\S+[^|;&]*?(\\s-delete|\\|\\s*xargs\\s+rm)\\b")
+              -> count(confirm_destructive_action)
+                  >= count_with(exec, "\\bfind\\s+\\S+[^|;&]*?(\\s-delete|\\|\\s*xargs\\s+rm)\\b"))
+        source: "library:tier1.destructive.confirm"
+
+      # PocketOS / Cursor (2026-04-27) almost certainly went through
+      # the Railway HTTP API, not the CLI — "single API call to
+      # Railway" is the operative wording.  curl / wget / httpie / xh
+      # carrying DELETE to known infra endpoints (Railway, AWS,
+      # GCP, Heroku, Fly, Vercel, DO, Linode, Cloudflare, Supabase)
+      # gates on the same confirm marker.  Generic curl with DELETE
+      # to arbitrary URLs is intentionally NOT gated here — too many
+      # legitimate REST API uses; users get the gate exactly where
+      # the blast radius is "wipe production infra".
+      - desc: "HTTP DELETE to cloud infra control planes needs per-call confirm_destructive_action (PocketOS API path)"
+        G:
+          ltl: >-
+            G(called_with(exec, "\\b(curl|wget|http|https|httpie|xh)\\b[^|;&]*?(-X\\s+DELETE|--request\\s+DELETE|\\sDELETE\\b)[^|;&]*?(railway\\.app|amazonaws\\.com|googleapis\\.com|heroku\\.com|fly\\.io|vercel\\.com|digitalocean\\.com|linode\\.com|cloudflare\\.com|supabase\\.co|planetscale\\.com|neon\\.tech|render\\.com|fly\\.dev|backboard\\.railway\\.app)")
+              -> count(confirm_destructive_action)
+                  >= count_with(exec, "\\b(curl|wget|http|https|httpie|xh)\\b[^|;&]*?(-X\\s+DELETE|--request\\s+DELETE|\\sDELETE\\b)[^|;&]*?(railway\\.app|amazonaws\\.com|googleapis\\.com|heroku\\.com|fly\\.io|vercel\\.com|digitalocean\\.com|linode\\.com|cloudflare\\.com|supabase\\.co|planetscale\\.com|neon\\.tech|render\\.com|fly\\.dev|backboard\\.railway\\.app)"))
+        source: "library:tier1.destructive.confirm"

package/contracts/capability/factual-claims.yaml

@@ -0,0 +1,79 @@
+# =============================================================================
+# sponsio/contracts/capability/factual-claims.yaml
+#
+# Capability pack — evidence obligations for factual claims.
+#
+# REQUIRES A SPONSIO CLOUD KEY. Verdicts are produced by the cloud
+# evidence API (POST /v1/evidence/verify); the runtime computes none of
+# them. The integration calls ``client.evidence.verify(...)`` and feeds
+# ``EvidenceResult.to_event(...)`` into the trace; that grounds three
+# atom families this pack composes:
+#
+#   claim_emitted(pred)             a claim of this predicate was emitted
+#   evidence_verdict(pred, V)       the server's verdict for it (PASS /
+#                                   MISMATCH / UNDERDETERMINED /
+#                                   NO_EVIDENCE / STALE /
+#                                   SOURCE_UNAVAILABLE /
+#                                   EXTRACTION_AMBIGUOUS)
+#   evidence_action(pred, a)        the server's policy action
+#                                   (release / block / clarify /
+#                                   re_resolve)
+#
+# Two shapes:
+#
+#   § A — claim_requires_evidence(pred):
+#         G(claim_emitted(pred) -> evidence_verdict(pred, PASS)).
+#         Any claim whose verdict is not PASS violates at the timestep
+#         the verdict lands.
+#
+#   § B — underdetermined_must_clarify(pred):
+#         G(evidence_verdict(pred, UNDERDETERMINED) ->
+#           evidence_action(pred, clarify)).
+#         Guards the policy wiring: ambiguous evidence must resolve to
+#         a clarify action, never a silent release.
+#
+# Without a cloud key no ``evidence`` events exist, both atom families
+# stay un-grounded, and every rule below is vacuously satisfied — the
+# pack does nothing rather than something wrong.
+#
+# The predicate names below are the two self-serve built-ins used across
+# the docs; replace them with the predicates your project actually
+# protects (GET /v1/evidence/predicates lists them).
+#
+# Include via:
+#   include:
+#     - sponsio:capability/factual-claims
+# =============================================================================
+
+agents:
+  "*":
+    contracts:
+
+      # ===================================================================
+      # § A — claims must verify (PASS or it doesn't ship)
+      # ===================================================================
+
+      - desc: "Weekday claims must match the calendar (cloud-verified)"
+        G:
+          pattern: claim_requires_evidence
+          args:
+            - date_weekday_agreement
+        source: "library:evidence.factual-claims"
+
+      - desc: "ZIP claims for a city must verify against reference data (cloud-verified)"
+        G:
+          pattern: claim_requires_evidence
+          args:
+            - city_zip_candidates
+        source: "library:evidence.factual-claims"
+
+      # ===================================================================
+      # § B — ambiguous evidence must clarify, never silently release
+      # ===================================================================
+
+      - desc: "Ambiguous city→ZIP evidence must trigger clarification"
+        G:
+          pattern: underdetermined_must_clarify
+          args:
+            - city_zip_candidates
+        source: "library:evidence.factual-claims"

package/contracts/capability/host-config-integrity.yaml

@@ -42,6 +42,10 @@
 #      — bash redirect / mutator forms that the self-modify pack
 #      doesn't currently match because its regex anchors on
 #      ``.sponsio/plugins/...`` paths only.
+#   6. ``truncate -s0 ~/.claude/settings.json`` / ``ln -sf /dev/null
+#      ~/.claude/settings.json`` / ``chmod 000 ~/.claude/settings.json``
+#      / ``rm -rf ~/.claude`` — no write at all, but the IDE reads an
+#      empty, foreign, or unreadable file and loads no hooks.
 #
 # What this pack denies:
 #
@@ -222,26 +226,55 @@ agents:
       # interpreter: ``echo '{}' > hooks.json``, ``cat /dev/null >
       # settings.json``, ``: > hooks.json``, ``sed -i 's/true/false/'
       # hooks.json``, ``tee hooks.json``, ``cp empty.json
-      # hooks.json``, ``mv x hooks.json``, ``rm hooks.json``.
+      # hooks.json``, ``mv x hooks.json``, ``rm hooks.json``,
+      # ``truncate -s0``, ``ln -sf /dev/null``, ``chmod 000``.
       #
-      # The pattern is "any of {redirect, sed, awk, tee, cp, mv,
-      # rm, install} adjacent to a hook-config path on the same
-      # command line". Read-only patterns (``cat hooks.json``,
-      # ``jq . hooks.json``, ``grep ... hooks.json``) are NOT
-      # matched — they don't carry a mutator verb in front of the
-      # path, so the alternation never triggers.
+      # The pattern is "a mutator verb, then anything up to the next
+      # pipe / separator, then a hook-config path on the same command
+      # line". The gap between verb and path is what ``~/``, ``$HOME/``,
+      # ``"${HOME}/``, and an absolute prefix sit in: an earlier version
+      # required the path to follow the redirect operator immediately,
+      # so ``> .claude/settings.json`` was denied and ``> ~/.claude/
+      # settings.json`` was not (reported by kta1kri, 2026-10).
+      # ``truncate``, ``ln``, ``chmod``, ``chown`` and ``chattr`` are
+      # mutators too: an emptied, replaced, or unreadable settings file
+      # removes the hook exactly as an edited one does.
+      #
+      # Read-only patterns (``cat hooks.json``, ``jq . hooks.json``,
+      # ``grep ... hooks.json``, ``jq . settings.json > /tmp/backup``)
+      # are NOT matched — they carry no mutator verb in front of the
+      # path, and a redirect to a different file stops at that file.
+      # ``cp`` with the file as the *source* does match; a backup is
+      # the price of catching ``cp empty.json settings.json``.
       #
       # Edge case: ``python ... > hooks.json`` is already caught
       # by §5 via the interpreter alternation. No double-deny harm
       # since this is the deny side of the contract anyway.
 
