overview / blind spots
The law is judged by the operand a command names. These shapes destroy .rabadon/guard.json without naming it, so the gate never sees them — and closing them would fence you inside your own project.
| class | shapes |
|---|---|
| a walk that never spells the law's name | 15 |
| the tree deleted from outside, law and all | 4 |
| the tree moved away, law and all | 1 |
| the project root deleted by its own name | 1 |
The heading above is not deleted, because it was honest about what it looked at. It was wrong about how much it looked at. Seven was the count of the shapes somebody thought to type; it was never a measurement of the class, and nothing in the product could tell the difference — native/law_blind_test.sh checked only that every declared shape is really blind, which is the one direction that cannot see a blind shape you failed to declare. The arbiter produced eight more ALLOW + GONE shapes on 2026-08-30 and the suite stayed 10 passed / 0 failed.
Re-measured the same day, same two-column reading, over a committed corpus instead of a memory — native/lawblind_corpus.txt, 36 candidate shapes:
Two classes became four, and the two new ones are why a count is no substitute for a reading:
The first deletes nothing at all; the law simply stops being where the law lives. No rule about destruction was ever going to see it.
They are still not being closed, and that is still a decision. The second class is rm -rf ./old-project, which the section below promises will pass; the first is every recursive walk of a directory you own. A cut wide enough to catch them fences you inside your own project, which is worse than a hole named out loud — but the hole has to be named at its real size, and for a while it was named at a third of it.
So the hole is announced by the product rather than by this page: the blind spots: block on the session screen prints the count, every class name, one shape per class, and what to do about it. The screen is yours, not the agent's: on Claude Code it goes out as the hook's systemMessage, and the agent's context gets none of the shapes. The number there is not typed — it comes off the same compiled table as rabadon-gate --law-blind, and native/law_blind_test.sh runs every declared shape for real and goes red if one of them is actually refused, if the screen's number drifts from the table, if the list is padded with shapes the gate does refuse — and now, the arm that was missing, if the corpus turns up a shape that is blind and undeclared, or a declared row the corpus never re-measures. The two sets have to be the same set.
What to do: commit .rabadon/ to git. That copy survives all twenty-one, and git checkout .rabadon puts the law back. Under rabadon exec a protectedPaths entry is additionally fenced by the kernel.
An earlier phase published ls | xargs rm -rf as the example of this class. That was wrong and the sentence is corrected rather than deleted: ls without -a does not list a dotted name, so the shape is ALLOW but leaves the law THERE — measured on the same run above. The shapes on this page are the ones that really reach it.
native/law_blind_test.sh runs every line of native/lawblind_corpus.txt through the shipped binary and then for real in a throwaway project: whatever comes back allowed with the law gone must be declared, and whatever is declared must be in the corpus. The lines that are not blind are the control: