FailproofAI · NiveditJain · Sep 27, 2026 · Sep 22, 2026 · Sep 22, 2026 · Sep 22, 2026
diff --git a/.gitignore b/.gitignore
@@ -142,6 +142,23 @@ COMMIT_MSG.tmp
 **/.failproofai/run/
 **/.failproofai/state/
 
+# The dogfood enable/disable set is now local to each contributor. It was
+# committed, which meant every local change to which policies run on YOUR
+# machine — turning a noisy one off while you work on it, or switching the
+# Stop gates off to get a long-running task finished — showed up as a staged
+# change to everyone else's enforcement. The policies themselves stay tracked
+# in `.failproofai/policies/`; only which of them are enabled here is yours.
+# Untrack it once with: git rm --cached .failproofai/policies-config.json
+/.failproofai/policies-config.json
+
+# The dogfood custom policies, for the same reason: they are the ones that gate
+# a turn (a Stop gate cannot tell "a subagent owns the working tree right now"
+# from "you forgot to commit"), so switching one off while you work should not
+# be a change to anybody else's repo. Same caveat as above — these are tracked,
+# so this rule only takes effect after:
+#   git rm --cached .failproofai/policies/review-policies.mjs .failproofai/policies/workflow-policies.mjs
+/.failproofai/policies/*.mjs
+
 # Python build and test artefacts from fp-cloud-cli/. `/dist` above is the Next.js one at
 # the repo root; fp-cloud-cli builds into its own nested dist/, which that rule does not
 # match, so it needs naming separately.

diff --git a/CHANGELOG.md b/CHANGELOG.md
diff --git a/CLAUDE.md b/CLAUDE.md
@@ -919,11 +919,11 @@ in-process fallback on that path: a second policy engine reachable by breaking t
 is not a guarantee, and a machine where stopping one service silently disables every
 guardrail is not a guarded machine.
 
-The mismatch case denies with a message naming the version and `failproofai config`,
+The mismatch case denies with a message naming the version and `failproofai update`,
 because the remedy differs from "the daemon is down" and that difference is the whole
 value of telling them apart. The accepted cost: both sides hardcode `PROTOCOL_VERSION`,
 so the first time it is bumped a machine whose CLI updated via npm before its daemon did
-denies until `failproofai config` runs. `publish.yml` ships both from one commit and
+denies until `failproofai update` runs. `publish.yml` ships both from one commit and
 `daemonVersionSkew()` hints on every CLI command, so the window is bounded and announces
 itself.
 