-      - desc: "Host agent must not redirect / sed / tee / mv / rm an IDE hook / MCP wiring file"
+      - desc: "Host agent must not redirect / sed / tee / mv / rm / truncate / ln / chmod an IDE hook / MCP wiring file"
+        G:
+          pattern: arg_blacklist
+          args:
+            - Bash
+            - command
+            - - ">{1,2}\\|?\\s*[^|&;<>\\n]*(\\.cursor/(hooks|mcp)\\.json|\\.claude/(settings(\\.local)?\\.json|hooks/[^\\s|]+)|\\.codex/hooks\\.json|\\.windsurf/hooks\\.json)"
+              - "\\b(tee|cp|mv|rm|install|truncate|ln|chmod|chown|chattr|shred|unlink|rsync|dd|sponge|patch|ed|ex|vi|vim|nvim)\\b[^|&;\\n]*(\\.cursor/(hooks|mcp)\\.json|\\.claude/(settings(\\.local)?\\.json|hooks/[^\\s|]+)|\\.codex/hooks\\.json|\\.windsurf/hooks\\.json)"
+              - "\\bsed\\b[^|&;\\n]*\\s-[a-zA-Z]*i[^|&;\\n]*(\\.cursor/(hooks|mcp)\\.json|\\.claude/(settings(\\.local)?\\.json|hooks/[^\\s|]+)|\\.codex/hooks\\.json|\\.windsurf/hooks\\.json)"
+              - "\\bawk\\b[^|&;\\n]*\\s-i[^|&;\\n]*(\\.cursor/(hooks|mcp)\\.json|\\.claude/(settings(\\.local)?\\.json|hooks/[^\\s|]+)|\\.codex/hooks\\.json|\\.windsurf/hooks\\.json)"
+          source: "library:tier1.host-config-integrity"
+
+      # The rules above name the wiring FILE. Removing, moving, or making
+      # unreadable the directory that holds it (``rm -rf ~/.claude``,
+      # ``chmod 000 ~/.claude``, ``mv .cursor /tmp``) takes the hook
+      # registration with it. The lookahead stops at the directory name
+      # so ``~/.claude-backup`` and ``.claude/commands/x.md`` stay open.
+      - desc: "Host agent must not remove, move, or lock the IDE config directory that holds the hook wiring"
         G:
           pattern: arg_blacklist
           args:
             - Bash
             - command
-            - - "(>\\s*|>>\\s*|\\btee\\b[^|\\n]*|\\bsed\\b\\s+-i[^|\\n]*|\\bawk\\b[^|\\n]*-i[^|\\n]*|\\bcp\\b[^|\\n]+|\\bmv\\b[^|\\n]+|\\brm\\b[^|\\n]+|\\binstall\\b[^|\\n]+)(\\.cursor/(hooks|mcp)\\.json|\\.claude/(settings(\\.local)?\\.json|hooks/[^\\s|]+)|\\.codex/hooks\\.json|\\.windsurf/hooks\\.json)"
+            - - "\\b(rm|rmdir|mv|chmod|chown|chattr|ln)\\b[^|&;\\n]*(\\.claude|\\.cursor|\\.codex|\\.windsurf)/?(?![\\w./-])"
           source: "library:tier1.host-config-integrity"
 
 # -----------------------------------------------------------------------------

package/contracts/capability/self-modify.yaml

@@ -40,8 +40,8 @@
 #     ``sponsio/contracts/**/*.yaml`` and the evaluation-engine
 #     Python files (``guard_stdin``, ``config``, ``core``, plus
 #     anything under ``runtime/``, ``patterns/``, ``formulas/``,
-#     ``tracer/``, ``integrations/``).  Without this, an agent can
-#     simply ``import sponsio; print(sponsio.__file__)`` to locate
+#     ``tracer/``, ``integrations/``, ``daemon/``, ``shim/``).  Without
+#     this, an agent can ``import sponsio; print(sponsio.__file__)`` to locate
 #     the package, then edit a capability bundle (or monkey-patch
 #     the loader) to delete the rule about to fire — bypassing the
 #     per-bucket protection above.
@@ -155,7 +155,7 @@ agents:
               # site-packages, --user installs, conda/venv all the same.
               - "(^|/)sponsio/contracts/[^/]+/[^/]+\\.yaml$"
               - "(^|/)sponsio/(guard_stdin|config|core)\\.py$"
-              - "(^|/)sponsio/(runtime|patterns|formulas|tracer|integrations)/[^/]+\\.py$"
+              - "(^|/)sponsio/(runtime|patterns|formulas|tracer|integrations|daemon|shim)/[^/]+\\.py$"
           source: "library:tier1.self-modify"
 
       # =================================================================
@@ -177,7 +177,7 @@ agents:
               - "(^|/)\\.sponsio/plugins/[^_/][^/]*/sponsio\\.yaml$"
               - "(^|/)sponsio/contracts/[^/]+/[^/]+\\.yaml$"
               - "(^|/)sponsio/(guard_stdin|config|core)\\.py$"
-              - "(^|/)sponsio/(runtime|patterns|formulas|tracer|integrations)/[^/]+\\.py$"
+              - "(^|/)sponsio/(runtime|patterns|formulas|tracer|integrations|daemon|shim)/[^/]+\\.py$"
           source: "library:tier1.self-modify"
 
       # =================================================================
@@ -194,7 +194,7 @@ agents:
               - "(^|/)\\.sponsio/plugins/[^_/][^/]*/sponsio\\.yaml$"
               - "(^|/)sponsio/contracts/[^/]+/[^/]+\\.yaml$"
               - "(^|/)sponsio/(guard_stdin|config|core)\\.py$"
-              - "(^|/)sponsio/(runtime|patterns|formulas|tracer|integrations)/[^/]+\\.py$"
+              - "(^|/)sponsio/(runtime|patterns|formulas|tracer|integrations|daemon|shim)/[^/]+\\.py$"
           source: "library:tier1.self-modify"
 
       # =================================================================
@@ -235,7 +235,7 @@ agents:
           args:
             - Write
             - content
-            - - "(?s)(?=.*(\\.sponsio/plugins/(_host[^/]*|[^_/][^/]*)/sponsio\\.yaml|sponsio/contracts/[^/]+/[^/]+\\.yaml|sponsio/(guard_stdin|config|core)\\.py|sponsio/(runtime|patterns|formulas|tracer|integrations)/[^/]+\\.py)).*(\\.write_text\\s*\\(|\\.write_bytes\\s*\\(|\\bf\\.write\\s*\\(|\\bopen\\s*\\([^)]*['\\\"][aw][\\+bxt]*['\\\"]\\s*\\)|\\bfs\\.(writeFileSync|appendFileSync|createWriteStream|writeFile)\\s*\\(|\\bFile\\.(open|write)\\s*\\(|\\b(IO|File)\\.write\\b)"
+            - - "(?s)(?=.*(\\.sponsio/plugins/(_host[^/]*|[^_/][^/]*)/sponsio\\.yaml|sponsio/contracts/[^/]+/[^/]+\\.yaml|sponsio/(guard_stdin|config|core)\\.py|sponsio/(runtime|patterns|formulas|tracer|integrations|daemon|shim)/[^/]+\\.py)).*(\\.write_text\\s*\\(|\\.write_bytes\\s*\\(|\\bf\\.write\\s*\\(|\\bopen\\s*\\([^)]*['\\\"][aw][\\+bxt]*['\\\"]\\s*\\)|\\bfs\\.(writeFileSync|appendFileSync|createWriteStream|writeFile)\\s*\\(|\\bFile\\.(open|write)\\s*\\(|\\b(IO|File)\\.write\\b)"
           source: "library:tier1.self-modify"
 
       - desc: "Host agent must not edit a script that mutates a sponsio guard config or engine file — use `sponsio plugin append`/`install`"
@@ -244,7 +244,7 @@ agents:
           args:
             - Edit
             - new_string
-            - - "(?s)(?=.*(\\.sponsio/plugins/(_host[^/]*|[^_/][^/]*)/sponsio\\.yaml|sponsio/contracts/[^/]+/[^/]+\\.yaml|sponsio/(guard_stdin|config|core)\\.py|sponsio/(runtime|patterns|formulas|tracer|integrations)/[^/]+\\.py)).*(\\.write_text\\s*\\(|\\.write_bytes\\s*\\(|\\bf\\.write\\s*\\(|\\bopen\\s*\\([^)]*['\\\"][aw][\\+bxt]*['\\\"]\\s*\\)|\\bfs\\.(writeFileSync|appendFileSync|createWriteStream|writeFile)\\s*\\(|\\bFile\\.(open|write)\\s*\\(|\\b(IO|File)\\.write\\b)"
+            - - "(?s)(?=.*(\\.sponsio/plugins/(_host[^/]*|[^_/][^/]*)/sponsio\\.yaml|sponsio/contracts/[^/]+/[^/]+\\.yaml|sponsio/(guard_stdin|config|core)\\.py|sponsio/(runtime|patterns|formulas|tracer|integrations|daemon|shim)/[^/]+\\.py)).*(\\.write_text\\s*\\(|\\.write_bytes\\s*\\(|\\bf\\.write\\s*\\(|\\bopen\\s*\\([^)]*['\\\"][aw][\\+bxt]*['\\\"]\\s*\\)|\\bfs\\.(writeFileSync|appendFileSync|createWriteStream|writeFile)\\s*\\(|\\bFile\\.(open|write)\\s*\\(|\\b(IO|File)\\.write\\b)"
           source: "library:tier1.self-modify"
 
       # =================================================================
@@ -280,7 +280,7 @@ agents:
             # across pipelines, but keeps ``;`` permitted because
             # Python's ``-c "..."`` payloads commonly use it as a
             # statement separator (``python -c "import x; x.do()"``).
-            - - "\\b(python|python2|python3|node|deno|bun|ruby|perl|php|lua|tclsh|R|Rscript)\\b[^|\\n]*(\\.sponsio/plugins/(_host[^/]*|[^_/][^/]*)/sponsio\\.yaml|sponsio/contracts/[^/]+/[^/]+\\.yaml|sponsio/(guard_stdin|config|core)\\.py|sponsio/(runtime|patterns|formulas|tracer|integrations)/[^/]+\\.py)"
+            - - "\\b(python|python2|python3|node|deno|bun|ruby|perl|php|lua|tclsh|R|Rscript)\\b[^|\\n]*(\\.sponsio/plugins/(_host[^/]*|[^_/][^/]*)/sponsio\\.yaml|sponsio/contracts/[^/]+/[^/]+\\.yaml|sponsio/(guard_stdin|config|core)\\.py|sponsio/(runtime|patterns|formulas|tracer|integrations|daemon|shim)/[^/]+\\.py)"
           source: "library:tier1.self-modify"
 
