{
 "generated_utc": "2026-08-03T17:25:24Z",
 "gate_commit": "74404c19431fd5b98ed7fa6a7b2d7aae45108a1e",
 "method": "Re-run of the census at the repaired gate. Every rule was judged by the real gate binary, standing in its own project, with the SAME probe the first census used — the probe is stored beside the rule so the measurement can be repeated. Each probe was driven through TWO binaries back to back in the same pass: the commit the published census was measured at (b384d6a) and HEAD, so the difference is the code and not the clock. A rule that did not answer in its own name got a second pass, alone in a scratch guard, to separate a dead rule from one a neighbour catches first. Nothing was executed: every probe is a PreToolUse event on stdin, asserted with a canary file the gate was asked to delete and did not. The generator is site/rule_census.py.",
 "headline": {
  "total": 430,
  "can_fire": 425,
  "cannot_fire": 0,
  "shadowed": 5,
  "undecided": 0,
  "guards": 61,
  "bash": 331,
  "protectedPaths": 99
 },
 "by_mechanism": [
  {
   "mechanism": "shadowed",
   "count": 5,
   "note": "The rule is capable — it refuses this command when it stands alone in a guard of its own — but an earlier rule in the same guard catches the same command first, so this id can never appear in a refusal."
  }
 ],
 "mechanisms_tested_and_not_found": [
  {
   "mechanism": "redirections",
   "claim": "every bash deny regex containing > is dead because the parser carries redirections separately from argv",
   "result": "NOT REPRODUCED at this commit. The structural laws in baseline.h read words only, but a deny REGEX reads Seg.surface, which still carries > >> and tee. 17 of the 18 bash rules on this machine whose pattern contains a redirection fire; the 18th is shadowed, not dead.",
   "evidence": "native/rule_census_test.sh section 2"
  },
  {
   "mechanism": "guard reach from a subdirectory",
   "claim": "gate.cpp reads the guard from the exact session cwd with no walk up, so from a subdirectory none of a project's rules load",
   "result": "REPAIRED at this commit. Re-measured with the same fixture shape, built inside a checked-out worktree so it sits under a `.git` (a fixture in the system temp area measures the deliberate absence of a bound, not the reach of the guard): at the project root old=reach-no-yarn new=reach-no-yarn; one directory down old=None new=reach-no-yarn; two down old=None new=reach-no-yarn. It never appeared in the per-rule census either way, because it switches every rule in a guard off at once rather than one rule.",
   "evidence": "census_run.py section 'guard reach'; native/guard_subdir_test.sh",
   "exposure": {
    "distinct_cwds_seen": 364,
    "events_at_a_guarded_project_root": 129673,
    "events_in_a_SUBDIRECTORY_of_a_guarded_project": 58369,
    "events_outside_any_guarded_project": 1249,
    "top_subdirectory_cwds": [
     {
      "project_root": "~",
      "cwd": "~/(withheld)",
      "events": 10282
     },
     {
      "project_root": "~",
      "cwd": "~/(withheld)",
      "events": 3472
     },
     {
      "project_root": "~",
      "cwd": "~/(withheld)",
      "events": 3292
     },
     {
      "project_root": "~",
      "cwd": "~/(withheld)",
      "events": 2403
     },
     {
      "project_root": "~",
      "cwd": "~/(withheld)",
      "events": 1671
     },
     {
      "project_root": "~",
      "cwd": "~/(withheld)",
      "events": 1307
     },
     {
      "project_root": "~",
      "cwd": "~/(withheld)",
      "events": 1056
     },
     {
      "project_root": "~",
      "cwd": "~/(withheld)",
      "events": 1046
     }
    ]
   },
   "exposure_note": "Of the Bash/tool events on this machine that ran inside a guarded project, 10.0% ran from a subdirectory where that project's own rules did not load (11,091 of 111,074). The home baseline guard is worse by construction: its root is $HOME, so it loads only when the cwd is exactly ~ — 61.4% of home-scoped work (47,278 of 76,980) ran with its 7 rules absent."
  }
 ],
 "protection_actually_lost": {
  "note": "A dead rule id does not always mean a dead protection: some have a second rule in the same guard that catches the file anyway. The rest have nothing behind them.",
  "dead_but_covered_by_a_sibling": [],
  "dead_and_uncovered": []
 },
 "incident_authored": {
  "total": 20,
  "can_fire": 18,
  "cannot_fire": 0,
  "dead": [],
  "note": "A rule marked authoredBy: incident was written because something really happened. A dead one means that thing can happen again."
 },
 "over_fires": {
  "note": "The other direction: rules that refuse work they were never written about. An allow twin is the author writing down what the rule must NOT catch. Every twin on this machine was re-run against BOTH binaries, because the repairs widen what a rule is matched against and a rule that starts refusing honest work costs more than one that never fires. The 26 ordinary and 50 benign commands are carried forward from the first census and were not re-run here.",
  "allow_twins_checked": 172,
  "allow_twins_withheld": 21,
  "allow_twins_withheld_note": "A git-push twin at a pushGate guard is not a judgement: gate.cpp forks a shell and RUNS the project's suite before deciding, so driving it executes cargo test / go test / (withheld) and moves lastTestVerified between the two binaries. Withheld from both runs so both binaries answer the same question.",
  "allow_twins_withheld_list": [
   {
    "project": "(withheld)",
    "id": "force-push-main",
    "command": "git push origin c1-naive"
   },
   {
    "project": "(withheld)",
    "id": "force-push-main",
    "command": "git push --force-with-lease origin main"
   },
   {
    "project": "(withheld)",
    "id": "force-push-main",
    "command": "git push --force origin c1-avx512-experiment"
   },
   {
    "project": "(withheld)",
    "id": "no-verify-bypass",
    "command": "git push origin c1-naive"
   },
   {
    "project": "(withheld)",
    "id": "no-force-push-main",
    "command": "git push origin feature/dewrites-cleanup"
   },
   {
    "project": "airflow",
    "id": "no-push-to-upstream",
    "command": "git push -u origin fix-dag-parsing"
   },
   {
    "project": "airflow",
    "id": "no-push-to-main",
    "command": "git push -u origin fix-dag-parsing"
   },
   {
    "project": "airflow",
    "id": "no-force-push-main",
    "command": "git push --force-with-lease origin fix-dag-parsing"
   },
   {
    "project": "crush",
    "id": "no-force-push-main",
    "command": "git push --force origin fix/hook-payload-carries-hook-event-name"
   },
   {
    "project": "crush",
    "id": "no-force-push-main",
    "command": "git push origin main"
   },
   {
    "project": "discourse",
    "id": "no-force-push-to-shared-branch",
    "command": "git push origin feature/my-branch --force"
   },
   {
    "project": "rails",
    "id": "no-force-push-main",
    "command": "git push origin main"
   },
   {
    "project": "rails",
    "id": "no-force-push-main",
    "command": "git push --force origin my-feature-branch"
   },
   {
    "project": "redis",
    "id": "no-force-push-main",
    "command": "git push --force origin my_branch"
   },
   {
    "project": "redis",
    "id": "no-force-push-main",
    "command": "git push origin unstable"
   },
   {
    "project": "redis",
    "id": "no-force-push-upstream-default",
    "command": "git push origin HEAD"
   },
   {
    "project": "terraform",
    "id": "no-force-push-main",
    "command": "git push origin main"
   },
   {
    "project": "terraform",
    "id": "no-force-push-main",
    "command": "git push --force-with-lease origin feature/state-migrate"
   },
   {
    "project": "(withheld)",
    "id": "no-force-push-main",
    "command": "git push origin feature/reports-index"
   }
  ],
  "allow_twins_refused": 1,
  "allow_twins_refused_at_b384d6a": 1,
  "absolute_spelling_twins_checked": 47,
  "absolute_spelling_twins_refused": 0,
  "absolute_spelling_twins_refused_at_b384d6a": 0,
  "confirmed": [
   {
    "project": "rabadon",
    "id": "no-rm-rf-outside",
    "command": "rm -rf ./native/gate_bench.dSYM",
    "exit": 2,
    "refused_by": "no-delete-native-binaries"
   }
  ],
  "confirmed_absolute_spelling": []
 },
 "by_project": [
  {
   "project": "(withheld)",
   "total": 236,
   "fires": 234,
   "cannot_fire": 0,
   "shadowed": 2,
   "bash": 191,
   "protectedPaths": 45,
   "incident": 0
  },
  {
   "project": "rabadon",
   "total": 16,
   "fires": 14,
   "cannot_fire": 0,
   "shadowed": 2,
   "bash": 12,
   "protectedPaths": 4,
   "incident": 11
  },
  {
   "project": "airflow",
   "total": 14,
   "fires": 13,
   "cannot_fire": 0,
   "shadowed": 1,
   "bash": 9,
   "protectedPaths": 5,
   "incident": 0
  },
  {
   "project": "goose",
   "total": 14,
   "fires": 14,
   "cannot_fire": 0,
   "shadowed": 0,
   "bash": 8,
   "protectedPaths": 6,
   "incident": 2
  },
  {
   "project": "redis",
   "total": 11,
   "fires": 11,
   "cannot_fire": 0,
   "shadowed": 0,
   "bash": 7,
   "protectedPaths": 4,
   "incident": 0
  },
  {
   "project": "terraform",
   "total": 9,
   "fires": 9,
   "cannot_fire": 0,
   "shadowed": 0,
   "bash": 3,
   "protectedPaths": 6,
   "incident": 0
  },
  {
   "project": "crush",
   "total": 8,
   "fires": 8,
   "cannot_fire": 0,
   "shadowed": 0,
   "bash": 4,
   "protectedPaths": 4,
   "incident": 0
  },
  {
   "project": "discourse",
   "total": 8,
   "fires": 8,
   "cannot_fire": 0,
   "shadowed": 0,
   "bash": 6,
   "protectedPaths": 2,
   "incident": 0
  },
  {
   "project": "rails",
   "total": 8,
   "fires": 8,
   "cannot_fire": 0,
   "shadowed": 0,
   "bash": 6,
   "protectedPaths": 2,
   "incident": 0
  },
  {
   "project": "(no project)",
   "total": 7,
   "fires": 7,
   "cannot_fire": 0,
   "shadowed": 0,
   "bash": 7,
   "protectedPaths": 0,
   "incident": 3
  }
 ],
 "rules": [
  {
   "project": "(no project)",
   "guard": "~/.rabadon/guard.json",
   "id": "no-force-push-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git push --force origin main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~",
   "gate_exit": 2,
   "refused_by": "no-force-push-main",
   "pattern": "git\\s+push[^|;&]*(--force|-f)\\b[^|;&]*\\b(main|master)\\b",
   "why": "baseline: force-pushing a shared branch destroys history",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-force-push-main",
   "changed": false
  },
  {
   "project": "(no project)",
   "guard": "~/.rabadon/guard.json",
   "id": "no-rm-rf-outside",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "rm -rf ~/(withheld)",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~",
   "gate_exit": 2,
   "refused_by": "no-rm-rf-outside",
   "pattern": "rm\\s+-\\w*[rf]\\w*\\s+(/(?!tmp)|~/(?!\\.)|\\$HOME)",
   "why": "baseline: recursive delete outside a project is unrecoverable",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-rm-rf-outside",
   "changed": false
  },
  {
   "project": "(no project)",
   "guard": "~/.rabadon/guard.json",
   "id": "no-hard-reset-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git reset --hard origin/main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~",
   "gate_exit": 2,
   "refused_by": "no-hard-reset-main",
   "pattern": "git\\s+reset\\s+--hard\\s+(origin/)?(main|master)\\b",
   "why": "baseline: rewrite shared state via commits, not resets",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-hard-reset-main",
   "changed": false
  },
  {
   "project": "(no project)",
   "guard": "~/.rabadon/guard.json",
   "id": "no-hook-bypass",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git commit --no-verify -m \"wip\"",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~",
   "gate_exit": 2,
   "refused_by": "no-hook-bypass",
   "pattern": "git\\s+(commit|push)[^|;&]*--no-verify",
   "why": "baseline: bypassing hooks bypasses every gate at once",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-hook-bypass",
   "changed": false
  },
  {
   "project": "(no project)",
   "guard": "~/.rabadon/guard.json",
   "id": "no-exit-code-after-pipe",
   "kind": "bash",
   "incident_authored": true,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "| tail echo exit=$?",
   "probe_source": "generated",
   "probe_tool": "Bash",
   "probe_cwd": "~",
   "gate_exit": 2,
   "refused_by": "no-exit-code-after-pipe",
   "pattern": "\\|\\s*(tail|head|grep|sed|awk)\\b[^\\n]*\\n?\\s*echo\\s+[\"']?exit=\\$\\?",
   "why": "`echo exit=$?` after a pipe reports the last pipe stage's status, not the command under test, so a RED suite reads as exit=0.",
   "verdict_at_b384d6a": "cannot-fire",
   "refused_by_at_b384d6a": null,
   "changed": true
  },
  {
   "project": "(no project)",
   "guard": "~/.rabadon/guard.json",
   "id": "no-gnu-timeout-on-macos",
   "kind": "bash",
   "incident_authored": true,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "timeout 5 make test",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~",
   "gate_exit": 2,
   "refused_by": "no-gnu-timeout-on-macos",
   "pattern": "(^|[;&|]\\s*)timeout\\s+\\d",
   "why": "macOS has no `timeout` binary; the command dies before the real work runs — use gtimeout or drop it.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-gnu-timeout-on-macos",
   "changed": false
  },
  {
   "project": "(no project)",
   "guard": "~/.rabadon/guard.json",
   "id": "no-reverse-patch-onto-head",
   "kind": "bash",
   "incident_authored": true,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git show 1234567 | git apply -R",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~",
   "gate_exit": 2,
   "refused_by": "no-reverse-patch-onto-head",
   "pattern": "git\\s+show\\s+[0-9a-f]{7,40}[^|]*\\|\\s*git\\s+apply\\s+(-R|--reverse)",
   "why": "Reverse-applying an old commit onto HEAD silently no-ops when the file has drifted, making a regression test look passing; use a worktree at the parent commit instead.",
   "verdict_at_b384d6a": "cannot-fire",
   "refused_by_at_b384d6a": null,
   "changed": true
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "force-push-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git push --force origin main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "force-push-main",
   "pattern": "^git\\b[^|;&]*\\bpush\\b(?=[^|;&]*(?:--force(?!-with-lease)|-f\\b))(?=[^|;&]*[\\s/](?:main|master)(?:\\s|$))",
   "why": "Mandatory guard: history on the shared main line is never rewritten; CLAUDE.md makes every checkpoint a public build-in-public artifact. --force-with-lease is the safe form and passes.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "force-push-main",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "rm-rf-outside-project",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "rm -rf ~/(withheld)",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "rm-rf-outside-project",
   "pattern": "^rm\\b(?=[^|;&]*\\s-{1,2}[a-z]*r)(?=[^|;&]*\\s-{1,2}[a-z]*f)(?=[^|;&]*\\s+(?:~|\\.\\.|\\$\\{?HOME|/(?!tmp/|var/tmp/|var/folders/)))",
   "why": "Mandatory guard: recursive force delete may only target paths inside the project tree or the machine temp area, never home or parent-traversal paths. $HOME is spelled out because the gate deliberately does not expand shell variables (threat-model.md) and this project's containment root IS ~ (git toplevel), so `rm -rf $HOME/...` otherwise reaches every sibling project and no baseline law sees it.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "rm-rf-outside-project",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "reset-hard-shared-branch",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git reset --hard origin/main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "reset-hard-shared-branch",
   "pattern": "^git\\b[^|;&]*\\breset\\b(?=[^|;&]*--hard\\b)(?=[^|;&]*[\\s/](?:main|master)(?:\\s|$))",
   "why": "Mandatory guard: a hard reset onto main/master discards shared checkpoint history that the proof rule depends on.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "reset-hard-shared-branch",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-unproven-speed-claim-in-commit",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git commit -m \"make it faster\"",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-unproven-speed-claim-in-commit",
   "pattern": "^git\\b[^|;&]*\\bcommit\\b[^|;&]*(faster|speedup|speed-up|h[iı]zland[iı])",
   "why": "CLAUDE.md kanit kurali: 'PROOF.md tablosu dolmadan hizlandi YOK' — a speed claim may not enter the history before the proof table carries it. Also catches `git -C <dir> commit` and the Turkish spelling with diacritics.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-unproven-speed-claim-in-commit",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-verify-bypass",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git commit --no-verify -m \"wip\"",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-verify-bypass",
   "pattern": "^git\\b[^|;&]*\\b(commit|push)\\b[^|;&]*--no-verify\\b",
   "why": "CLAUDE.md: every checkpoint passes through perf-proof-protocol.md — skipping the local verification hooks skips that gate. Also catches the `git -C <dir>` form.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-verify-bypass",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "proof-table-must-not-be-erased",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "rm PROOF.md",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "proof-table-must-not-be-erased",
   "pattern": "(^rm\\b[^|;&]*PROOF\\.md|^truncate\\b[^|;&]*PROOF\\.md|^mv\\b[^|;&]*PROOF\\.md|\\btee\\b(?!\\s+-a)(?!\\s+--append)[^|;&]*PROOF\\.md)",
   "why": "perf-proof-protocol.md 3: 'Kanit kalici: PROOF.md'ye tablo' and the baseline is held fixed across commits. Deleting, moving away or blanking PROOF.md destroys the only record a later speedup claim is measured against. KNOWN GAP, stated so nobody trusts more than is here: a shell redirect (`echo x > PROOF.md`) CANNOT be covered by any bash rule — the gate carries redirections separately from argv (native/baseline.h:561), so no deny regex ever sees a `>`, and baseline-truncating-redirect only fires when the target escapes the project root, which PROOF.md never does.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "proof-table-must-not-be-erased",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "proof-table-must-not-be-overwritten",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "cp x PROOF.md",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "proof-table-must-not-be-overwritten",
   "pattern": "^cp\\b[^|;&]*\\sPROOF\\.md\\s*$",
   "why": "perf-proof-protocol.md 3, the same law seen from the other side: copying a file ONTO PROOF.md replaces the baseline table without deleting anything, so it reads as an edit and is a total loss. Copying PROOF.md somewhere else is a backup and passes.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "proof-table-must-not-be-overwritten",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-claude-coauthor",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git commit -m \"fix the thing\n\nCo-Authored-By: Claude <noreply@anthropic.com>\"",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-claude-coauthor",
   "pattern": "git\\s+commit[\\s\\S]*(co-authored-by|claude-session|generated with claude)",
   "why": "Commit rules: author is Damla ONLY — never add a Claude co-author/session trailer or generated-with line",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-claude-coauthor",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-emoji-in-commit",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git commit -m \"ship it 🚀\"",
   "probe_source": "canonical (hand: the pattern is a UTF-16 surrogate range, which no python/C++ witness generator can emit; this is the real emoji it describes)",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-emoji-in-commit",
   "pattern": "git\\s+commit[\\s\\S]*-m[\\s\\S]*[\\uD800-\\uDBFF]",
   "why": "Commit rules: lowercase english, no emojis in commit messages (surrogate pair = emoji)",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-emoji-in-commit",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-force-push-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git push --force origin main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-force-push-main",
   "pattern": "git\\s+push(?=[\\s\\S]*(--force\\b|\\s-f\\b))(?=[\\s\\S]*\\b(main|master)\\b)",
   "why": "Baseline: never force-push to the shared main branch (a 6h bot also commits there)",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-force-push-main",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-rm-rf-outside-project",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "rm -rf ~/(withheld)",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-rm-rf-outside-project",
   "pattern": "rm\\s+(-[a-z]*r[a-z]*f|-[a-z]*f[a-z]*r)[a-z]*\\s+(\"?/|~|\\$HOME|\\.\\.)",
   "why": "Baseline: recursive force delete aimed at absolute~ paths is destructive and irreversible",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-rm-rf-outside-project",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-hard-reset-shared",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git reset --hard origin/main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-hard-reset-shared",
   "pattern": "git\\s+reset\\s+--hard\\s+(origin/)?(main|master)\\b",
   "why": "Baseline: hard reset on the shared branch destroys history the 6h pipeline bot depends on",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-hard-reset-shared",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-shell-edit-veri-html",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "sed -i \"\" s/a/b/ veri.html",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-shell-edit-veri-html",
   "pattern": "sed\\s+-i[\\s\\S]*veri\\.html",
   "why": "Trust layer: veri.html is auto-baked — change the baker, not the baked output",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-shell-edit-veri-html",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "veri-html-auto-baked",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/(withheld)",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "veri-html-auto-baked",
   "pattern": "(^|/)veri\\.html$",
   "why": "Law says veri.html is auto-baked by the trust layer; hand edits get overwritten — edit the generator instead",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "veri-html-auto-baked",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "claude-context-regenerable",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/(withheld)",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "claude-context-regenerable",
   "pattern": "(^|/)CLAUDE\\.context\\.md$",
   "why": "Marked 'deep machine context (auto, regenerable)' — generated file, do not hand-edit",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "claude-context-regenerable",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "force-push-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git push --force origin main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "force-push-main",
   "pattern": "git\\s+push(?=[\\s\\S]*(--force|\\s-f\\b))(?=[\\s\\S]*\\bmain\\b)",
   "why": "main auto-deploys (withheld).com live; force-pushing rewrites deployed history — always-deny baseline",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "force-push-main",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "rm-rf-outside-project",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "rm -rf ~/(withheld)",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "rm-rf-outside-project",
   "pattern": "rm\\s+(-[a-z]*(rf|fr)[a-z]*|-r\\s+-f|-f\\s+-r)\\s+(/|~|\\$HOME|\\.\\.)",
   "why": "destructive delete outside the project tree — always-deny baseline; asimetri: Damla pays for every loss",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "rm-rf-outside-project",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "reset-hard-shared-branch",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git reset --hard origin/main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "reset-hard-shared-branch",
   "pattern": "git\\s+reset\\s+--hard\\s+(origin/)?(main|master)\\b",
   "why": "destructive reset on the shared auto-deploying branch — always-deny baseline",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "reset-hard-shared-branch",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "commit-coauthor",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git commit -m \"fix the thing\n\nCo-Authored-By: Claude <noreply@anthropic.com>\"",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "commit-coauthor",
   "pattern": "git\\s+commit[\\s\\S]*co-authored-by",
   "why": "global git law: commit messages lowercase english, co-author ASLA",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "commit-coauthor",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "runtime-ai-dependency",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "npm install openai",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "runtime-ai-dependency",
   "pattern": "(npm|pnpm|yarn|bun)\\s+(install|add|i)\\s[\\s\\S]*(\\bopenai\\b|@anthropic-ai|@google/generative-ai|langchain)",
   "why": "law: NO runtime AI (real sources only), öner system runs on zero Claude tokens — installing an LLM SDK reintroduces it",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "runtime-ai-dependency",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "deleted-deps-reinstall",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "npm install supabase",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "deleted-deps-reinstall",
   "pattern": "(npm|pnpm|yarn|bun)\\s+(install|add|i)\\s[\\s\\S]*(supabase|framer-motion|polar)",
   "why": "2026-07-09 rework DELETED supabase/polar-premium/framer-motion and removed them from package.json — do not reintroduce",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "deleted-deps-reinstall",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "shell-write-contributors",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "sed -i \"\" s/a/b/ src/data/contributors.json",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "shell-write-contributors",
   "pattern": "(sed\\s+-i|tee|>{1,2})[^\\n]*src/data/contributors\\.json",
   "why": "contributors.json is written only by the onay GitHub Action (scripts/oneri.mjs); shell-editing it fakes the önerenler counter",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "shell-write-contributors",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "contributors-json",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/(withheld)",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "contributors-json",
   "pattern": "src/data/contributors\\.json$",
   "why": "generated by the approval Action; hand edits fabricate the 'N konu önerildi' counter — honesty law (kanıtla, iddia etme). Change scripts/oneri.mjs instead",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "contributors-json",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "claude-context-md",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/(withheld)",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "claude-context-md",
   "pattern": "CLAUDE\\.context\\.md$",
   "why": "marked 'deep machine context (auto, regenerable)' — regenerate it, don't hand-edit",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "claude-context-md",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-force-push-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git push --force origin main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-force-push-main",
   "pattern": "git\\s+push[^|;&]*(--force|-f)\\b[^|;&]*\\b(main|master)\\b",
   "why": "baseline: force-pushing a shared branch destroys history",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-force-push-main",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-rm-rf-outside",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "rm -rf ~/(withheld)",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-rm-rf-outside",
   "pattern": "rm\\s+-\\w*[rf]\\w*\\s+(/(?!tmp)|~/(?!\\.)|\\$HOME)",
   "why": "baseline: recursive delete outside the project is unrecoverable",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-rm-rf-outside",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-hard-reset-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git reset --hard origin/main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-hard-reset-main",
   "pattern": "git\\s+reset\\s+--hard\\s+(origin/)?(main|master)\\b",
   "why": "baseline: rewrite shared state via commits, not resets",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-hard-reset-main",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-hook-bypass",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git commit --no-verify -m \"wip\"",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-hook-bypass",
   "pattern": "git\\s+(commit|push)[^|;&]*--no-verify",
   "why": "baseline: bypassing hooks bypasses every gate at once",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-hook-bypass",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-force-push-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git push --force origin main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-force-push-main",
   "pattern": "git\\s+push\\b.*(\\s--force\\b|\\s-f\\b).*\\bmain\\b|git\\s+push\\b.*\\bmain\\b.*(\\s--force\\b|\\s-f\\b)",
   "why": "baseline safety: never force-push main",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-force-push-main",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-hard-reset-shared",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git reset --hard origin/main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-hard-reset-shared",
   "pattern": "git\\s+reset\\s+--hard\\s+(origin/)?(main|master)\\b",
   "why": "baseline safety: no destructive reset on shared branches",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-hard-reset-shared",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-rm-rf-outside-project",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "rm -rf ~/(withheld)",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-rm-rf-outside-project",
   "pattern": "rm\\s+(-[a-z]*r[a-z]*f|-[a-z]*f[a-z]*r)\\s+(/|~|\\$HOME|\\.\\.)",
   "why": "baseline safety: rm -rf outside the project tree",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-rm-rf-outside-project",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-coauthor-commits",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git commit -m \"fix the thing\n\nCo-Authored-By: Claude <noreply@anthropic.com>\"",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-coauthor-commits",
   "pattern": "git\\s+commit[\\s\\S]*co-authored-by",
   "why": "global git law: commit messages lowercase english, co-author ASLA",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-coauthor-commits",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-runtime-ai-deps",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "npm install openai",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-runtime-ai-deps",
   "pattern": "npm\\s+(install|i|add)\\s+[^&|;]*(\\bopenai\\b|@anthropic-ai|@google/generative|langchain)",
   "why": "CLAUDE.md What: NO runtime AI — 'AI çeker, üretmez'; installing an LLM SDK adds runtime AI",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-runtime-ai-deps",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-shell-edit-community-data",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "sed -i \"\" s/a/b/ src/data/contributors.json",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-shell-edit-community-data",
   "pattern": "(echo|sed|tee|cat)\\s+[^&|;]*src/data/(community|contributors)\\.json",
   "why": "suggestion pipeline: community.json/contributors.json are appended only by the onay Action, not hand-edited",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-shell-edit-community-data",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "community-json-workflow-only",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/(withheld)",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "community-json-workflow-only",
   "pattern": "src/data/community\\.json$",
   "why": "written by .github/workflows/suggestion.yml on Damla's onay label — hand edits bypass the approval flow",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "community-json-workflow-only",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "contributors-json-workflow-only",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/(withheld)",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "contributors-json-workflow-only",
   "pattern": "src/data/contributors\\.json$",
   "why": "written by the suggestion Action on approval — hand edits bypass the approval flow",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "contributors-json-workflow-only",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-force-push-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git push --force origin main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-force-push-main",
   "pattern": "git\\s+push(?=[\\s\\S]*(--force|\\s-f\\b))(?=[\\s\\S]*\\b(main|master)\\b)",
   "why": "baseline rule: never force-push to the main branch",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-force-push-main",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-rm-rf-outside-project",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "rm -rf ~/(withheld)",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-rm-rf-outside-project",
   "pattern": "rm\\s+-\\w*r\\w*\\s+(/(?!~/(withheld))|~|\\$HOME)",
   "why": "baseline rule: no recursive delete on absolute/home paths outside the project",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-rm-rf-outside-project",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-hard-reset-shared",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git reset --hard origin/main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-hard-reset-shared",
   "pattern": "git\\s+reset\\s+--hard\\s+(origin/)?(main|master)\\b",
   "why": "baseline rule: no destructive reset on shared branches",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-hard-reset-shared",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-coauthor-commit",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git commit -m \"fix the thing\n\nCo-Authored-By: Claude <noreply@anthropic.com>\"",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-coauthor-commit",
   "pattern": "git\\s+commit[\\s\\S]*co-authored-by",
   "why": "global law §6: commit messages carry no co-author, ever",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-coauthor-commit",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-pixel-fonts",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "pixelify x.png",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-pixel-fonts",
   "pattern": "pixelify",
   "why": "(withheld) type law: NO pixel fonts (Damla's call after trying Pixelify) — block fetching/installing it",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-pixel-fonts",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "worker-proxy-untouched",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/(withheld) proxy",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "worker-proxy-untouched",
   "pattern": "worker[-_ ]?proxy|proxy[-_ ]?worker",
   "why": "(withheld) law: Worker proxy untouched — Damla's backend domain, she writes the backend herself",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "worker-proxy-untouched",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "fonts-are-generated",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/(withheld)",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "fonts-are-generated",
   "pattern": "\\.(ttf|otf)$",
   "why": "(withheld) type law: font instances are regenerated via fontTools instancer, not hand-edited",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "fonts-are-generated",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-share-card-readd",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/(withheld) card",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-share-card-readd",
   "pattern": "share[-_ ]?card",
   "why": "(withheld) law: share card feature was deleted by Damla — do not re-add without a concrete reference from her",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-share-card-readd",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-remote-push",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git push --force origin main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-remote-push",
   "pattern": "git\\s+push(\\s|$)",
   "why": "Status law: 'no remote repo (local git only)' — nothing gets pushed anywhere",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-remote-push",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-remote-add",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git remote add origin git@github.com:x/y.git",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-remote-add",
   "pattern": "git\\s+remote\\s+(add|set-url)",
   "why": "Status law: 'no remote repo (local git only)' — creating a remote violates it",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-remote-add",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-force-push-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "shadowed",
   "mechanism": "shadowed",
   "mechanism_note": "The rule is capable — it refuses this command when it stands alone in a guard of its own — but an earlier rule in the same guard catches the same command first, so this id can never appear in a refusal.",
   "probe": "git push   --force main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-remote-push",
   "pattern": "git\\s+push\\s+\\S*\\s*.*(--force|\\s-f\\b).*(main|master)",
   "why": "Baseline: never force-push main (subsumed by no-remote-push, kept as defense in depth)",
   "verdict_at_b384d6a": "shadowed",
   "refused_by_at_b384d6a": "no-remote-push",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-destructive-rm",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "rm -rf ~",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-destructive-rm",
   "pattern": "rm\\s+-\\w*r\\w*\\s+([\"']?)(/|~|\\$HOME|\\.\\.)([\"']?)(\\s|$)",
   "why": "Baseline: recursive delete of root, home, or parent dirs is never sanctioned by any law",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-destructive-rm",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-hard-reset-shared",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git reset --hard origin/main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-hard-reset-shared",
   "pattern": "git\\s+reset\\s+--hard\\s+(origin/)?(main|master)",
   "why": "Baseline: destructive reset of a shared branch discards history",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-hard-reset-shared",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-package-install",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "npm install openai",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-package-install",
   "pattern": "(npm|pnpm|yarn|bun)\\s+(install|add|i)(\\s|$)",
   "why": "Law: 'zero install, zero network' single-file app — adding dependencies breaks the core contract",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-package-install",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "auto-context-file",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/(withheld)",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "auto-context-file",
   "pattern": "CLAUDE\\.context\\.md$",
   "why": "Marked '(auto, regenerable)' — regenerate it, never hand-edit",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "auto-context-file",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-sample-files",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/(withheld)",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-sample-files",
   "pattern": "\\.(wav|mp3|ogg|m4a|flac|aiff)$",
   "why": "Law: 'All sounds synthesized with Web Audio — no sample files'",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-sample-files",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-force-push-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git push --force origin main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-force-push-main",
   "pattern": "git\\s+push(?=[\\s\\S]*(--force|\\s-f\\b))(?=[\\s\\S]*\\b(main|master)\\b)",
   "why": "Standard guard: force push to main is destructive; the only sanctioned force push is the documented gh-pages subtree deploy (t:gh-pages), which this regex does not match.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-force-push-main",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-hard-reset-shared",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git reset --hard origin/main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-hard-reset-shared",
   "pattern": "git\\s+reset\\s+--hard\\s+(origin\\/)?(main|master|gh-pages)",
   "why": "Standard guard: hard reset on shared branches destroys the live deploy history the CLAUDE.md workflow depends on.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-hard-reset-shared",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-rm-rf-outside-project",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "rm -rf ~/(withheld)",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-rm-rf-outside-project",
   "pattern": "rm\\s+-[a-z]*r[a-z]*\\s+(~|\\/|\\$HOME)(?!\\S*damla_projects_2026)",
   "why": "Standard guard: recursive delete on absolute/home paths outside the project tree.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-rm-rf-outside-project",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-wrangler-deploy",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "wrangler deploy",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-wrangler-deploy",
   "pattern": "wrangler\\s+(deploy|publish|delete)",
   "why": "CLAUDE.md 'TEK DEPLOY DAMLA'DA' — worker deploy/silme Damla'nın işi ('DAMLA YAPACAK: cd backend && npx wrangler deploy'); agent asla wrangler deploy koşmaz.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-wrangler-deploy",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-headless-browser",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "node x.js --headless",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-headless-browser",
   "pattern": "--headless",
   "why": "CLAUDE.md og.png bölümü: 'headless Chrome yasak' — PNG export'u Damla tarayıcı/Figma ile yapar.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-headless-browser",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-localhost-server",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "python3 -m http.server 8000",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-localhost-server",
   "pattern": "python3?\\s+-m\\s+http\\.server|npx\\s+(serve|http-server|live-server)\\b",
   "why": "CLAUDE.md 'KURAL DEĞİŞTİ: artık LOCALHOST YOK' — her değişiklik gh-pages'e push edilip canlıda görülür; lokal server iterasyonu yasak.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-localhost-server",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-coauthor-commit",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git commit -m \"fix the thing\n\nCo-Authored-By: Claude <noreply@anthropic.com>\"",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-coauthor-commit",
   "pattern": "git\\s+commit[\\s\\S]*co-authored-by",
   "why": "Global KÖK YASA git kuralı: commit mesajında co-author ASLA.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-coauthor-commit",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "kvkk-consent-legal",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/(withheld)",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "kvkk-consent-legal",
   "pattern": "gizlilik\\.html$",
   "why": "CLAUDE.md: 'KVKK/consent metinlerine DOKUNULMADI (yasal)' — legal metin; Llama-mimari değişikliği dahil her düzenleme Damla'nın açık kararıyla olur.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "kvkk-consent-legal",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "og-png-damla-only",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/(withheld)",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "og-png-damla-only",
   "pattern": "og\\.png$",
   "why": "CLAUDE.md: 'PNG üretici yok + headless yasak → PNG'yi Damla üretmeli' — og.png agent tarafından yazılmaz/taklit edilmez, kaynak og.svg'dir.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "og-png-damla-only",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-force-push-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git push --force origin main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-force-push-main",
   "pattern": "git\\s+push\\s+[^\\n]*(--force(-with-lease)?|\\s-f\\b)[^\\n]*\\b(main|master)\\b",
   "why": "baseline safety: never force-push the shared main branch",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-force-push-main",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-hard-reset-shared",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git reset --hard origin/main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-hard-reset-shared",
   "pattern": "git\\s+reset\\s+--hard\\s+(origin\\/)?(main|master)\\b",
   "why": "baseline safety: no destructive reset on shared branches",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-hard-reset-shared",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-rm-rf-outside-project",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "rm -rf ~/(withheld)",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-rm-rf-outside-project",
   "pattern": "rm\\s+(-\\w+\\s+)*-\\w*(rf|fr)\\w*\\s+[\"']?(\\/|~|\\$HOME)",
   "why": "baseline safety: recursive delete on absolute/home paths reaches outside the project",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-rm-rf-outside-project",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-coauthor-commit",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git commit -m \"fix the thing\n\nCo-Authored-By: Claude <noreply@anthropic.com>\"",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-coauthor-commit",
   "pattern": "git\\s+commit[\\s\\S]*co-authored-by",
   "why": "global git law: commit messages lowercase english, co-author ASLA",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-coauthor-commit",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-repo-delete",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "gh repo delete nosey-dewdrop/x",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-repo-delete",
   "pattern": "gh\\s+repo\\s+delete",
   "why": "law: deleting the old Kitsch stub repo on GitHub needs Damla approval — no repo deletion without her",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-repo-delete",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-shell-edit-generated-context",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "sed -i \"\" s/a/b/ CLAUDE.context.md",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-shell-edit-generated-context",
   "pattern": "(>>?|\\btee\\b|sed\\s+-i)[^\\n]*claude\\.context\\.md",
   "why": "CLAUDE.context.md is marked auto/regenerable — change the generator, not the file, and not via shell redirection",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-shell-edit-generated-context",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "generated-claude-context",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/(withheld)",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "generated-claude-context",
   "pattern": "CLAUDE\\.context\\.md$",
   "why": "marked 'deep machine context (auto, regenerable)' — never hand-edit, regenerate instead",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "generated-claude-context",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-force-push-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git push --force origin main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-force-push-main",
   "pattern": "git\\s+push(?=[^;|&]*(--force(?!-with-lease)|\\s-f\\b))(?=[^;|&]*\\b(main|master)\\b)",
   "why": "site is LIVE on GitHub Pages from main — force-pushing main can destroy the published history (baseline safety rule)",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-force-push-main",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-rm-rf-outside-project",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "rm -rf ~/(withheld)",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-rm-rf-outside-project",
   "pattern": "rm\\s+-\\w*r\\w*\\s+[\"']?(~|\\$home|\\.\\.|\\/(?!users\\/home\\/damla_projects_2026\\/))",
   "why": "baseline safety rule: recursive delete outside the project tree is never sanctioned by any law here",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-rm-rf-outside-project",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-hard-reset-shared",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git reset --hard origin/main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-hard-reset-shared",
   "pattern": "git\\s+reset\\s+--hard\\s+[^;|&]*\\b(origin\\/)?(main|master)\\b",
   "why": "baseline safety rule: destructive reset of the shared live branch discards pushed work",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-hard-reset-shared",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-shell-edit-generated-context",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "sed -i \"\" s/a/b/ CLAUDE.context.md",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-shell-edit-generated-context",
   "pattern": "(>>?|\\bsed\\s+-\\w*i|\\btee\\b)[^;|&]*claude\\.context\\.md",
   "why": "CLAUDE.context.md is marked 'deep machine context (auto, regenerable)' — writing it via shell bypasses the generator",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-shell-edit-generated-context",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "claude-context-generated",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/(withheld)",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "claude-context-generated",
   "pattern": "(^|\\/)claude\\.context\\.md$",
   "why": "marked '(auto, regenerable)' in CLAUDE.md — change the generator/source, then regenerate; never hand-edit",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "claude-context-generated",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-force-push-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git push --force origin main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-force-push-main",
   "pattern": "git\\s+push(?=[\\s\\S]*(--force\\b|\\s-f\\b))(?=[\\s\\S]*\\b(main|master)\\b)",
   "why": "always-on gate: force-pushing main destroys shared history",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-force-push-main",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-rm-rf-outside-project",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "rm -rf ~/(withheld)",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-rm-rf-outside-project",
   "pattern": "\\brm\\s+(-\\w+\\s+)*-\\w*r\\w*\\s*(-\\w+\\s+)*[\"']?(~|\\$home|\\.\\.(/|\\s|$)|/(users|etc|var|usr|library|system|applications)?(/|\\s|$))",
   "why": "always-on gate: recursive delete of (withheld) paths is unrecoverable",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-rm-rf-outside-project",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-reset-hard-shared",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git reset --hard origin/main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-reset-hard-shared",
   "pattern": "git\\s+reset\\s+--hard\\s+(origin/)?(main|master)\\b",
   "why": "always-on gate: hard reset on the shared branch throws away pushed work",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-reset-hard-shared",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-coauthor-in-commits",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git commit -m \"fix the thing\n\nCo-Authored-By: Claude <noreply@anthropic.com>\"",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-coauthor-in-commits",
   "pattern": "git\\s+commit[\\s\\S]*co-authored-by",
   "why": "global git law: commit messages lowercase english, co-author ASLA",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-coauthor-in-commits",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-remove-treesprite",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "rm -rf treesprite",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-remove-treesprite",
   "pattern": "\\brm\\b[^|;&]*treesprite",
   "why": "CLAUDE.md ideas: tag-tree system (TreeSprite) — do not remove without asking Damla",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-remove-treesprite",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "claude-context-generated",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/(withheld)",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "claude-context-generated",
   "pattern": "CLAUDE\\.context\\.md$",
   "why": "marked 'deep machine context (auto, regenerable)' — regenerate it, never hand-edit",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "claude-context-generated",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "mj-raw-source-assets",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/(withheld)",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "mj-raw-source-assets",
   "pattern": "(^|/)mj-raw/",
   "why": "mj-raw/ holds Damla's raw Midjourney drops; Claude cuts copies out of it, never alters the raws",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "mj-raw-source-assets",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-shader-v1",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/(withheld)",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-shader-v1",
   "pattern": "\\.metal$",
   "why": "garden decision: NO texture-warp shader in v1 (Damla fears water-ripple feel); shader parked as later polish",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-shader-v1",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-force-push-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git push --force origin main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-force-push-main",
   "pattern": "git\\s+push[^|;&]*(--force|-f)\\b[^|;&]*\\b(main|master)\\b",
   "why": "baseline: force-pushing a shared branch destroys history",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-force-push-main",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-rm-rf-outside",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "rm -rf ~/(withheld)",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-rm-rf-outside",
   "pattern": "rm\\s+-\\w*[rf]\\w*\\s+(/(?!tmp)|~/(?!\\.)|\\$HOME)",
   "why": "baseline: recursive delete outside the project is unrecoverable",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-rm-rf-outside",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-hard-reset-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git reset --hard origin/main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-hard-reset-main",
   "pattern": "git\\s+reset\\s+--hard\\s+(origin/)?(main|master)\\b",
   "why": "baseline: rewrite shared state via commits, not resets",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-hard-reset-main",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-hook-bypass",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git commit --no-verify -m \"wip\"",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-hook-bypass",
   "pattern": "git\\s+(commit|push)[^|;&]*--no-verify",
   "why": "baseline: bypassing hooks bypasses every gate at once",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-hook-bypass",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-force-push-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git push --force origin main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-force-push-main",
   "pattern": "git\\s+push[^&|;]*(--force|\\s-f\\b)[^&|;]*\\b(main|master)\\b",
   "why": "Standard safety: never force-push to the main branch.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-force-push-main",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-rm-rf-outside-project",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "rm -rf ~/(withheld)",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-rm-rf-outside-project",
   "pattern": "rm\\s+(-[a-z]*r[a-z]*f|-[a-z]*f[a-z]*r)\\s+(/[^\\s]|~|\\$HOME)",
   "why": "Standard safety: no recursive delete on absolute/home paths outside the project.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-rm-rf-outside-project",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-hard-reset-shared",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git reset --hard origin/main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-hard-reset-shared",
   "pattern": "git\\s+reset\\s+--hard\\s+(origin/)?(main|master)\\b",
   "why": "Standard safety: no destructive reset on the shared main branch.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-hard-reset-shared",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-tailwind",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "npm install tailwindcss",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-tailwind",
   "pattern": "(npm|pnpm|yarn|bun)\\s+(i|install|add)\\b[^&|;]*\\btailwind",
   "why": "Tech stack law: 'No Tailwind (hand CSS is the house style)'.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-tailwind",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-state-libs",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "npm install redux",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-state-libs",
   "pattern": "(npm|pnpm|yarn|bun)\\s+(i|install|add)\\b[^&|;]*\\b(redux|zustand|mobx|jotai|recoil)\\b",
   "why": "Tech stack law: 'no state libraries until pain is real'.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-state-libs",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "landing-frozen",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/(withheld)",
   "probe_source": "generated (recovered from protection_actually_lost; the published census recorded null)",
   "probe_tool": "Edit",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "landing-frozen",
   "pattern": "^(\\./)?(index\\.html|style\\.css|script\\.js)$",
   "why": "Design law: 'UI FROZEN (Damla 2026-07-10)' — landing visuals are final, do not touch look/layout unless Damla explicitly asks.",
   "verdict_at_b384d6a": "cannot-fire",
   "refused_by_at_b384d6a": null,
   "changed": true
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-force-push-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git push --force origin main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-force-push-main",
   "pattern": "git\\s+push[^|;&]*(--force|-f)\\b[^|;&]*\\b(main|master)\\b",
   "why": "baseline: force-pushing a shared branch destroys history",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-force-push-main",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-rm-rf-outside",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "rm -rf ~/(withheld)",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-rm-rf-outside",
   "pattern": "rm\\s+-\\w*[rf]\\w*\\s+(/(?!tmp)|~/(?!\\.)|\\$HOME)",
   "why": "baseline: recursive delete outside the project is unrecoverable",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-rm-rf-outside",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-hard-reset-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git reset --hard origin/main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-hard-reset-main",
   "pattern": "git\\s+reset\\s+--hard\\s+(origin/)?(main|master)\\b",
   "why": "baseline: rewrite shared state via commits, not resets",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-hard-reset-main",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-hook-bypass",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git commit --no-verify -m \"wip\"",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-hook-bypass",
   "pattern": "git\\s+(commit|push)[^|;&]*--no-verify",
   "why": "baseline: bypassing hooks bypasses every gate at once",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-hook-bypass",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-force-push-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git push --force origin main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-force-push-main",
   "pattern": "git\\s+push[^|;&]*(\\s-f\\b|--force)[^|;&]*\\b(main|master)\\b|git\\s+push[^|;&]*\\b(main|master)\\b[^|;&]*(\\s-f\\b|--force)",
   "why": "Baseline safety: force-pushing main destroys shared history; always denied.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-force-push-main",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-rm-rf-outside-project",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "rm -rf ~/(withheld)",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-rm-rf-outside-project",
   "pattern": "rm\\s+-[a-z]*(rf|fr)[a-z]*\\s+(\"|')?(/|~|\\$HOME|\\.\\.)",
   "why": "Baseline safety: recursive delete targeting absolute, home, or parent paths reaches outside the project.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-rm-rf-outside-project",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-hard-reset-shared",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git reset --hard origin/main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-hard-reset-shared",
   "pattern": "git\\s+reset\\s+--hard\\s+(origin/)?(main|master)\\b",
   "why": "Baseline safety: hard reset on a shared branch silently discards work.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-hard-reset-shared",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-force-push-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git push --force origin main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-force-push-main",
   "pattern": "git\\s+push[^|;&]*(--force|-f)\\b[^|;&]*\\b(main|master)\\b",
   "why": "baseline: force-pushing a shared branch destroys history",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-force-push-main",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-rm-rf-outside",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "rm -rf ~/(withheld)",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-rm-rf-outside",
   "pattern": "rm\\s+-\\w*[rf]\\w*\\s+(/(?!tmp)|~/(?!\\.)|\\$HOME)",
   "why": "baseline: recursive delete outside the project is unrecoverable",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-rm-rf-outside",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-hard-reset-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git reset --hard origin/main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-hard-reset-main",
   "pattern": "git\\s+reset\\s+--hard\\s+(origin/)?(main|master)\\b",
   "why": "baseline: rewrite shared state via commits, not resets",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-hard-reset-main",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-hook-bypass",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git commit --no-verify -m \"wip\"",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-hook-bypass",
   "pattern": "git\\s+(commit|push)[^|;&]*--no-verify",
   "why": "baseline: bypassing hooks bypasses every gate at once",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-hook-bypass",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-force-push-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git push --force origin main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-force-push-main",
   "pattern": "git\\s+push\\b(?=[\\s\\S]*(--force\\b|\\s-f\\b))(?=[\\s\\S]*\\b(main|master)\\b)",
   "why": "Always-on gate: force-pushing main rewrites shared history irreversibly.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-force-push-main",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-rm-rf-outside-project",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "rm -rf ~/(withheld)",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-rm-rf-outside-project",
   "pattern": "rm\\s+(-\\w+\\s+)*-(\\w*r\\w*f|\\w*f\\w*r)\\w*\\s+(/|~|\\$HOME|\\.\\.)",
   "why": "Always-on gate: recursive delete aimed at absolute~ paths reaches outside the project.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-rm-rf-outside-project",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-hard-reset-shared",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git reset --hard origin/main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-hard-reset-shared",
   "pattern": "git\\s+reset\\s+--hard\\s+(origin\\/\\S+|main|master)\\b",
   "why": "Always-on gate: hard reset onto a shared branch destroys committed work.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-hard-reset-shared",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "epub-artifacts",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/(withheld)",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "epub-artifacts",
   "pattern": "\\.epub$",
   "why": "EPUBs are built from the kaynak markdowns in sources/ (Kurallar: gerçek/kaynaklı); change the source and rebuild, never hand-edit the artifact.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "epub-artifacts",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "force-push-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git push --force origin main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "force-push-main",
   "pattern": "git\\s+push(?=[\\s\\S]*(--force|\\s-f\\b))(?=[\\s\\S]*\\b(main|master)\\b)",
   "why": "baseline law: never force-push to the main branch",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "force-push-main",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "rm-rf-outside-project",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "rm -rf ~/(withheld)",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "rm-rf-outside-project",
   "pattern": "rm\\s+-[a-z]*r[a-z]*f?[a-z]*\\s+(/(?!Users\\/home)|~|\\$HOME|\\.\\.)",
   "why": "baseline law: destructive recursive delete outside the project tree is forbidden",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "rm-rf-outside-project",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "reset-hard-shared",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git reset --hard origin/main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "reset-hard-shared",
   "pattern": "git\\s+reset\\s+--hard\\s+(origin\\/)?(main|master)\\b",
   "why": "baseline law: no destructive resets on shared branches",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "reset-hard-shared",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-coauthor-commit",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git commit -m \"fix the thing\n\nCo-Authored-By: Claude <noreply@anthropic.com>\"",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-coauthor-commit",
   "pattern": "git\\s+commit(?=[\\s\\S]*co-authored-by)",
   "why": "global git law: commit messages lowercase english, co-author ASLA (never)",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-coauthor-commit",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "(withheld)-stays-private",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git commit -m \"(withheld)\"",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "(withheld)-stays-private",
   "pattern": "git\\s+(add|commit|push)(?=[\\s\\S]*(withheld))",
   "why": "portfolio law: (withheld)-abone stays PRIVATE (KVKK), never enters the public wall/repo",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "(withheld)-stays-private",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "claude-context-generated",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/(withheld)",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "claude-context-generated",
   "pattern": "CLAUDE\\.context\\.md$",
   "why": "marked 'deep machine context (auto, regenerable)' — regenerate it, never hand-edit",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "claude-context-generated",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-force-push-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git push --force origin main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-force-push-main",
   "pattern": "git\\s+push(?=.*\\s(-f|--force)(\\s|$))(?=.*\\b(main|master)\\b)",
   "why": "baseline gate: never force-push to the shared main branch",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-force-push-main",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-rm-rf-outside-project",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "rm -rf ~/(withheld)",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-rm-rf-outside-project",
   "pattern": "rm\\s+(-\\w+\\s+)*-\\w*(rf|fr)\\w*\\s+(\\/|~|\\$HOME|\\.\\.)",
   "why": "baseline gate: recursive force-delete on absolute~ paths reaches outside the project",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-rm-rf-outside-project",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-hard-reset-shared-branch",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git reset --hard origin/main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-hard-reset-shared-branch",
   "pattern": "git\\s+reset\\s+--hard\\s+(origin\\/)?(main|master)\\b",
   "why": "baseline gate: destructive reset on the shared branch loses work",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-hard-reset-shared-branch",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "claude-context-generated",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/(withheld)",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "claude-context-generated",
   "pattern": "(^|\\/)CLAUDE\\.context\\.md$",
   "why": "law marks it 'deep machine context (auto, regenerable)' — regenerate it, never hand-edit",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "claude-context-generated",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-force-push-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git push --force origin main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-force-push-main",
   "pattern": "git\\s+push[^|;&]*(--force|-f)\\b[^|;&]*\\b(main|master)\\b",
   "why": "force-pushing a shared branch destroys history",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-force-push-main",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-rm-rf-outside",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "rm -rf ~/(withheld)",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-rm-rf-outside",
   "pattern": "rm\\s+-\\w*[rf]\\w*\\s+(/(?!tmp)|~/(?!\\.)|\\$HOME)",
   "why": "recursive delete outside a project is unrecoverable",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-rm-rf-outside",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-hard-reset-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git reset --hard origin/main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-hard-reset-main",
   "pattern": "git\\s+reset\\s+--hard\\s+(origin/)?(main|master)\\b",