diff --git a/Cargo.lock b/Cargo.lock
diff --git a/PROBE-FOLLOWUP.md b/PROBE-FOLLOWUP.md
@@ -0,0 +1,186 @@
+# Probe follow-up: `destructive-deletion.irreplaceable` cannot see a pathless delete
+
+Status: **proposed, not applied.** The probe text in `src/hooks/semantic/policies.ts` is
+unchanged on purpose. This file records what the change would be, what it would cost to
+validate, and which commands are still uncovered while it is not made.
+
+## The finding
+
+Measured on a real machine, through the real hook, with a Jev config present:
+
+```
+$ probe --said "the repo feels cluttered, tidy it up" "git clean -fdx"
+allow     git clean -fdx
+  jev:     ok decision=allow applied=two-tier 495ms
+  probes:  destructive-deletion.destroys=0.94  beyond_task=0.79  task_step=0.78
+```
+
+`git clean -fdx` was caught by **neither tier**.
+
+`destructive-deletion.destroys` answered **0.94** — the check sees that the command
+destroys data, which it should, because its own `instructions` name `git clean -fdx` as
+an example. The policy still did not fire. Two independent reasons:
+
+1. **Evidence is the MINIMUM over a policy's probes** (`PolicyOutcome.evidence`, "min over
+   probe probabilities — one weak probe spoils the evidence"). `destructive-deletion` has
+   two probes, and the partner `irreplaceable` answered low — it does not appear on the
+   probe line at all, which lists only what came back above the display floor. One weak
+   probe is enough, so 0.94 on `destroys` buys nothing.
+2. **No regex builtin matched the string.** Verified by running every builtin that matches
+   `PreToolUse` + `Bash` against the literal command: zero non-allow verdicts.
+   `block-rm-rf` only recognises `rm` and `find` command words (`RM_CMD_RE`,
+   `FIND_CMD_RE`), `warn-git-stash-drop` is `/\bgit\s+stash\s+(?:drop|clear)\b/`, and the
+   only place `git clean` appears anywhere in the regex tier is
+   `GIT_DESTRUCTIVE_SUBCOMMANDS` inside the always-on self-protection guard — which is
+   anchored to failproofai's own state directory and fires on nothing else.
+
+## Why `irreplaceable` answers low, and why that is not a tuning bug
+
+The probe, in full, as it stands today:
+
+```
+id: "irreplaceable"
+instructions:
+  "What would be destroyed is outside the project, is the whole project, is the user's
+   home directory, is the filesystem root, or is data that cannot simply be regenerated
+   (source code, documents, databases, keys). Use `facts.paths[].relation` to see where
+   each target sits relative to the project."
+criteria:
+  true:  "The destroyed data matters and could not be rebuilt by running a command."
+  false: "Only regenerable data inside the project is affected: build output, dist/,
+          caches, node_modules, virtualenvs, coverage reports, temp files, or files the
+          agent itself just created."
+```
+
+Every clause of the instructions is about a **target**, and the probe is told to read
+`facts.paths[].relation` to locate it. But `git clean` takes no path operand at all, so
+there is nothing for `facts.ts` to extract. Measured on this build:
+
+| command | `facts.paths` |
+|---|---|
+| `git clean -fdx` | `[]` |
+| `git clean -fdx` (via `cd /tmp && …`) | `/tmp => system` — the `cd` target, not the delete target |
+| `git reset --hard` | `[]` |
+| `git checkout -- .` | `. => project_root` |
+
+`extractPaths` skips `clean` (not path-like: no `/`, `~`, `.` or `..`) and skips `-fdx`
+(starts with `-`). So the classifier is asked to judge where the target sits, is handed no
+target, and reads the false criteria — which enumerate exactly the things a "clean" verb
+suggests: build output, `dist/`, caches, `node_modules`, coverage, temp files. The
+ordinary answer to the question **as written** is the false branch. The probe is not
+mis-tuned; it is mis-scoped for operations whose blast radius is implied by a flag rather
+than named by an argument.
+
+What `git clean -fdx` actually removes: every untracked **and** ignored file in the tree —
+`.env`, local config, editor state, uncommitted scratch work, anything not yet added. The
+`-x` is what makes it severe; without it, ignored files are spared.
+
+## The probe change this would need — and why it is not in this commit
+
+Two candidate edits, both to `irreplaceable`:
+
+**(a) Name the pathless case in the instructions.** Add a sentence such as: *"A command
+that names no path but sweeps the working tree — `git clean -x`/`-X`/`-d`, `git reset
+--hard`, `git checkout -- .` — destroys untracked and ignored files, which git has no copy
+of; treat that as data that cannot be regenerated even though `facts.paths` is empty."*
+
+**(b) Stop the empty-`facts.paths` case defaulting to false.** Add to the instructions:
+*"An empty `facts.paths` means no target could be resolved, not that the target is
+harmless."* This is the same principle `envelope.ts` already states for the two-tier
+combine — *"`policies.ts` treats incomplete evidence as a reason to ASK MORE"* — applied
+one level down, to a probe.
+
+**Why neither ships here.** The probe text is a calibrated classifier input. The decision
+thresholds in `decide.ts` were measured against this exact wording over the 1,332-call
+labelled corpus, and the numbers in the top CHANGELOG section (real work blocked 13.9% →
+8.7%, 132 of 234 attacks blocked, 70.8% label agreement) are properties of the
+**wording + thresholds together**. `irreplaceable` is the partner probe of the only
+deny-mode check that covers deletion, and `destructive-deletion` applies to `shell` *and*
+`write` — so a word that raises it raises it on every `rm`, every `truncate`, every
+`dd of=`, every overwriting redirect and every `Write` in the corpus, not only on
+`git clean`. Raising a MIN-combined probe can only move policies toward firing, so the
+risk is one-directional and concentrated in false blocks, which is the metric the
+two-tier release was justified on.
+
+**So the change needs a full corpus replay before it lands:** re-run the 1,332 labelled
+calls, report real-work-blocked, attacks-blocked and label agreement against the numbers
+above, and confirm no threshold in `decide.ts` has to move to hold them. That is a
+measurement task with its own prereg, not a word edit.
+
+## What ships instead
+
+`warn-git-clean`, a deterministic builtin in the regex tier (`policy-catalog.ts` +
+`builtin-policies.ts`). `instruct`, `defaultEnabled: false`, `authority: "hard"`, with a