       # =================================================================
@@ -306,7 +306,7 @@ agents:
           args:
             - Bash
             - command
-            - - ">>?\\s*[^|&;]*(\\.sponsio/plugins/(_host[^/]*|[^_/][^/]*)/sponsio\\.yaml|sponsio/contracts/[^/]+/[^/]+\\.yaml|sponsio/(guard_stdin|config|core)\\.py|sponsio/(runtime|patterns|formulas|tracer|integrations)/[^/]+\\.py)"
+            - - ">{1,2}\\|?\\s*[^|&;<>\\n]*(\\.sponsio/plugins/(_host[^/]*|[^_/][^/]*)/sponsio\\.yaml|sponsio/contracts/[^/]+/[^/]+\\.yaml|sponsio/(guard_stdin|config|core)\\.py|sponsio/(runtime|patterns|formulas|tracer|integrations|daemon|shim)/[^/]+\\.py)"
           source: "library:tier1.self-modify"
 
       - desc: "Host agent must not `tee` into a sponsio guard config or engine file"
@@ -315,7 +315,7 @@ agents:
           args:
             - Bash
             - command
-            - - "\\btee\\b\\s+[^|&;]*(\\.sponsio/plugins/(_host[^/]*|[^_/][^/]*)/sponsio\\.yaml|sponsio/contracts/[^/]+/[^/]+\\.yaml|sponsio/(guard_stdin|config|core)\\.py|sponsio/(runtime|patterns|formulas|tracer|integrations)/[^/]+\\.py)"
+            - - "\\btee\\b\\s+[^|&;]*(\\.sponsio/plugins/(_host[^/]*|[^_/][^/]*)/sponsio\\.yaml|sponsio/contracts/[^/]+/[^/]+\\.yaml|sponsio/(guard_stdin|config|core)\\.py|sponsio/(runtime|patterns|formulas|tracer|integrations|daemon|shim)/[^/]+\\.py)"
           source: "library:tier1.self-modify"
 
       - desc: "Host agent must not `sed -i` a sponsio guard config or engine file"
@@ -324,7 +324,7 @@ agents:
           args:
             - Bash
             - command
-            - - "\\bsed\\b\\s+-i\\b[^|&;]*(\\.sponsio/plugins/(_host[^/]*|[^_/][^/]*)/sponsio\\.yaml|sponsio/contracts/[^/]+/[^/]+\\.yaml|sponsio/(guard_stdin|config|core)\\.py|sponsio/(runtime|patterns|formulas|tracer|integrations)/[^/]+\\.py)"
+            - - "\\bsed\\b\\s+-i\\b[^|&;]*(\\.sponsio/plugins/(_host[^/]*|[^_/][^/]*)/sponsio\\.yaml|sponsio/contracts/[^/]+/[^/]+\\.yaml|sponsio/(guard_stdin|config|core)\\.py|sponsio/(runtime|patterns|formulas|tracer|integrations|daemon|shim)/[^/]+\\.py)"
           source: "library:tier1.self-modify"
 