   "why": "rewrite shared state via commits, not resets",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-hard-reset-main",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-hook-bypass",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git commit --no-verify -m \"wip\"",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-hook-bypass",
   "pattern": "git\\s+(commit|push)[^|;&]*--no-verify",
   "why": "bypassing hooks bypasses every gate at once",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-hook-bypass",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "dewstock-no-inplace-rewrite",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "sed -i \"\" s/a/b/ dewrites.md",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "dewstock-no-inplace-rewrite",
   "pattern": "\\b(sed|perl|ruby)\\b[^;|&]*\\s-\\w*i\\w*\\s[^;|&]*\\b(dewrites|dewlog|dewthinks|dewideo|x-content-bank|oss-pr-defteri)[a-z0-9_.-]*\\.(md|txt)\\b",
   "why": "dewrites.md is 349 KB of prose with no generator behind it - one wrong in-place regex silently rewrites every entry and there is nothing to rebuild it from; read with sed, edit with an editor",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "dewstock-no-inplace-rewrite",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "dewstock-no-truncating-write",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "echo x > dewrites.md",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "dewstock-no-truncating-write",
   "pattern": "(^|[^>])>(?!>)\\s*[^\\s;|&>]*?(dewrites|dewlog|dewthinks|dewideo|x-content-bank|oss-pr-defteri)[a-z0-9_.-]*\\.(md|txt)\\b",
   "why": "a single redirect onto a content-stock file empties it before the command on the left ever runs; this stock is append-only work, so append is the only legitimate write",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "dewstock-no-truncating-write",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "dewstock-no-delete",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "rm dewrites.md",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "dewstock-no-delete",
   "pattern": "\\brm\\b[^;|&]*\\b(dewrites|dewlog|dewthinks|dewideo|x-content-bank|oss-pr-defteri)[a-z0-9_.-]*\\.(md|txt)\\b",
   "why": "the content stock and its _old/_verified snapshots are the only copies of Damla's writing; deleting one is not recoverable from this tree",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "dewstock-no-delete",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "dokunulmayan-is-frozen",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/(withheld)",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "dokunulmayan-is-frozen",
   "pattern": "(^|/)dewrites-dokunulmayan\\.txt$",
   "why": "the filename states the policy - dokunulmayan means untouched; this 382 KB snapshot is the pre-curation reference every later cut is measured against",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "dokunulmayan-is-frozen",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "kanit-bundle-is-captured-output",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/(withheld)",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "kanit-bundle-is-captured-output",
   "pattern": "(^|/)rabadon-show-hn-kanit/",
   "why": "these are captured gate/ledger outputs that rabadon-show-hn-verify.py derives its numbers from - hand-editing one makes the fact-check certify a claim no run ever produced; regenerate, never edit",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "kanit-bundle-is-captured-output",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "force-push-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git push --force origin main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "force-push-main",
   "pattern": "git\\s+push\\b.*(\\s--force|\\s-f)\\b.*\\b(main|master)\\b|git\\s+push\\b.*\\b(main|master)\\b.*(\\s--force|\\s-f)\\b",
   "why": "baseline: never force-push main",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "force-push-main",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "rm-rf-outside-project",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "rm -rf ~",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "rm-rf-outside-project",
   "pattern": "rm\\s+-[a-z]*r[a-z]*\\s+(\\/|~|\\$HOME|\\.\\.)(\\/)?(\\s|$)",
   "why": "baseline: destructive delete outside the project root",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "rm-rf-outside-project",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "reset-hard-shared",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git reset --hard origin/main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "reset-hard-shared",
   "pattern": "git\\s+reset\\s+--hard\\s+(origin\\/)?(main|master)\\b",
   "why": "baseline: no destructive reset on shared branches",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "reset-hard-shared",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-deps-no-backend",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "npm install openai",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-deps-no-backend",
   "pattern": "(npm|pnpm|yarn|bun)\\s+(i|install|add)\\s+\\S|npx\\s+create-",
   "why": "law: single-file web app, no backend, localStorage only — adding packages/scaffolds breaks the zero-dependency architecture",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-deps-no-backend",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "claude-context-generated",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/(withheld)",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "claude-context-generated",
   "pattern": "(^|\\/)CLAUDE\\.context\\.md$",
   "why": "marked 'deep machine context (auto, regenerable)' — regenerate it, never hand-edit",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "claude-context-generated",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-force-push-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git push --force origin main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-force-push-main",
   "pattern": "git\\s+push[^|;&]*(--force|-f)\\b[^|;&]*\\b(main|master)\\b",
   "why": "baseline: force-pushing a shared branch destroys history",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-force-push-main",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-rm-rf-outside",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "rm -rf ~/(withheld)",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-rm-rf-outside",
   "pattern": "rm\\s+-\\w*[rf]\\w*\\s+(/(?!tmp)|~/(?!\\.)|\\$HOME)",
   "why": "baseline: recursive delete outside the project is unrecoverable",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-rm-rf-outside",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-hard-reset-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git reset --hard origin/main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-hard-reset-main",
   "pattern": "git\\s+reset\\s+--hard\\s+(origin/)?(main|master)\\b",
   "why": "baseline: rewrite shared state via commits, not resets",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-hard-reset-main",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-hook-bypass",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git commit --no-verify -m \"wip\"",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-hook-bypass",
   "pattern": "git\\s+(commit|push)[^|;&]*--no-verify",
   "why": "baseline: bypassing hooks bypasses every gate at once",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-hook-bypass",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-force-push-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git push --force origin main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-force-push-main",
   "pattern": "git\\s+push[^|;&]*(--force|-f)\\b[^|;&]*\\b(main|master)\\b",
   "why": "baseline: force-pushing a shared branch destroys history",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-force-push-main",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-rm-rf-outside",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "rm -rf ~/(withheld)",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-rm-rf-outside",
   "pattern": "rm\\s+-\\w*[rf]\\w*\\s+(/(?!tmp)|~/(?!\\.)|\\$HOME)",
   "why": "baseline: recursive delete outside the project is unrecoverable",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-rm-rf-outside",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-hard-reset-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git reset --hard origin/main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-hard-reset-main",
   "pattern": "git\\s+reset\\s+--hard\\s+(origin/)?(main|master)\\b",
   "why": "baseline: rewrite shared state via commits, not resets",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-hard-reset-main",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-hook-bypass",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git commit --no-verify -m \"wip\"",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-hook-bypass",
   "pattern": "git\\s+(commit|push)[^|;&]*--no-verify",
   "why": "baseline: bypassing hooks bypasses every gate at once",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-hook-bypass",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "force-push-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git push --force origin main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "force-push-main",
   "pattern": "git\\s+push(?=.*(\\s--force\\b|\\s-f\\b))(?=.*\\b(main|master)\\b)",
   "why": "baseline rule: force-pushing main rewrites shared history",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "force-push-main",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "reset-hard-shared",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git reset --hard origin/main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "reset-hard-shared",
   "pattern": "git\\s+reset\\s+--hard\\s+(origin\\/)?(main|master)\\b",
   "why": "baseline rule: destructive reset on a shared branch loses work",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "reset-hard-shared",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "rm-rf-outside-project",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "rm -rf ~/(withheld)",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "rm-rf-outside-project",
   "pattern": "rm\\s+-[a-z]*(rf|fr)[a-z]*\\s+(~|\\$HOME\\b|\\.\\.|\\/(?!tmp\\/))",
   "why": "baseline rule: recursive delete outside the project tree is unrecoverable",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "rm-rf-outside-project",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "wasm-build-keeps-no-dynamic-execution",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "emcc x.c",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "wasm-build-keeps-no-dynamic-execution",
   "pattern": "\\bem(cc|\\+\\+)\\b(?![\\s\\S]*-sDYNAMIC_EXECUTION=0)",
   "why": "CLAUDE.md rules: any wasm rebuild MUST keep -sDYNAMIC_EXECUTION=0 (CSP embind eval breaks the site)",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "wasm-build-keeps-no-dynamic-execution",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "dancer-model-locked",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/(withheld)",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "dancer-model-locked",
   "pattern": "dancer\\.glb$",
   "why": "CLAUDE.md rules: dancer kept BARE at NATIVE transform (Damla's call); replacing it is a licensing decision for Damla, not an agent edit",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "dancer-model-locked",
   "changed": false
  },
  {
   "project": "airflow",
   "guard": "~/damla_projects_2026/katki/airflow/.rabadon/guard.json",
   "id": "no-host-pytest-python-airflow",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "python3 -m http.server 8000",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/damla_projects_2026/katki/airflow",
   "gate_exit": 2,
   "refused_by": "no-host-pytest-python-airflow",
   "pattern": "^\\s*(pytest|python3?|airflow)\\b",
   "why": "AGENTS.md/CLAUDE.md: 'Never run pytest, python, or airflow commands directly on the host — always use breeze' (or the documented `uv run --project ...` wrappers).",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-host-pytest-python-airflow",
   "changed": false
  },
  {
   "project": "airflow",
   "guard": "~/damla_projects_2026/katki/airflow/.rabadon/guard.json",
   "id": "no-conventional-commit-message",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git commit -m feat:",
   "probe_source": "generated",
   "probe_tool": "Bash",
   "probe_cwd": "~/damla_projects_2026/katki/airflow",
   "gate_exit": 2,
   "refused_by": "no-conventional-commit-message",
   "pattern": "git\\s+commit\\b.*\\s-m\\s+(feat|fix|chore|docs|refactor|style|test|perf|build|ci|revert)(\\([^)]*\\))?:",
   "why": "CLAUDE.md: Airflow does not use Conventional Commits; the `check-no-conventional-commit-message` prek hook and CI reject `fix:`/`feat:`/`chore:` subjects.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-conventional-commit-message",
   "changed": false
  },
  {
   "project": "airflow",
   "guard": "~/damla_projects_2026/katki/airflow/.rabadon/guard.json",
   "id": "no-agent-co-author",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git commit -m \"wip\" --trailer \"Co-Authored-By: Claude <noreply@anthropic.com>\"",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/damla_projects_2026/katki/airflow",
   "gate_exit": 2,
   "refused_by": "no-agent-co-author",
   "pattern": "git\\s+commit\\b.*co-authored-by",
   "why": "CLAUDE.md: 'NEVER add Co-Authored-By with yourself as co-author of the commit' — agents are assistants, not authors.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-agent-co-author",
   "changed": false
  },
  {
   "project": "airflow",
   "guard": "~/damla_projects_2026/katki/airflow/.rabadon/guard.json",
   "id": "no-skip-commit-hooks",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git commit --no-verify -m \"wip\"",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/damla_projects_2026/katki/airflow",
   "gate_exit": 2,
   "refused_by": "no-skip-commit-hooks",
   "pattern": "git\\s+commit\\b.*(--no-verify|\\s-n\\b)",
   "why": "CLAUDE.md: 'Always run prek install before committing' so the commit-msg guard runs locally; bypassing hooks defeats it.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-skip-commit-hooks",
   "changed": false
  },
  {
   "project": "airflow",
   "guard": "~/damla_projects_2026/katki/airflow/.rabadon/guard.json",
   "id": "no-push-to-upstream",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git push upstream main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/damla_projects_2026/katki/airflow",
   "gate_exit": 2,
   "refused_by": "no-push-to-upstream",
   "pattern": "git\\s+push\\b.*\\bupstream\\b",
   "why": "CLAUDE.md git remote conventions: 'Always push branches to origin. Never push directly to upstream.'",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-push-to-upstream",
   "changed": false
  },
  {
   "project": "airflow",
   "guard": "~/damla_projects_2026/katki/airflow/.rabadon/guard.json",
   "id": "no-push-to-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git push --force origin main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/damla_projects_2026/katki/airflow",
   "gate_exit": 2,
   "refused_by": "no-push-to-main",
   "pattern": "git\\s+push\\b.*\\s(main|master)\\b",
   "why": "CLAUDE.md: 'never push directly to main (on either remote)' — all work goes through a PR branch on the fork.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-push-to-main",
   "changed": false
  },
  {
   "project": "airflow",
   "guard": "~/damla_projects_2026/katki/airflow/.rabadon/guard.json",
   "id": "no-force-push-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "shadowed",
   "mechanism": "shadowed",
   "mechanism_note": "The rule is capable — it refuses this command when it stands alone in a guard of its own — but an earlier rule in the same guard catches the same command first, so this id can never appear in a refusal.",
   "probe": "git push --force main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/damla_projects_2026/katki/airflow",
   "gate_exit": 2,
   "refused_by": "no-push-to-main",
   "pattern": "git\\s+push\\b(?=.*--force)(?=.*\\bmain\\b)",
   "why": "Force-pushing the shared main branch rewrites published history; CLAUDE.md forbids destructive git operations unless explicitly requested.",
   "verdict_at_b384d6a": "shadowed",
   "refused_by_at_b384d6a": "no-push-to-main",
   "changed": false
  },
  {
   "project": "airflow",
   "guard": "~/damla_projects_2026/katki/airflow/.rabadon/guard.json",
   "id": "no-reset-hard-shared-branch",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git reset --hard origin/main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/damla_projects_2026/katki/airflow",
   "gate_exit": 2,
   "refused_by": "no-reset-hard-shared-branch",
   "pattern": "git\\s+reset\\s+--hard\\b.*\\b(origin/|upstream/)?(main|master|v\\d+-\\d+-test)\\b",
   "why": "CLAUDE.md Boundaries: never use destructive git operations unless explicitly requested; hard-resetting a shared/release branch discards work.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-reset-hard-shared-branch",
   "changed": false
  },
  {
   "project": "airflow",
   "guard": "~/damla_projects_2026/katki/airflow/.rabadon/guard.json",
   "id": "no-rm-rf-outside-project",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "rm -rf ~/(withheld)",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/damla_projects_2026/katki/airflow",
   "gate_exit": 2,
   "refused_by": "no-rm-rf-outside-project",
   "pattern": "\\brm\\s+-\\S*r\\S*\\s+(~|/(?!tmp|var/folders|Users/home/damla_projects_2026/katki/airflow))",
