[remigiusz-antczak]

This supersedes #1991, adding guard wave 5 and a third blind corpus. The destructive guard now sees commands hidden inside containers, remote shells, sqlite3, watch, parallel and Windows shells. On a corpus frozen before any of these rules existed, it blocks 48 of 60 dangerous commands, against 14 for hooks-mastery and 12 for safety-net.

Held-out-8 (blind, 60 dangerous / 60 benign)	Blocked	Benign blocked
Perun guard, wave 5 (27d1c7d63)	48/60	1/60
Perun guard, this PR after review fixes	49/60	1/60
Perun guard, #1991 (7503ea3)	41/60	2/60
claude-code-hooks-mastery, ported	14/60	7/60
claude-code-safety-net, ported subset	12/60 (2 unported)	0/60

• Held-out-9, a fourth blind corpus, written after these rules were final. It was pushed before scoring (prereg/heldout9, ffb22e7):

  • this PR: 55/60 blocked, 0/60 benign blocked;
  • main: 48/60 and 0/60;
  • hooks-mastery: 8/60 and 2/60;
  • safety-net: 9/60 and 0/60, with 1 row unported.

  The five misses are aws kms schedule-key-deletion, a clickhouse DROP TABLE, gem uninstall -aIx, diskutil apfs deleteContainer and tmutil delete.

• Preregistered. Held-out-8 was pushed before scoring (prereg/heldout8, e451111).

• Why 49 differs from 48. The fixes behind 49/60 came from an independent review that never saw the corpus. The extra block is a PowerShell Get-ChildItem | Remove-Item pipeline.

• Remaining misses (11). These are the leads for wave 6: tmutil delete, launchctl bootout chained with rm, perl remove_tree, make clean ROOT=/, cdk, doctl, flyctl, heroku and clickhouse deletes, hg strip, and an IFS split. The one false positive is find ./dist -name '*.map' -delete.

• Held-out-6 and 7 are now in-sample. The wave-5 rules were written against their misses. Their blind rows are pinned by test_security_gates_heldout{6,7}_blind.py:

  • held-out-6: 45/60 blind, 2/60 benign blocked;
  • held-out-7: 51/60 blind, 1/60 benign blocked.

Rule changes, waves 3 and 4 (as in #1991):

• Inner command checked: docker, podman and nerdctl exec/run; kubectl exec|run|debug; oc exec|debug|rsh; sqlite3 .shell, .system and .read |.
• Now blocked:
  • >> and tee onto system paths;
  • nested decode-then-execute;
  • the /private/* aliases for rm;
  • $VAR/.. write targets.

Rule changes, wave 5:

• Wrappers:
  • watch with any flags and a quoted or unquoted command;
  • parallel with a quoted command string, ::: or ::::;
  • nohup;
  • xargs -0 rm.
• Windows:
  • del and rd of drive roots and system directories;
  • format, including format.com;
  • diskpart;
  • bcdedit /delete;
  • reg delete with the hive in any position;
  • wmic ... delete and call format;
  • PowerShell Remove-Item -Recurse with flags in any order or fed by a pipeline.
• Secrets, VCS and data:
  • vault deletes;
  • gh api -X DELETE;
  • glab deletes;
  • mongosh deleteMany;
  • reflog expire plus gc;
  • cp onto system files;
  • openssl enc piped to a shell;
  • kubectl exec ... bash -c with a destructive inner command.
• Speed: the base64 scan went from 0.68 s to 0.04 s on the held-out-4 timing blob.

Review history:

• Wave 5 review: 3 🔴, all fixed: quoted watch and parallel commands, and Windows drive-root deletes.
• Re-review: 1 🔴, also fixed (watch -d and --interval before the command).
• Final review: 1 🔴, fixed: format c:\ /q slipped past because of the trailing backslash. del of %SystemRoot%, %windir% and \Windows paths is now blocked, and extension-scoped del *.tmp in the current directory is allowed.
• Folded into wave 6 (🟡):
  • kubectl run --overrides privileged pods;
  • sqlite ATTACH of non-system paths;
  • ln -sf and rsync onto /etc;
  • vault lease and token revoke;
  • git reflog delete;
  • chroot -u;
  • mongosh remove and deleteOne;
  • del wildcards that are still allowed: del *.* in the current directory, ..\ paths, %USERPROFILE%, non-system drives, and *.dll or *.sys under System32. Main blocks none of these either;
  • false positives on find . -prune | xargs -0 rm, on cp to /etc/*.bak and on del /s /q *.log.

#1991 failed CI on test_audit_skills because guard edits moved four finding fingerprints. All four are lines where the guard quotes the commands it blocks, and they are triaged with that reason.

Local gates:

• test_security_gates*.py: 16/16. test-destructive-guard.sh: 16/16. test_audit_skills: pass.
• ci-tests.d: pass, except three scripts that cannot run in the local sandbox: run-ledger (lsof), prepush-ci-parity (200 s timeout) and bench-check (needs origin/main).
• Size-ratchet: ok. bench_check: clean. git diff --check: clean. Privacy: clean.

🤖 Generated with Claude Code

https://claude.ai/code/session_014QNFFPWVcPUbeuvwM5fk2Z