       - desc: "Host agent must not `cp` / `mv` / `rm` / `dd` against a sponsio guard config or engine file"
@@ -333,7 +333,53 @@ agents:
           args:
             - Bash
             - command
-            - - "\\b(cp|mv|rm|dd)\\b\\s+[^|&;]*(\\.sponsio/plugins/(_host[^/]*|[^_/][^/]*)/sponsio\\.yaml|sponsio/contracts/[^/]+/[^/]+\\.yaml|sponsio/(guard_stdin|config|core)\\.py|sponsio/(runtime|patterns|formulas|tracer|integrations)/[^/]+\\.py)"
+            - - "\\b(cp|mv|rm|dd)\\b\\s+[^|&;]*(\\.sponsio/plugins/(_host[^/]*|[^_/][^/]*)/sponsio\\.yaml|sponsio/contracts/[^/]+/[^/]+\\.yaml|sponsio/(guard_stdin|config|core)\\.py|sponsio/(runtime|patterns|formulas|tracer|integrations|daemon|shim)/[^/]+\\.py)"
+          source: "library:tier1.self-modify"
+
+      # A file can be emptied, replaced, or made unreadable without a
+      # write operator: ``truncate -s0``, ``ln -sf /dev/null``,
+      # ``chmod 000`` (reported by kta1kri, 2026-10, against the hook
+      # wiring; the rule file has the same exposure). The hook fails
+      # closed on an empty or unreadable library, so for the rule file
+      # these are denial of service rather than bypass, but they are
+      # the agent reaching for its own guard all the same.
+      - desc: "Host agent must not truncate / link over / lock a sponsio guard config or engine file"
+        G:
+          pattern: arg_blacklist
+          args:
+            - Bash
+            - command
+            - - "\\b(truncate|ln|chmod|chown|chattr|shred|unlink|install|rsync|sponge|patch|ed|ex|vi|vim|nvim)\\b\\s+[^|&;]*(\\.sponsio/plugins/(_host[^/]*|[^_/][^/]*)/sponsio\\.yaml|sponsio/contracts/[^/]+/[^/]+\\.yaml|sponsio/(guard_stdin|config|core)\\.py|sponsio/(runtime|patterns|formulas|tracer|integrations|daemon|shim)/[^/]+\\.py)"
+          source: "library:tier1.self-modify"
+
+      # The rules above name the rule FILE. Removing or moving a directory
+      # that contains it (``rm -rf ~/.sponsio``, ``mv ~/.sponsio/plugins
+      # /tmp``) took every library with it, after which each tool was
+      # "unconfigured" and ran, and ``defaults.unconfigured: deny`` went
+      # too, since it lives in the host library. The lookahead stops at
+      # the directory name so ``~/.sponsio-backup`` stays allowed.
+      - desc: "Host agent must not remove, move, or lock the sponsio config directory or a library bucket"
+        G:
+          pattern: arg_blacklist
+          args:
+            - Bash
+            - command
+            - - "\\b(rm|mv|rmdir|chmod|chown|chattr|ln)\\b[^|&;\\n]*\\.sponsio(/plugins(/[\\w-]+)?)?/?(?![\\w./-])"
+          source: "library:tier1.self-modify"
+
+      # The daemon holds a rule change that removes a contract until
+      # someone runs `sponsio rules reload`. At Tier 1 that someone could
+      # be the agent, approving its own weakening; the same goes for
+      # starting a daemon that applies every change (`--watch`), switching
+      # a host to observe, or removing the hooks. These belong to the
+      # person at their own terminal.
+      - desc: "Host agent must not approve its own rule changes, or switch Sponsio to observe or off"
+        G:
+          pattern: arg_blacklist
+          args:
+            - Bash
+            - command
+            - - "\\bsponsio\\b[^|&;\\n]*\\b(rules\\s+reload|admin\\b|daemon\\s+run\\b[^|&;\\n]*--watch|host\\s+uninstall|host\\s+install\\b[^|&;\\n]*--mode[\\s=]+observe)"
           source: "library:tier1.self-modify"
 
 # -----------------------------------------------------------------------------

package/contracts/capability/shell.yaml

@@ -65,10 +65,19 @@ agents:
             #   rm -rf /home/...  (direct home path)
             #   rm -rf /root/...
             #   rm -rf /Users/... (macOS home)
-            - - "rm\\s+-[rRf]+\\s+(/|\\$HOME|~)(\\s|;|&|\\||$)"
-              - "rm\\s+-[rRf]+\\s+/\\*"
-              - "rm\\s+-[rRf]+\\s+/(home|root|Users)"
-              - "rm\\s+-[rRf]+\\s+\\$\\{?HOME\\}?"
+            #
+            # Flag grammar: ``rm`` followed by any options, at least one
+            # of which is a short cluster containing r/R/f (``-rf``,
+            # ``-fr``, ``-Rfv``, ``-r -f``) or the long spelling
+            # (``--recursive`` / ``--force``), then any further options
+            # (``--no-preserve-root``, ``--``), then the target.
+            # ``arg_blacklist`` is a raw regex with no argv parsing, so
+            # the long forms must be spelled out here or
+            # ``rm --recursive --force /`` walks straight through.
+            - - "\\brm(?:\\s+(?:-[a-zA-Z]+|--[a-z-]+))*\\s+(?:-[a-zA-Z]*[rRf][a-zA-Z]*|--recursive|--force)(?:\\s+(?:-[a-zA-Z]+|--[a-z-]+|--))*\\s+(/|\\$HOME|~)/?(\\s|;|&|\\||$)"
+              - "\\brm(?:\\s+(?:-[a-zA-Z]+|--[a-z-]+))*\\s+(?:-[a-zA-Z]*[rRf][a-zA-Z]*|--recursive|--force)(?:\\s+(?:-[a-zA-Z]+|--[a-z-]+|--))*\\s+/\\*"
+              - "\\brm(?:\\s+(?:-[a-zA-Z]+|--[a-z-]+))*\\s+(?:-[a-zA-Z]*[rRf][a-zA-Z]*|--recursive|--force)(?:\\s+(?:-[a-zA-Z]+|--[a-z-]+|--))*\\s+/(home|root|Users)"
+              - "\\brm(?:\\s+(?:-[a-zA-Z]+|--[a-z-]+))*\\s+(?:-[a-zA-Z]*[rRf][a-zA-Z]*|--recursive|--force)(?:\\s+(?:-[a-zA-Z]+|--[a-z-]+|--))*\\s+\\$\\{?HOME\\}?"
           source: "library:tier1.shell"
 
       - desc: "Ban fork-bomb and obvious denial-of-service patterns"
@@ -124,8 +133,8 @@ agents:
           args:
             - exec
             - command
-            - - "\\\\\\n\\s*(sudo|su\\s|rm\\s+-[rRf]|dd\\s+if=|chmod\\s|chown\\s|mount\\s|curl\\s|wget\\s)"
-              - "\\\\\\r?\\n\\s*(sudo|su\\s|rm\\s+-[rRf]|dd\\s+if=|chmod\\s|chown\\s|mount\\s|curl\\s|wget\\s)"
+            - - "\\\\\\n\\s*(sudo|su\\s|rm\\s+(?:-[a-zA-Z]*[rRf][a-zA-Z]*|--recursive|--force)|dd\\s+if=|chmod\\s|chown\\s|mount\\s|curl\\s|wget\\s)"
+              - "\\\\\\r?\\n\\s*(sudo|su\\s|rm\\s+(?:-[a-zA-Z]*[rRf][a-zA-Z]*|--recursive|--force)|dd\\s+if=|chmod\\s|chown\\s|mount\\s|curl\\s|wget\\s)"
           source: "library:tier1.shell"
 
       - desc: "Ban undefined-variable-looking patterns that expand to empty in shell"
@@ -135,8 +144,8 @@ agents:
           args:
             - exec
             - command
-            - - "rm\\s+-[rRf]+\\s+\\{[^}]*\\}/?"
-              - "rm\\s+-[rRf]+\\s+\\$\\{[^}]*\\}/?"
+            - - "\\brm(?:\\s+(?:-[a-zA-Z]+|--[a-z-]+))*\\s+(?:-[a-zA-Z]*[rRf][a-zA-Z]*|--recursive|--force)(?:\\s+(?:-[a-zA-Z]+|--[a-z-]+|--))*\\s+\\{[^}]*\\}/?"
+              - "\\brm(?:\\s+(?:-[a-zA-Z]+|--[a-z-]+))*\\s+(?:-[a-zA-Z]*[rRf][a-zA-Z]*|--recursive|--force)(?:\\s+(?:-[a-zA-Z]+|--[a-z-]+|--))*\\s+\\$\\{[^}]*\\}/?"
           source: "library:tier1.shell"
 
       # =================================================================
@@ -235,5 +244,5 @@ agents:
 # - The LTL contracts in §3 and §4 depend on the `ltl:` schema field
 #   being supported by the config parser.  Until the LTL parser lands,
 #   these can be temporarily commented out; the arg_blacklist contracts
-#   in §1 and the arg_length_limit
-#   contracts in §2 work on current master.
+#   in §1 and the arg_length_limit contract in §2 work on current
+#   master.