   "why": "Recursive deletes outside the worktree are unrecoverable and outside the scope of any task in this repo.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-rm-rf-outside-project",
   "changed": false
  },
  {
   "project": "airflow",
   "guard": "~/damla_projects_2026/katki/airflow/.rabadon/guard.json",
   "id": "uv-lock-is-tool-managed",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/damla_projects_2026/katki/airflow/uv.lock",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/damla_projects_2026/katki/airflow",
   "gate_exit": 2,
   "refused_by": "uv-lock-is-tool-managed",
   "pattern": "(^|/)uv\\.lock$",
   "why": "CLAUDE.md: uv.lock 'is generated by uv lock, uv sync' — regenerate it, never hand-edit; on conflict delete and run `uv lock`.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "uv-lock-is-tool-managed",
   "changed": false
  },
  {
   "project": "airflow",
   "guard": "~/damla_projects_2026/katki/airflow/.rabadon/guard.json",
   "id": "generated-dir",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/damla_projects_2026/katki/airflow/generated/",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/damla_projects_2026/katki/airflow",
   "gate_exit": 2,
   "refused_by": "generated-dir",
   "pattern": "(^|/)generated/",
   "why": "`generated/` holds tool-produced artifacts (e.g. generated/PYPI_README.md referenced from pyproject.toml); change the generator, not the output.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "generated-dir",
   "changed": false
  },
  {
   "project": "airflow",
   "guard": "~/damla_projects_2026/katki/airflow/.rabadon/guard.json",
   "id": "magpie-snapshot",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/damla_projects_2026/katki/airflow/.apache-magpie/",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/damla_projects_2026/katki/airflow",
   "gate_exit": 2,
   "refused_by": "magpie-snapshot",
   "pattern": "(^|/)\\.apache-magpie/",
   "why": "CLAUDE.md: the apache-magpie snapshot is fetched per .apache-magpie.lock — 'never edit the snapshot directly'; overrides go in .apache-magpie-overrides/.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "magpie-snapshot",
   "changed": false
  },
  {
   "project": "airflow",
   "guard": "~/damla_projects_2026/katki/airflow/.rabadon/guard.json",
   "id": "no-provider-newsfragments",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/damla_projects_2026/katki/airflow/providers/x/newsfragments/x",
   "probe_source": "generated (recovered from protection_actually_lost (+ file under the named directory); the published census recorded null)",
   "probe_tool": "Edit",
   "probe_cwd": "~/damla_projects_2026/katki/airflow",
   "gate_exit": 2,
   "refused_by": "no-provider-newsfragments",
   "pattern": "^providers/[^/]+/newsfragments/",
   "why": "CLAUDE.md: 'Never add newsfragments for providers/' — release managers regenerate the changelog from git log; edit providers/<provider>/docs/changelog.rst instead.",
   "verdict_at_b384d6a": "cannot-fire",
   "refused_by_at_b384d6a": null,
   "changed": true
  },
  {
   "project": "airflow",
   "guard": "~/damla_projects_2026/katki/airflow/.rabadon/guard.json",
   "id": "no-airflowctl-newsfragments",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/damla_projects_2026/katki/airflow/airflow-ctl/newsfragments/x",
   "probe_source": "generated (recovered from protection_actually_lost (+ file under the named directory); the published census recorded null)",
   "probe_tool": "Edit",
   "probe_cwd": "~/damla_projects_2026/katki/airflow",
   "gate_exit": 2,
   "refused_by": "no-airflowctl-newsfragments",
   "pattern": "^airflow-ctl/newsfragments/",
   "why": "CLAUDE.md: airflow-ctl does not consume newsfragments; user-visible notes go in airflow-ctl/RELEASE_NOTES.rst.",
   "verdict_at_b384d6a": "cannot-fire",
   "refused_by_at_b384d6a": null,
   "changed": true
  },
  {
   "project": "crush",
   "guard": "~/damla_projects_2026/katki/crush/.rabadon/guard.json",
   "id": "semantic-commit-required",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git commit --no-verify -m \"wip\"",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/damla_projects_2026/katki/crush",
   "gate_exit": 2,
   "refused_by": "semantic-commit-required",
   "pattern": "\\bgit\\s+commit\\b.*\\s-[a-z]*m\\s+(?!(fix|feat|chore|refactor|docs|sec|test|perf|build|ci|style|revert)\\b)",
   "why": "AGENTS.md Committing: ALWAYS use semantic commits (fix:, feat:, chore:, refactor:, docs:, sec:, etc).",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "semantic-commit-required",
   "changed": false
  },
  {
   "project": "crush",
   "guard": "~/damla_projects_2026/katki/crush/.rabadon/guard.json",
   "id": "no-force-push-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git push --force origin main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/damla_projects_2026/katki/crush",
   "gate_exit": 2,
   "refused_by": "no-force-push-main",
   "pattern": "\\bgit\\s+push\\b(?=.*(--force|-f\\b))(?=.*\\b(main|master)\\b)",
   "why": "Force-pushing the shared default branch (build.yml runs on push to main) destroys others' history.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-force-push-main",
   "changed": false
  },
  {
   "project": "crush",
   "guard": "~/damla_projects_2026/katki/crush/.rabadon/guard.json",
   "id": "no-reset-hard-shared-branch",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git reset --hard origin/main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/damla_projects_2026/katki/crush",
   "gate_exit": 2,
   "refused_by": "no-reset-hard-shared-branch",
   "pattern": "\\bgit\\s+reset\\b.*--hard\\b.*\\b(origin/)?(main|master)\\b",
   "why": "Hard-resetting the shared main branch discards work that CI and other contributors depend on.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-reset-hard-shared-branch",
   "changed": false
  },
  {
   "project": "crush",
   "guard": "~/damla_projects_2026/katki/crush/.rabadon/guard.json",
   "id": "no-rm-rf-outside-project",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "rm -rf ~/(withheld)",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/damla_projects_2026/katki/crush",
   "gate_exit": 2,
   "refused_by": "no-rm-rf-outside-project",
   "pattern": "\\brm\\s+-[a-z]*[rf][a-z]*\\s+(/|~|\\.\\.|\\$HOME)",
   "why": "Recursive delete targeting an absolute, home, or parent path reaches outside the crush working tree.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-rm-rf-outside-project",
   "changed": false
  },
  {
   "project": "crush",
   "guard": "~/damla_projects_2026/katki/crush/.rabadon/guard.json",
   "id": "golden-files-are-generated",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/damla_projects_2026/katki/crush/.golden",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/damla_projects_2026/katki/crush",
   "gate_exit": 2,
   "refused_by": "golden-files-are-generated",
   "pattern": "\\.golden$",
   "why": "AGENTS.md: golden files are regenerated with `go test ./... -update`, never hand-edited.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "golden-files-are-generated",
   "changed": false
  },
  {
   "project": "crush",
   "guard": "~/damla_projects_2026/katki/crush/.rabadon/guard.json",
   "id": "sqlc-generated-db-code",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/damla_projects_2026/katki/crush/internal/db/x.sql.go",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/damla_projects_2026/katki/crush",
   "gate_exit": 2,
   "refused_by": "sqlc-generated-db-code",
   "pattern": "internal/db/[^/]*\\.(sql\\.go|go)$",
   "why": "AGENTS.md: queries live in internal/db/sql/ and internal/db/*.go is sqlc-generated — edit the SQL, not the output.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "sqlc-generated-db-code",
   "changed": false
  },
  {
   "project": "crush",
   "guard": "~/damla_projects_2026/katki/crush/.rabadon/guard.json",
   "id": "go-sum-is-tool-managed",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/damla_projects_2026/katki/crush/go.sum",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/damla_projects_2026/katki/crush",
   "gate_exit": 2,
   "refused_by": "go-sum-is-tool-managed",
   "pattern": "(^|/)go\\.sum$",
   "why": "build.yml runs `go mod tidy` then `git diff --exit-code` — go.sum is produced by the toolchain, not by hand.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "go-sum-is-tool-managed",
   "changed": false
  },
  {
   "project": "crush",
   "guard": "~/damla_projects_2026/katki/crush/.rabadon/guard.json",
   "id": "cla-signatures-bot-managed",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/damla_projects_2026/katki/crush/.github/cla-signatures.json",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/damla_projects_2026/katki/crush",
   "gate_exit": 2,
   "refused_by": "cla-signatures-bot-managed",
   "pattern": "\\.github/cla-signatures\\.json$",
   "why": "cla.yml has the CLA Assistant action write path-to-signatures; humans must not edit the signature ledger.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "cla-signatures-bot-managed",
   "changed": false
  },
  {
   "project": "discourse",
   "guard": "~/damla_projects_2026/katki/discourse/.rabadon/guard.json",
   "id": "no-npm-or-yarn",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "npm install openai",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/damla_projects_2026/katki/discourse",
   "gate_exit": 2,
   "refused_by": "no-npm-or-yarn",
   "pattern": "^(npm|yarn)\\s+(i|install|ci|add|remove|run|exec|dlx)\\b",
   "why": "CLAUDE.md/AGENTS.md 'Use pnpm for JavaScript' plus package.json engines pinning npm/yarn to 'please-use-pnpm' and packageManager pnpm@10.28.0",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-npm-or-yarn",
   "changed": false
  },
  {
   "project": "discourse",
   "guard": "~/damla_projects_2026/katki/discourse/.rabadon/guard.json",
   "id": "prefer-bin-helpers-over-bundle-exec",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "bundle exec rspec",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/damla_projects_2026/katki/discourse",
   "gate_exit": 2,
   "refused_by": "prefer-bin-helpers-over-bundle-exec",
   "pattern": "^bundle\\s+exec\\s+(rspec|rake|rubocop)\\b",
   "why": "CLAUDE.md/AGENTS.md 'Use helpers in bin over bundle exec ((withheld), (withheld), (withheld))'",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "prefer-bin-helpers-over-bundle-exec",
   "changed": false
  },
  {
   "project": "discourse",
   "guard": "~/damla_projects_2026/katki/discourse/.rabadon/guard.json",
   "id": "no-skipping-git-hooks",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git commit --no-verify -m \"wip\"",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/damla_projects_2026/katki/discourse",
   "gate_exit": 2,
   "refused_by": "no-skipping-git-hooks",
   "pattern": "^git\\s+(commit|push)\\b.*\\s--no-verify\\b",
   "why": "CLAUDE.md requires (withheld) --fix before committing or pushing, and lefthook is the repo's hook runner (package.json devDependencies)",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-skipping-git-hooks",
   "changed": false
  },
  {
   "project": "discourse",
   "guard": "~/damla_projects_2026/katki/discourse/.rabadon/guard.json",
   "id": "no-force-push-to-shared-branch",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git push --force origin main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/damla_projects_2026/katki/discourse",
   "gate_exit": 2,
   "refused_by": "no-force-push-to-shared-branch",
   "pattern": "^git\\s+push\\b(?=.*(?:--force\\b|--force-with-lease\\b|\\s-f\\b))(?=.*\\b(?:main|master|stable)\\b)",
   "why": "main and stable are the CI-protected branches in .github/workflows/migration-tests.yml; history there is shared",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-force-push-to-shared-branch",
   "changed": false
  },
  {
   "project": "discourse",
   "guard": "~/damla_projects_2026/katki/discourse/.rabadon/guard.json",
   "id": "no-rm-rf-outside-project",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "rm -rf ~/(withheld)",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/damla_projects_2026/katki/discourse",
   "gate_exit": 2,
   "refused_by": "no-rm-rf-outside-project",
   "pattern": "^rm\\s+(?:-\\S+\\s+)*-\\S*[rf]\\S*\\s+(?!~/damla_projects_2026/katki/discourse)(?:/|~|\\.\\.)",
   "why": "Recursive force delete reaching an absolute, home, or parent path leaves the working tree",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-rm-rf-outside-project",
   "changed": false
  },
  {
   "project": "discourse",
   "guard": "~/damla_projects_2026/katki/discourse/.rabadon/guard.json",
   "id": "no-hard-reset-on-shared-branch",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git reset --hard origin/main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/damla_projects_2026/katki/discourse",
   "gate_exit": 2,
   "refused_by": "no-hard-reset-on-shared-branch",
   "pattern": "^git\\s+reset\\s+--hard\\b(?=.*\\b(?:origin/)?(?:main|master|stable)\\b)",
   "why": "Discards work on the branches CI publishes from (main, stable)",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-hard-reset-on-shared-branch",
   "changed": false
  },
  {
   "project": "discourse",
   "guard": "~/damla_projects_2026/katki/discourse/.rabadon/guard.json",
   "id": "pnpm-lockfile-is-tool-managed",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/damla_projects_2026/katki/discourse/pnpm-lock.yaml",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/damla_projects_2026/katki/discourse",
   "gate_exit": 2,
   "refused_by": "pnpm-lockfile-is-tool-managed",
   "pattern": "(^|/)pnpm-lock\\.yaml$",
   "why": "CI runs pnpm install --frozen-lockfile; the lockfile is regenerated by pnpm, never hand-edited",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "pnpm-lockfile-is-tool-managed",
   "changed": false
  },
  {
   "project": "discourse",
   "guard": "~/damla_projects_2026/katki/discourse/.rabadon/guard.json",
   "id": "gemfile-lock-is-tool-managed",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/damla_projects_2026/katki/discourse/Gemfile.lock",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/damla_projects_2026/katki/discourse",
   "gate_exit": 2,
   "refused_by": "gemfile-lock-is-tool-managed",
   "pattern": "(^|/)Gemfile\\.lock$",
   "why": "CI installs with bundle deployment=true against the committed lock; change Gemfile and let bundler regenerate",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "gemfile-lock-is-tool-managed",
   "changed": false
  },
  {
   "project": "goose",
   "guard": "~/damla_projects_2026/katki/goose/.rabadon/guard.json",
   "id": "no-force-push-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git push --force origin main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/damla_projects_2026/katki/goose",
   "gate_exit": 2,
   "refused_by": "no-force-push-main",
   "pattern": "git\\s+push\\b[^\\n]*(--force|--force-with-lease|\\s-f\\b)[^\\n]*\\b(main|master)\\b|git\\s+push\\b[^\\n]*\\b(main|master)\\b[^\\n]*(--force|--force-with-lease|\\s-f\\b)",
   "why": "Mandatory baseline: force-pushing the shared main branch rewrites upstream history for every contributor.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-force-push-main",
   "changed": false
  },
  {
   "project": "goose",
   "guard": "~/damla_projects_2026/katki/goose/.rabadon/guard.json",
   "id": "no-rm-rf-outside-project",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "rm -rf ~/(withheld)",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/damla_projects_2026/katki/goose",
   "gate_exit": 2,
   "refused_by": "no-rm-rf-outside-project",
   "pattern": "\\brm\\s+-[a-zA-Z]*[rR][a-zA-Z]*\\s+(~|\\$HOME|\\.\\./|/(?!Users/home/damla_projects_2026/katki/goose)[^\\s]*)",
   "why": "Mandatory baseline: recursive delete targeting a path outside the goose checkout (project-local deletes like ui/desktop/node_modules stay allowed per CONTRIBUTING troubleshooting).",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-rm-rf-outside-project",
   "changed": false
  },
  {
   "project": "goose",
   "guard": "~/damla_projects_2026/katki/goose/.rabadon/guard.json",
   "id": "no-reset-hard-shared-branch",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git reset --hard origin/main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/damla_projects_2026/katki/goose",
   "gate_exit": 2,
   "refused_by": "no-reset-hard-shared-branch",
   "pattern": "git\\s+reset\\s+--hard\\s+((origin|upstream)/)?(main|master)\\b",
   "why": "Mandatory baseline: hard reset onto main/master discards work on a branch shared with upstream (CONTRIBUTING documents fork sync via fetch/merge, not reset).",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-reset-hard-shared-branch",
   "changed": false
  },
  {
   "project": "goose",
   "guard": "~/damla_projects_2026/katki/goose/.rabadon/guard.json",
   "id": "no-hey-api-openapi-ts",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "npm install @hey-api/openapi-ts",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/damla_projects_2026/katki/goose",
   "gate_exit": 2,
   "refused_by": "no-hey-api-openapi-ts",
   "pattern": "(pnpm|npm|yarn)\\s+(add|install|i)\\b[^\\n]*@hey-api/openapi-ts",
   "why": "AGENTS.md Never: do not add @hey-api/openapi-ts to ui/desktop or recreate the generated API client.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-hey-api-openapi-ts",
   "changed": false
  },
  {
   "project": "goose",
   "guard": "~/damla_projects_2026/katki/goose/.rabadon/guard.json",
   "id": "no-pr-without-ready-issue",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "gh pr create --title x --body y",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/damla_projects_2026/katki/goose",
   "gate_exit": 2,
   "refused_by": "no-pr-without-ready-issue",