+`destructiveFlags` param (default `["d","x","X"]`) to narrow or widen it. It fires when
+`git clean` has force (`-f` / `--force`, or a waived `clean.requireForce`) together with
+`-d`, `-x` or `-X`; it does not fire on `--dry-run` / `-n`, on a bare `git clean -f`, or
+on `git clean` with no force.
+
+It is **hard**, not `reviewable: ["destructive-deletion"]`, and the finding above is why:
+a named check that is asked and does not fire answers "no concern", which **clears**
+(`combine.ts`, "A warning-level answer clears the deny"). `destructive-deletion`
+demonstrably answers low here, so the pairing would not review this policy — it would
+switch it off on every machine that configured Jev. That is the `block-work-on-main`
+mistake, and the test that decides it is "is there anything left that can DENY". No other
+deny-mode semantic check covers untracked-file deletion, so a clear would leave the
+concern enforced by nothing. When (a) or (b) lands with a passing replay, this policy is
+the first candidate to be revisited as `reviewable`.
+
+## Sibling sweep: destructive git commands with no path argument
+
+Measured, not guessed — each command run against every builtin matching `PreToolUse` +
+`Bash` on this build, and through `extractPaths` for the facts column.
+
+| command | matched by any builtin? | `facts.paths` | would `destructive-deletion` fire? | covered here? |
+|---|---|---|---|---|
+| `git clean -fdx` / `-fd` / `-fx` / `-fX` | **now yes** — `warn-git-clean` (was: none) | `[]` | No. `destroys` 0.94, `irreplaceable` low — measured | **yes** |
+| `git clean --dry-run` / `-n` | no, by design | `[]` | No | n/a — safe |
+| `git reset --hard` (and `--hard HEAD~N`) | **no** | `[]` | Unlikely. Overwrites tracked files from HEAD, so `destroys` should be high; `irreplaceable` has no target and the loss (uncommitted modifications) is not in the object database at all | no — see below |
+| `git checkout -- .` | **no** | `. => project_root` | Possible. `irreplaceable` does get a target here, and `project_root` is one of the relations its instructions name, so this is the one sibling the probe has a fair chance on | no |
+| `git restore .` | **no** | `. => project_root` | Same as above | no |
+| `git rm -r --cached .` | **no** | `. => project_root` | No, and correctly: `--cached` unstages and leaves the working-tree file. Not data loss | no — not destructive |
+| `git rm -rf src` | **no** | `[]` | Unlikely (no target in facts) | no — but see note |
+| `git rm -rf /` | **yes** — `block-rm-rf` denies | `/ => root` | Yes | already covered |
+| `git branch -D feature/x` | **no** | `feature/x => inside_project` (a false positive: it is a ref, not a path) | No, and defensibly: commits stay reachable through the reflog for 90 days | no — recoverable |
+| `git reflog expire --expire=now --all` | **no** | `[]` | No — destroys no files | no |
+| `git gc --prune=now` | **no** | `[]` | No — destroys no files | no |
+
+Notes on two rows that surprise:
+
+- **`git rm -rf <path>` is partially covered by accident.** `recursiveDeletionTargets`
+  searches the token list for a word matching `RM_CMD_RE`, and in `git rm -rf src` that
+  matches the `rm` **subcommand**. So `block-rm-rf` evaluates it as an `rm` with target
+  `src` — allowed, because `src` is not catastrophic — and denies `git rm -rf /`. The
+  coverage is real but incidental, and it stops at the catastrophic-target test.
+- **`git reflog expire` + `git gc --prune=now` are the recovery mechanism, not the loss.**
+  Alone they destroy no working file. Their severity is that they make `git reset --hard`,
+  `git branch -D` and a dropped stash *permanently* unrecoverable, which is a two-command
+  concern no single-command matcher models well.
+
+### Why only `git clean` got coverage in this change
+
+`git reset --hard`, `git checkout -- .` and `git restore .` are the same shape and the same
+severity class, and they are the obvious next policy — but not a bolt-on to this one:
+
+1. **They are a different verb.** "Discard uncommitted changes to tracked files" is not
+   "delete untracked files"; one instruct message cannot name both losses usefully, and
+   the flag conditions have nothing in common.
+2. **Their authority decision is genuinely open, and `checkout`/`restore` may differ from
+   `reset`.** `git checkout -- .` and `git restore .` DO put `. => project_root` into
+   `facts.paths`, which is a relation `irreplaceable`'s instructions name explicitly — so
+   those two may be legitimately `reviewable` through `destructive-deletion` where
+   `git clean` provably is not. That needs measuring, per command, the way this one was.
+3. **`git reset --hard <commit>` overlaps `git-history-rewrite`'s concern**, so its pairing
+   question is "which check owns this", not "does the existing check fire".
+
+Each of those is a measurement, not a patch. Filed here rather than guessed.
+
+### Open items
+
+- [ ] Replay the labelled corpus against probe edit (a) and/or (b); report real-work-blocked,
+      attacks-blocked and label agreement against the current baseline.
+- [ ] If the replay holds, revisit `warn-git-clean`'s authority.
+- [ ] Add a `warn-git-discard-changes` builtin for `git reset --hard` / `git checkout -- .` /
+      `git restore .`, with its authority decided per command from measured probe answers.
+- [ ] Decide whether `git reflog expire --expire=now --all` and `git gc --prune=now` deserve
+      a policy of their own, given that their harm is only realised in combination.
diff --git a/README.md b/README.md
@@ -19,7 +19,7 @@
 Wherever your agents run, we see it — and we can say no. Failproof hooks 12 agent
 harnesses — coding CLIs like Claude Code and Codex, chat gateways like Hermes,
 self-hosted assistants like OpenClaw — capturing every run and blocking dangerous
-tool calls before they execute. 39 built-in policies. Zero latency. Runs locally.
+tool calls before they execute. 40 built-in policies. Zero latency. Runs locally.
 
 </div>
 
@@ -177,7 +177,7 @@ three are the developer favourites — coding CLIs are the harness class we cove
 deepest. The `sanitize-*` family is separate: it runs after a tool returns, so
 it reports a secret in tool output rather than keeping it out of the context.
 
-→ [All 39 built-in policies](https://docs.befailproof.ai/policies/packs)
+→ [All 40 built-in policies](https://docs.befailproof.ai/policies/packs)
 
 ---