{
  "_meta": {
    "what": "Dryx's destructive floor — the stop-set the runtime gate refuses before any policy is read. It holds even when the policy artifact is missing, stale, or forged, and it blocks in Observe and Enforce alike.",
    "why_published": "So the floor is a claim you can check, not a claim you take on faith. This file is compared element-for-element against the gate's own constants by scripts/check-floor-claims.py in the Dryx build; any drift between what this page says and what the gate does fails the build.",
    "source_of_truth": "The gate Dryx deploys to ~/.dryx/dryx-gate.py — readable Python on your own disk. Open it and compare.",
    "generated": "2026-08-19",
    "counts": { "patterns": 10, "shapes": 6, "safe_roots": 4 }
  },
  "shapes": [
    {
      "id": "rm_recursive_force",
      "plain": "A recursive, forced delete (rm -rf and its spellings). Two tiers: a target the gate resolves to a system or home location is refused outright; a target it cannot resolve at all (a variable, a substitution) becomes an operator question on harnesses that can ask, and stays refused where none can.",
      "patterns": [
        "\\brm\\s+-[a-z]*[rR][a-z]*[fF]",
        "\\brm\\s+-[a-z]*[fF][a-z]*[rR]",
        "\\brm\\s+(-[rR]\\s+-[fF]|-[fF]\\s+-[rR])",
        "\\brm\\b.*--recursive.*--force|\\brm\\b.*--force.*--recursive"
      ],
      "tier": "hard block when the target resolves to a system or home location; operator question when the target is unresolvable"
    },
    {
      "id": "dd_rawdisk",
      "plain": "dd writing to — or reading from — a raw disk device (/dev/sd, /dev/disk, /dev/rdisk, /dev/nvme, /dev/hd). /dev/zero, /dev/urandom and /dev/null are deliberately not matched: those are benign idioms.",
      "patterns": [
        "\\bdd\\b.*\\bof\\s*=\\s*/dev/(sd|disk|rdisk|nvme|hd)",
        "\\bdd\\s+.*\\bif\\s*=\\s*/dev/(sd|disk|rdisk|nvme|hd)"
      ],
      "tier": "hard block"
    },
    {
      "id": "mkfs",
      "plain": "Formatting a filesystem (mkfs.*). Formatting a device destroys everything on it; there is no safe agent-initiated variant.",
      "patterns": ["\\bmkfs\\.[a-z0-9]+"],
      "tier": "hard block"
    },
    {
      "id": "fork_bomb",
      "plain": "The classic shell fork-bomb literal. A shell structure with no sound downgrade, so even a quoted or echoed copy of the literal is refused — a deliberate, stated over-block.",
      "patterns": [":\\s*\\(\\s*\\)\\s*\\{[^}]*:\\|:[^}]*\\}\\s*;\\s*:"],
      "tier": "hard block, unconditional"
    },
    {
      "id": "rawdisk_redirect",
      "plain": "An unquoted shell redirect straight onto a raw disk device.",
      "patterns": [">\\s*/dev/(sd|disk|rdisk|nvme|hd)"],
      "tier": "hard block"
    },
    {
      "id": "chmod_777_root",
      "plain": "chmod -R 777 on the filesystem root — world-writable everything.",
      "patterns": ["\\bchmod\\s+-[a-z]*R[a-z]*\\s+777\\s+/($|\\s|[;&|#])"],
      "tier": "hard block"
    }
  ],
  "safe_roots": {
    "plain": "The only absolute roots a recursive delete may target without a question: the machine's temp trees. /var deliberately excludes everything except /var/folders (the macOS per-user temp).",
    "prefixes": ["/tmp/", "/var/folders/", "/private/tmp/", "/private/var/folders/"],
    "exact": ["/tmp", "/var/folders", "/private/tmp", "/private/var/folders"]
  },
  "propagation": {
    "plain": "A payload handed to a shell is treated as the command it is: `sh -c \"<payload>\"` and `echo '<payload>' | sh` re-run the same floor on the extracted literal payload, to a bounded depth.",
    "reparse_depth": 2
  },
  "parse_posture": {
    "plain": "The parser fails closed, and the receipt says so: a command too large to parse that carries any candidate pattern keeps its block, and a parse failure after a candidate match keeps the block.",
    "max_command_bytes": 262144
  },
  "ask_escalation": {
    "plain": "An operator question that cannot reach an operator never silently allows: when the harness has declared it will not prompt (bypass permissions), a question in these classes escalates to a refusal. executable_config_write is a policy-plane class, listed here because it shares the escalation rule — it is not one of the six floor shapes.",
    "classes": ["executable_config_write", "destructive_rm_unresolved"]
  },
  "receipts": {
    "plain": "Every floor decision writes a local receipt naming the shape that fired and how the parse reached the verdict — closed vocabularies, never the command text.",
    "parse_confidence_vocabulary": ["guard_confirmed", "guard_error", "candidate_error", "oversize", "reparse"]
  },
  "honest_residues": [
    "Unresolved-target recursive deletes are asked about (or refused where no one can be asked) rather than passed — this includes targets behind variables and relative targets under a cd the gate cannot resolve.",
    "The fork-bomb literal is refused even quoted or echoed; no sound downgrade exists.",
    "Oversized or unparseable commands carrying a candidate pattern keep the block — the conservative posture is the verdict, and the receipt marks it."
  ],
  "scope_notes": [
    "The floor is mode-blind: it blocks in Observe and Enforce alike, wherever the gate is armed. Turning Action Guard off is the only state without it.",
    "Dryx's policy plane — separate from this floor, operator-tunable, and softenable in Observe — can also refuse named installs and executable-config writes. That plane is not this file; this file is only the floor.",
    "Where the gate cannot run at all (no usable Python interpreter), all hook legs fail open; Dryx counts and shows that state rather than hiding it."
  ]
}