   "pattern": "\\bgh\\s+pr\\s+create\\b",
   "why": "CONTRIBUTING: do not open a pull request until the issue has reached Ready on the Goose Issues board; a human must confirm status and link the issue.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-pr-without-ready-issue",
   "changed": false
  },
  {
   "project": "goose",
   "guard": "~/damla_projects_2026/katki/goose/.rabadon/guard.json",
   "id": "no-in-place-binary-overwrite",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "cp x ui/desktop/src/bin",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/damla_projects_2026/katki/goose",
   "gate_exit": 2,
   "refused_by": "no-in-place-binary-overwrite",
   "pattern": "^(?![\\s\\S]*\\brm\\s+-f)[\\s\\S]*\\bcp\\b[\\s\\S]*ui/desktop/src/bin",
   "why": "AGENTS.md Never: overwriting a live binary in place — unlink or atomic-rename first, else macOS SIGKILLs running processes with 'Code Signature Invalid'.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-in-place-binary-overwrite",
   "changed": false
  },
  {
   "project": "goose",
   "guard": "~/damla_projects_2026/katki/goose/.rabadon/guard.json",
   "id": "no-inplace-perl-rewrite-of-source",
   "kind": "bash",
   "incident_authored": true,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "perl -i -pe s/a/b/ x.rs",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/damla_projects_2026/katki/goose",
   "gate_exit": 2,
   "refused_by": "no-inplace-perl-rewrite-of-source",
   "pattern": "perl\\s+(-\\S*\\s+)*-[a-zA-Z]*i[a-zA-Z]*\\b.*\\.rs\\b",
   "why": "In-place perl/sed rewrites of tracked .rs files silently mutate logic outside the editor's tracking and produce phantom test failures.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-inplace-perl-rewrite-of-source",
   "changed": false
  },
  {
   "project": "goose",
   "guard": "~/damla_projects_2026/katki/goose/.rabadon/guard.json",
   "id": "no-cp-over-rust-sources",
   "kind": "bash",
   "incident_authored": true,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "cp a.rs b.rs",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/damla_projects_2026/katki/goose",
   "gate_exit": 2,
   "refused_by": "no-cp-over-rust-sources",
   "pattern": "\\bcp\\b[^\\n;|&]*\\.rs\\s+[^\\n;|&]*\\.rs",
   "why": "Copying a scratch .rs over a tracked source file bypasses Edit/Write and the cargo fmt step, which is what broke the fmt gate here.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-cp-over-rust-sources",
   "changed": false
  },
  {
   "project": "goose",
   "guard": "~/damla_projects_2026/katki/goose/.rabadon/guard.json",
   "id": "generated-acp-schema",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/damla_projects_2026/katki/goose/crates/goose/acp-schema.json",
   "probe_source": "generated (recovered from protection_actually_lost; the published census recorded null)",
   "probe_tool": "Edit",
   "probe_cwd": "~/damla_projects_2026/katki/goose",
   "gate_exit": 2,
   "refused_by": "generated-acp-schema",
   "pattern": "^(\\./)?crates/goose/acp-(schema|meta)\\.json$",
   "why": "Justfile generate-acp-schema/check-acp-schema generate and diff-verify these; edit the Rust types and regenerate.",
   "verdict_at_b384d6a": "cannot-fire",
   "refused_by_at_b384d6a": null,
   "changed": true
  },
  {
   "project": "goose",
   "guard": "~/damla_projects_2026/katki/goose/.rabadon/guard.json",
   "id": "generated-acp-ts-types",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/damla_projects_2026/katki/goose/ui/sdk/src/generated/x",
   "probe_source": "generated (recovered from protection_actually_lost (+ file under the named directory); the published census recorded null)",
   "probe_tool": "Edit",
   "probe_cwd": "~/damla_projects_2026/katki/goose",
   "gate_exit": 2,
   "refused_by": "generated-acp-ts-types",
   "pattern": "^(\\./)?ui/sdk/src/generated/",
   "why": "Justfile generate-acp-types writes this directory from the JSON schema; check-acp-schema fails CI on hand edits.",
   "verdict_at_b384d6a": "cannot-fire",
   "refused_by_at_b384d6a": null,
   "changed": true
  },
  {
   "project": "goose",
   "guard": "~/damla_projects_2026/katki/goose/.rabadon/guard.json",
   "id": "generated-openapi-client",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/damla_projects_2026/katki/goose/ui/desktop/src/api/x",
   "probe_source": "generated (recovered from protection_actually_lost (+ file under the named directory); the published census recorded null)",
   "probe_tool": "Edit",
   "probe_cwd": "~/damla_projects_2026/katki/goose",
   "gate_exit": 2,
   "refused_by": "generated-openapi-client",
   "pattern": "^(\\./)?ui/desktop/src/api/",
   "why": "AGENTS.md Never: recreate ui/desktop/src/api — use ACP SDK types or local src/types/* instead.",
   "verdict_at_b384d6a": "cannot-fire",
   "refused_by_at_b384d6a": null,
   "changed": true
  },
  {
   "project": "goose",
   "guard": "~/damla_projects_2026/katki/goose/.rabadon/guard.json",
   "id": "generated-canonical-models",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/damla_projects_2026/katki/goose/crates/goose-provider-types/src/canonical/data/canonical_models.json",
   "probe_source": "generated (recovered from protection_actually_lost; the published census recorded null)",
   "probe_tool": "Edit",
   "probe_cwd": "~/damla_projects_2026/katki/goose",
   "gate_exit": 2,
   "refused_by": "generated-canonical-models",
   "pattern": "^(\\./)?crates/goose-provider-types/src/canonical/data/(canonical_models|provider_metadata)\\.json$",
   "why": "Justfile build-canonical-models rebuilds these from models.dev via cargo run --bin build_canonical_models.",
   "verdict_at_b384d6a": "cannot-fire",
   "refused_by_at_b384d6a": null,
   "changed": true
  },
  {
   "project": "goose",
   "guard": "~/damla_projects_2026/katki/goose/.rabadon/guard.json",
   "id": "vendored-v8",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/damla_projects_2026/katki/goose/vendor/x",
   "probe_source": "generated (recovered from protection_actually_lost (+ file under the named directory); the published census recorded null)",
   "probe_tool": "Edit",
   "probe_cwd": "~/damla_projects_2026/katki/goose",
   "gate_exit": 2,
   "refused_by": "vendored-v8",
   "pattern": "^(\\./)?vendor/",
   "why": "Cargo.toml patches v8 to the vendored vendor/v8 copy; vendored source is not hand-edited.",
   "verdict_at_b384d6a": "cannot-fire",
   "refused_by_at_b384d6a": null,
   "changed": true
  },
  {
   "project": "goose",
   "guard": "~/damla_projects_2026/katki/goose/.rabadon/guard.json",
   "id": "tool-managed-lockfiles",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/damla_projects_2026/katki/goose/Cargo.lock",
   "probe_source": "generated (recovered from protection_actually_lost; the published census recorded null)",
   "probe_tool": "Edit",
   "probe_cwd": "~/damla_projects_2026/katki/goose",
   "gate_exit": 2,
   "refused_by": "tool-managed-lockfiles",
   "pattern": "^(\\./)?(Cargo\\.lock|ui/pnpm-lock\\.yaml)$",
   "why": "AGENTS.md: dependency changes go through cargo add / cargo update (Justfile bump-version), keeping the lockfile tool-consistent.",
   "verdict_at_b384d6a": "cannot-fire",
   "refused_by_at_b384d6a": null,
   "changed": true
  },
  {
   "project": "rails",
   "guard": "~/damla_projects_2026/katki/rails/.rabadon/guard.json",
   "id": "no-rspec",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "rspec",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/damla_projects_2026/katki/rails",
   "gate_exit": 2,
   "refused_by": "no-rspec",
   "pattern": "^(bundle\\s+exec\\s+)?rspec\\b",
   "why": "AGENTS.md: 'test/ - Test files (NOT spec/ - Rails uses Minitest, not RSpec)'; RSpec is not the project's runner.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-rspec",
   "changed": false
  },
  {
   "project": "rails",
   "guard": "~/damla_projects_2026/katki/rails/.rabadon/guard.json",
   "id": "commit-references-issue",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git commit --no-verify -m \"wip\"",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/damla_projects_2026/katki/rails",
   "gate_exit": 2,
   "refused_by": "commit-references-issue",
   "pattern": "^git\\s+commit\\b.*\\s-m\\s+(?!.*#\\d)",
   "why": "AGENTS.md 'Issue References and Pull Requests': 'Always reference issue numbers in commits: Fix #12345: Description'.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "commit-references-issue",
   "changed": false
  },
  {
   "project": "rails",
   "guard": "~/damla_projects_2026/katki/rails/.rabadon/guard.json",
   "id": "no-security-issue-on-github",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "gh issue create --title \"security: cve-2026-1 exploit\"",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/damla_projects_2026/katki/rails",
   "gate_exit": 2,
   "refused_by": "no-security-issue-on-github",
   "pattern": "^gh\\s+issue\\s+create\\b.*(vulnerab|security|cve-|exploit)",
   "why": "CONTRIBUTING.md: 'Do not open up a GitHub issue if the bug is a security vulnerability in Rails' — use the security policy instead.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-security-issue-on-github",
   "changed": false
  },
  {
   "project": "rails",
   "guard": "~/damla_projects_2026/katki/rails/.rabadon/guard.json",
   "id": "no-force-push-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git push --force origin main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/damla_projects_2026/katki/rails",
   "gate_exit": 2,
   "refused_by": "no-force-push-main",
   "pattern": "^git\\s+push\\b.*(--force|\\s-f\\b).*\\b(main|master)\\b",
   "why": "Baseline: force-pushing the shared main branch rewrites published history for every contributor.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-force-push-main",
   "changed": false
  },
  {
   "project": "rails",
   "guard": "~/damla_projects_2026/katki/rails/.rabadon/guard.json",
   "id": "no-reset-hard-shared-branch",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git reset --hard origin/main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/damla_projects_2026/katki/rails",
   "gate_exit": 2,
   "refused_by": "no-reset-hard-shared-branch",
   "pattern": "^git\\s+reset\\b.*--hard\\b.*\\b(origin/|upstream/|main|master)",
   "why": "Baseline: hard-resetting onto a shared branch ref discards work and diverges from the published history.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-reset-hard-shared-branch",
   "changed": false
  },
  {
   "project": "rails",
   "guard": "~/damla_projects_2026/katki/rails/.rabadon/guard.json",
   "id": "no-rm-rf-outside-project",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "rm -rf ~/(withheld)",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/damla_projects_2026/katki/rails",
   "gate_exit": 2,
   "refused_by": "no-rm-rf-outside-project",
   "pattern": "^rm\\s+(-[a-z]+\\s+)*(/|~|\\.\\./)",
   "why": "Baseline: recursive delete targeting an absolute, home, or parent path reaches outside the repository checkout.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-rm-rf-outside-project",
   "changed": false
  },
  {
   "project": "rails",
   "guard": "~/damla_projects_2026/katki/rails/.rabadon/guard.json",
   "id": "active-support-core-ext",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/damla_projects_2026/katki/rails/activesupport/lib/active_support/core_ext/",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/damla_projects_2026/katki/rails",
   "gate_exit": 2,
   "refused_by": "active-support-core-ext",
   "pattern": "activesupport/lib/active_support/core_ext/",
   "why": "CONTRIBUTING.md: 'We generally reject changes to Active Support core extensions' — propose them in the Ruby issue tracker instead.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "active-support-core-ext",
   "changed": false
  },
  {
   "project": "rails",
   "guard": "~/damla_projects_2026/katki/rails/.rabadon/guard.json",
   "id": "no-spec-directories",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/damla_projects_2026/katki/rails/spec/",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/damla_projects_2026/katki/rails",
   "gate_exit": 2,
   "refused_by": "no-spec-directories",
   "pattern": "(^|/)spec/",
   "why": "AGENTS.md 'File Organization Principles': tests live in test/, NOT spec/ — Rails uses Minitest, not RSpec.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-spec-directories",
   "changed": false
  },
  {
   "project": "redis",
   "guard": "~/damla_projects_2026/katki/redis/.rabadon/guard.json",
   "id": "no-force-push-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git push --force origin main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/damla_projects_2026/katki/redis",
   "gate_exit": 2,
   "refused_by": "no-force-push-main",
   "pattern": "git\\s+push\\b(?=.*\\s(?:--force|-f)\\b)(?=.*\\b(?:unstable|main|master)\\b)",
   "why": "Always-on rule: force-push to the shared mainline (this repo's default branch is `unstable`) rewrites published history; CONTRIBUTING.md tells contributors to push topic branches to their own fork instead.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-force-push-main",
   "changed": false
  },
  {
   "project": "redis",
   "guard": "~/damla_projects_2026/katki/redis/.rabadon/guard.json",
   "id": "no-force-push-upstream-default",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git push --force origin HEAD",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/damla_projects_2026/katki/redis",
   "gate_exit": 2,
   "refused_by": "no-force-push-upstream-default",
   "pattern": "git\\s+push\\s+--force(?:-with-lease)?\\s+origin\\s+HEAD\\b",
   "why": "Always-on rule: force-pushing HEAD to origin without naming a topic branch targets whatever shared branch is checked out.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-force-push-upstream-default",
   "changed": false
  },
  {
   "project": "redis",
   "guard": "~/damla_projects_2026/katki/redis/.rabadon/guard.json",
   "id": "no-rm-rf-outside-project",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "rm -rf ~/(withheld)",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/damla_projects_2026/katki/redis",
   "gate_exit": 2,
   "refused_by": "no-rm-rf-outside-project",
   "pattern": "rm\\s+(?:-[a-z]*r[a-z]*f|-[a-z]*f[a-z]*r)\\S*\\s+(?:/(?!Users/home/damla_projects_2026/katki/redis)|~|\\$HOME|\\.\\./)",
   "why": "Always-on rule: recursive force delete outside the repo root; scripts/modules-shallow.sh shows the project's own rm -rf are all repo-relative (modules/<name>/src).",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-rm-rf-outside-project",
   "changed": false
  },
  {
   "project": "redis",
   "guard": "~/damla_projects_2026/katki/redis/.rabadon/guard.json",
   "id": "no-reset-hard-shared-branch",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git reset --hard origin/main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/damla_projects_2026/katki/redis",
   "gate_exit": 2,
   "refused_by": "no-reset-hard-shared-branch",
   "pattern": "git\\s+reset\\s+--hard\\s+(?:origin/)?(?:unstable|main|master)\\b",
   "why": "Always-on rule: hard reset onto the shared mainline discards work and moves a branch other contributors track.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-reset-hard-shared-branch",
   "changed": false
  },
  {
   "project": "redis",
   "guard": "~/damla_projects_2026/katki/redis/.rabadon/guard.json",
   "id": "topic-branch-not-mainline",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git checkout -b main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/damla_projects_2026/katki/redis",
   "gate_exit": 2,
   "refused_by": "topic-branch-not-mainline",
   "pattern": "git\\s+checkout\\s+-b\\s+(?:unstable|main|master)\\b",
   "why": "CONTRIBUTING.md step 2b: contributions go on a topic branch (`git checkout -b my_branch`), never a new branch shadowing the mainline name.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "topic-branch-not-mainline",
   "changed": false
  },
  {
   "project": "redis",
   "guard": "~/damla_projects_2026/katki/redis/.rabadon/guard.json",
   "id": "no-hand-editing-commands-def",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "sed -i src/commands.def",
   "probe_source": "generated",
   "probe_tool": "Bash",
   "probe_cwd": "~/damla_projects_2026/katki/redis",
   "gate_exit": 2,
   "refused_by": "no-hand-editing-commands-def",
   "pattern": "(?:sed|perl)\\s+-i\\S*\\s+\\S*src/commands\\.def",
   "why": "src/commands.def header says \"Automatically generated by generate-command-code.py, do not edit\" and ci.yml fails the build if it diverges from src/commands/*.json — regenerate with `make commands.def`.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-hand-editing-commands-def",
   "changed": false
  },
  {
   "project": "redis",
   "guard": "~/damla_projects_2026/katki/redis/.rabadon/guard.json",
   "id": "no-skipping-werror-build",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "make REDIS_CFLAGS=-Wno-error",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/damla_projects_2026/katki/redis",
   "gate_exit": 2,
   "refused_by": "no-skipping-werror-build",
   "pattern": "make\\b(?=.*\\bREDIS_CFLAGS=)(?=.*-Wno-error)",
   "why": "Every ci.yml build job compiles with REDIS_CFLAGS='-Werror' and the comment states \"Fail build if there are warnings\" — silencing warnings locally hides what CI will reject.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-skipping-werror-build",
   "changed": false
  },
  {
   "project": "redis",
   "guard": "~/damla_projects_2026/katki/redis/.rabadon/guard.json",
   "id": "generated-commands-def",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/damla_projects_2026/katki/redis/src/commands.def",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/damla_projects_2026/katki/redis",
