{
  "_meta": {
    "what": "Dryx's destructive floor: the stop-set the runtime gate refuses before any policy is read. It holds even when the policy artifact is missing, stale, or forged, and it blocks in Observe and Enforce alike.",
    "why_published": "So the floor is a claim you can check, not a claim you take on faith. The six shapes and their tiers are printed here in plain words. The edges of the refusal (the exact match patterns, the safe-root paths, the re-parse depth, the size cap) are published as one fingerprint rather than printed, so this page is never the only readable copy of the boundary once the gate is signed native code. scripts/check-floor-claims.py recomputes that fingerprint from the gate's own constants in the gate test-suite and in CI; any drift between this page and the shipped gate fails that check.",
    "source_of_truth": "The gate Dryx deploys on your Mac. scripts/check-floor-claims.py compares this page (shapes, tiers, vocabularies, counts, and the edges fingerprint) to the shipped gate's constants; the same check runs in CI.",
    "generated": "2026-09-10",
    "ruling": "Shapes public, edges behind a published fingerprint (Ruling 3, 2026-09-10). Earlier versions of this page printed the patterns; that text is not recalled, but from this version the fingerprint is the checkable form.",
    "counts": {
      "patterns": 10,
      "shapes": 6,
      "safe_roots": 4
    }
  },
  "shapes": [
    {
      "id": "rm_recursive_force",
      "plain": "A recursive, forced delete (rm -rf and its spellings). Three tiers: a target the gate resolves to a system or home location is refused outright; a target it cannot resolve at all (a variable, a substitution, a directory change it cannot follow) becomes an operator question on harnesses that can ask, and stays refused where none can; a target inside the agent's own working directory that does not escape it is allowed as the operator's own cleanup inside the project, unless resolving it lands on the home folder itself, a top-level entry of it, or a system location, in which case it is refused like any home or system path.",
      "tier": "hard block when the target resolves to a system or home location; operator question when the target is unresolvable"
    },
    {
      "id": "dd_rawdisk",
      "plain": "dd writing to, or reading from, a raw disk device. The benign device idioms (zero, random, null) are deliberately not matched.",
      "tier": "hard block"
    },
    {
      "id": "mkfs",
      "plain": "Formatting a filesystem. Formatting a device destroys everything on it; there is no safe agent-initiated variant.",
      "tier": "hard block"
    },
    {
      "id": "fork_bomb",
      "plain": "The classic shell fork-bomb literal. A shell structure with no sound downgrade, so even a quoted or echoed copy of the literal is refused: a deliberate, stated over-block.",
      "tier": "hard block, unconditional"
    },
    {
      "id": "rawdisk_redirect",
      "plain": "An unquoted shell redirect straight onto a raw disk device.",
      "tier": "hard block"
    },
    {
      "id": "chmod_777_root",
      "plain": "A recursive world-writable permission change on the filesystem root.",
      "tier": "hard block"
    }
  ],
  "edges": {
    "plain": "The edges of the refusal are the exact match patterns behind each shape, the only absolute roots a recursive delete may target without a question (the machine's temporary trees), how deep the gate re-parses a command handed to a shell, and the size above which a command is treated as unparseable. They are not printed here. They are published as the fingerprint below, computed over the gate's own constants, so anyone can confirm the gate on their Mac carries exactly the edges this page vouches for without this page becoming the map.",
    "fingerprint": "sha256:649e965214cea3398eaac1694efbbe132b7715539fcc6fdc3413523b6f3955bb",
    "canonical_form": "json: sort_keys, separators (',',':'), ascii; keys rm_recursive_force, intrinsic_unconditional, safe_root_prefixes, safe_root_exact, max_command_bytes, reparse_depth",
    "how_to_verify": "python3 scripts/check-floor-claims.py --print-fingerprint, in the Dryx repository at the tagged release, prints the fingerprint the gate constants produce; the same script in CI fails if this page and the gate disagree."
  },
  "propagation": {
    "plain": "A payload handed to a shell is treated as the command it is: a command wrapped in a shell invocation, or piped into one, re-runs the same floor on the extracted payload, to a bounded depth that is part of the fingerprint."
  },
  "parse_posture": {
    "plain": "The parser fails closed, and the receipt says so: a command too large to parse that carries any candidate pattern keeps its block, and a parse failure after a candidate match keeps the block. The size limit is part of the fingerprint."
  },
  "ask_escalation": {
    "plain": "An operator question that cannot reach an operator never silently allows: when the harness has declared it will not prompt (bypass permissions), a question in these classes escalates to a refusal. executable_config_write is a policy-plane class, listed here because it shares the escalation rule; it is not one of the six floor shapes.",
    "classes": [
      "executable_config_write",
      "destructive_rm_unresolved"
    ]
  },
  "receipts": {
    "plain": "Every floor decision writes a local receipt naming the shape that fired and how the parse reached the verdict, in closed vocabularies, never the command text.",
    "parse_confidence_vocabulary": [
      "guard_confirmed",
      "guard_error",
      "candidate_error",
      "oversize",
      "reparse"
    ]
  },
  "policy_statements": [
    "A recursive delete whose target the gate cannot resolve is asked about, or refused where no one can be asked, never passed.",
    "A recursive delete that stays inside the agent's own project is treated as the operator's own cleanup and is allowed; a floor that refuses every in-project delete gets turned off within a week, and a floor that is off protects nobody. A target that is named, reaches above the project, or resolves to the home folder or one of its top-level entries is refused.",
    "The fork-bomb literal is refused even quoted or echoed; no sound downgrade exists.",
    "Oversized or unparseable commands carrying a candidate pattern keep the block; the conservative posture is the verdict, and the receipt marks it."
  ],
  "scope_notes": [
    "The floor is mode-blind: it blocks in Observe and Enforce alike, wherever the gate is armed. Turning Action Guard off is the only state without it.",
    "Dryx's policy plane, separate from this floor, operator-tunable, and softenable in Observe, can also refuse named installs and executable-config writes. That plane is not this file; this file is only the floor.",
    "Where the gate cannot run at all (no usable Python interpreter), all hook legs fail open; Dryx counts and shows that state rather than hiding it."
  ]
}