   "gate_exit": 2,
   "refused_by": "generated-commands-def",
   "pattern": "src/commands\\.def$",
   "why": "File header: \"Automatically generated by generate-command-code.py, do not edit\"; ci.yml has a dedicated job validating it matches src/commands/*.json.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "generated-commands-def",
   "changed": false
  },
  {
   "project": "redis",
   "guard": "~/damla_projects_2026/katki/redis/.rabadon/guard.json",
   "id": "vendored-deps",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/damla_projects_2026/katki/redis/deps/hiredis/",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/damla_projects_2026/katki/redis",
   "gate_exit": 2,
   "refused_by": "vendored-deps",
   "pattern": "^(?:.*/)?deps/(?:hiredis|jemalloc|linenoise|lua|hdr_histogram|fpconv|fast_float)/",
   "why": "deps/ holds vendored upstream sources built by the top-level Makefile; changes belong upstream or in the vendoring step, not hand-edits.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "vendored-deps",
   "changed": false
  },
  {
   "project": "redis",
   "guard": "~/damla_projects_2026/katki/redis/.rabadon/guard.json",
   "id": "untracked-generated-conf",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/damla_projects_2026/katki/redis/redis-full.conf",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/damla_projects_2026/katki/redis",
   "gate_exit": 2,
   "refused_by": "untracked-generated-conf",
   "pattern": "redis-full\\.conf$",
   "why": "Makefile sync-redis-conf target: \"Rewrite the untracked redis-full.conf from redis.conf + modules.yaml + per-module module.conf files\" — edit redis.conf or the module.conf sources instead.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "untracked-generated-conf",
   "changed": false
  },
  {
   "project": "redis",
   "guard": "~/damla_projects_2026/katki/redis/.rabadon/guard.json",
   "id": "cloned-module-sources",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/damla_projects_2026/katki/redis/modules/x/src/",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/damla_projects_2026/katki/redis",
   "gate_exit": 2,
   "refused_by": "cloned-module-sources",
   "pattern": "^(?:.*/)?modules/[^/]+/src/",
   "why": "scripts/modules-update.sh clones modules/*/src from modules.yaml and modules-shallow.sh rm -rf's them on re-clone; edits there are destroyed and belong in the upstream module repo.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "cloned-module-sources",
   "changed": false
  },
  {
   "project": "terraform",
   "guard": "~/damla_projects_2026/katki/terraform/.rabadon/guard.json",
   "id": "no-force-push-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git push --force origin main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/damla_projects_2026/katki/terraform",
   "gate_exit": 2,
   "refused_by": "no-force-push-main",
   "pattern": "^git\\s+push\\b(?=.*(?:--force|\\s-f\\b))(?=.*\\b(?:main|master)\\b)",
   "why": "Baseline safety rule: force-pushing the shared main/master branch of the Terraform core repo rewrites published history.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-force-push-main",
   "changed": false
  },
  {
   "project": "terraform",
   "guard": "~/damla_projects_2026/katki/terraform/.rabadon/guard.json",
   "id": "no-rm-rf-outside-project",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "rm -rf ~/(withheld)",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/damla_projects_2026/katki/terraform",
   "gate_exit": 2,
   "refused_by": "no-rm-rf-outside-project",
   "pattern": "^rm\\s+(?:-\\S+\\s+)+(?:~|\\.\\.\\/|\\/(?!tmp\\/|var\\/folders\\/))",
   "why": "Baseline safety rule: recursive delete aimed at an absolute path, the home directory, or a parent directory leaves the repo working tree.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-rm-rf-outside-project",
   "changed": false
  },
  {
   "project": "terraform",
   "guard": "~/damla_projects_2026/katki/terraform/.rabadon/guard.json",
   "id": "no-reset-hard-shared-branch",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git reset --hard origin/main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/damla_projects_2026/katki/terraform",
   "gate_exit": 2,
   "refused_by": "no-reset-hard-shared-branch",
   "pattern": "^git\\s+reset\\b(?=.*--hard)(?=.*(?:\\b(?:main|master)\\b|origin\\/))",
   "why": "Baseline safety rule: hard-resetting main/master or an origin ref discards work that other contributors share.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-reset-hard-shared-branch",
   "changed": false
  },
  {
   "project": "terraform",
   "guard": "~/damla_projects_2026/katki/terraform/.rabadon/guard.json",
   "id": "generated-protobuf-stubs",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/damla_projects_2026/katki/terraform/.pb.go",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/damla_projects_2026/katki/terraform",
   "gate_exit": 2,
   "refused_by": "generated-protobuf-stubs",
   "pattern": "\\.pb\\.go$",
   "why": "CONTRIBUTING has a Generated Code section and the Makefile regenerates protobuf stubs via `make protobuf` (go run ./tools/protobuf-compile) — edit the .proto source, not the stub.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "generated-protobuf-stubs",
   "changed": false
  },
  {
   "project": "terraform",
   "guard": "~/damla_projects_2026/katki/terraform/.rabadon/guard.json",
   "id": "go-generate-output",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/damla_projects_2026/katki/terraform/_gen.go",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/damla_projects_2026/katki/terraform",
   "gate_exit": 2,
   "refused_by": "go-generate-output",
   "pattern": "(_gen|_string)\\.go$",
   "why": "Makefile `generate` target runs `go generate ./...`; these files are tool output, so change the generator or its directive instead.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "go-generate-output",
   "changed": false
  },
  {
   "project": "terraform",
   "guard": "~/damla_projects_2026/katki/terraform/.rabadon/guard.json",
   "id": "changie-managed-changelog",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/damla_projects_2026/katki/terraform/CHANGELOG.md",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/damla_projects_2026/katki/terraform",
   "gate_exit": 2,
   "refused_by": "changie-managed-changelog",
   "pattern": "(^|/)CHANGELOG\\.md$|(^|/)\\.changes/",
   "why": "CONTRIBUTING says changelog entries are created with `changie` (.changie.yaml present); CHANGELOG.md and .changes/ entries are generated, not hand-written.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "changie-managed-changelog",
   "changed": false
  },
  {
   "project": "terraform",
   "guard": "~/damla_projects_2026/katki/terraform/.rabadon/guard.json",
   "id": "equivalence-test-goldens",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/damla_projects_2026/katki/terraform/testing/equivalence-tests/outputs/",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/damla_projects_2026/katki/terraform",
   "gate_exit": 2,
   "refused_by": "equivalence-test-goldens",
   "pattern": "testing/equivalence-tests/outputs/",
   "why": "CI workflows treat testing/equivalence-tests/outputs as golden files updated by the equivalence-test action (\"Update equivalence test golden files.\"), never by hand.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "equivalence-test-goldens",
   "changed": false
  },
  {
   "project": "terraform",
   "guard": "~/damla_projects_2026/katki/terraform/.rabadon/guard.json",
   "id": "go-sum-lockfile",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/damla_projects_2026/katki/terraform/go.sum",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/damla_projects_2026/katki/terraform",
   "gate_exit": 2,
   "refused_by": "go-sum-lockfile",
   "pattern": "(^|/)go\\.sum$",
   "why": "go.sum is the Go toolchain's lockfile (CI keys its cache on it, scripts/syncdeps.sh maintains deps) — regenerate with go mod tidy rather than editing.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "go-sum-lockfile",
   "changed": false
  },
  {
   "project": "terraform",
   "guard": "~/damla_projects_2026/katki/terraform/.rabadon/guard.json",
   "id": "deprecated-tool-provisioners",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/damla_projects_2026/katki/terraform/provisioner/chef/",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/damla_projects_2026/katki/terraform",
   "gate_exit": 2,
   "refused_by": "deprecated-tool-provisioners",
   "pattern": "provisioners?/(chef|habitat|puppet|salt-masterless)/",
   "why": "CONTRIBUTING: the tool-specific provisioners are deprecated and \"we will not be accepting PRs for these areas of the codebase\".",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "deprecated-tool-provisioners",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-force-push-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git push --force origin main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-force-push-main",
   "pattern": "git\\s+push\\b(?=.*(--force(\\s|$|=)|\\s-f(\\s|$)))(?=.*\\b(main|master)\\b)",
   "why": "Baseline safety: force-pushing main destroys shared history; kanıtla-iddia-etme culture forbids rewriting the record.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-force-push-main",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-rm-rf-outside-project",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "rm -rf ~/(withheld)",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-rm-rf-outside-project",
   "pattern": "rm\\s+(-[a-zA-Z]+\\s+)*-[a-zA-Z]*r[a-zA-Z]*\\s+(-[a-zA-Z]+\\s+)*(\"|')?(~|\\$HOME|/(\\s|\\*|$)|\\.\\.)",
   "why": "Baseline safety: recursive delete aimed at home, root, or parent dirs reaches outside the project.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-rm-rf-outside-project",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-hard-reset-shared-branch",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git reset --hard origin/main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-hard-reset-shared-branch",
   "pattern": "git\\s+reset\\s+--hard\\b.*\\b(origin/)?(main|master)\\b",
   "why": "Baseline safety: hard reset against main/master silently discards work — asymmetry rule, Damla pays the loss.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-hard-reset-shared-branch",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-shell-edit-generated-context",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "sed -i \"\" s/a/b/ CLAUDE.context.md",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-shell-edit-generated-context",
   "pattern": "(>{1,2}\\s*\\S*CLAUDE\\.context\\.md|sed\\s+-i.*CLAUDE\\.context\\.md|tee\\s+.*CLAUDE\\.context\\.md)",
   "why": "CLAUDE.context.md is marked 'deep machine context (auto, regenerable)' — hand-editing it via shell is overwritten; change the source instead.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-shell-edit-generated-context",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "generated-claude-context",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/(withheld)",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "generated-claude-context",
   "pattern": "(^|/)CLAUDE\\.context\\.md$",
   "why": "CLAUDE.md declares it auto-generated and regenerable — edit the generator/source, never this file.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "generated-claude-context",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-force-push-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git push --force origin main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-force-push-main",
   "pattern": "git\\s+push(?=[\\s\\S]*(\\s--force\\b|\\s-f\\b))(?=[\\s\\S]*\\b(main|master)\\b)",
   "why": "baseline safety: force-pushing main rewrites shared history",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-force-push-main",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-rm-rf-outside-project",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "rm -rf ~/(withheld)",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-rm-rf-outside-project",
   "pattern": "rm\\s+(-\\w*r\\w*f|-\\w*f\\w*r)\\s+(/|~|\\.\\.)",
   "why": "baseline safety: recursive delete outside the project tree is unrecoverable",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-rm-rf-outside-project",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-hard-reset-shared",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git reset --hard origin/main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-hard-reset-shared",
   "pattern": "git\\s+reset\\s+--hard\\s+(origin/)?(main|master)\\b",
   "why": "baseline safety: hard reset on a shared branch discards pushed work",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-hard-reset-shared",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-coauthor-commit",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git commit -m \"fix the thing\n\nCo-Authored-By: Claude <noreply@anthropic.com>\"",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-coauthor-commit",
   "pattern": "git\\s+commit[\\s\\S]*co-authored-by",
   "why": "global git law: commit messages lowercase english, 'co-author ASLA'",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-coauthor-commit",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-avatar-photo-assets",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/(withheld)",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-avatar-photo-assets",
   "pattern": "avatar|profile[-_.]?(photo|pic)",
   "why": "KILITLI law: avatar/foto/gorsel YOK ('kelimeler konussun') — no avatar/profile-photo files may be created or edited",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-avatar-photo-assets",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-force-push-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git push --force origin main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-force-push-main",
   "pattern": "git\\s+push\\b.*(--force|\\s-f\\b).*\\s(main|master)\\b",
   "why": "kanıtla-iddia-etme root law + one-step-one-commit git discipline; force-pushing main destroys the proof trail",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-force-push-main",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-rm-rf-outside-project",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "rm -rf ~/(withheld)",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-rm-rf-outside-project",
   "pattern": "rm\\s+-\\w*[rR]\\w*\\s+(\\/(?!Users\\/home\\/damla_projects_2026)|~\\/?|\\$HOME|\\.\\.)",
   "why": "destructive delete outside the project root is never authorized by any law",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-rm-rf-outside-project",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-hard-reset-shared",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git reset --hard origin/main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-hard-reset-shared",
   "pattern": "git\\s+reset\\s+--hard\\s+(origin\\/)?(main|master)\\b",
   "why": "destructive reset of the shared branch erases pushed history; no law authorizes it",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-hard-reset-shared",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-delete-web-without-damla",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "rm -r web",
   "probe_source": "generated",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-delete-web-without-damla",
   "pattern": "(^|[;&|]\\s*)(rm\\s+-\\w*[rR]\\w*|git\\s+rm(\\s+-r)?(\\s+--cached)?)\\s+(\\.\\/)?web\\/?(\\s|$)",
   "why": "Status law: retiring web/ is 'awaiting Damla's OK' and Next lists 'Damla: confirm deleting web/' — deletion is her call, not the agent's",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-delete-web-without-damla",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-hand-edit-context-md",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/(withheld)",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-hand-edit-context-md",
   "pattern": "CLAUDE\\.context\\.md$",
   "why": "file is marked 'deep machine context (auto, regenerable)' — regenerate it, never hand-edit",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-hand-edit-context-md",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-force-push-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git push --force origin main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-force-push-main",
   "pattern": "git\\s+push(?=.*(--force|\\s-f\\b))(?=.*\\b(main|master)\\b)",
   "why": "always-on default: force-pushing the main branch rewrites shared history",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-force-push-main",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-rm-rf-outside-project",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "rm -rf ~/(withheld)",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-rm-rf-outside-project",
   "pattern": "rm\\s+-[a-z]*(rf|fr)[a-z]*\\s+(/|~|\\$HOME|\\.\\.)",
   "why": "always-on default: recursive force-delete on absolute~ paths reaches outside the project",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-rm-rf-outside-project",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-hard-reset-shared",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git reset --hard origin/main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-hard-reset-shared",
   "pattern": "git\\s+reset\\s+--hard\\s+(origin/)?(main|master)\\b",
   "why": "always-on default: hard reset on a shared branch destroys work",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-hard-reset-shared",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-shell-edit-generated-context",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "sed -i \"\" s/a/b/ CLAUDE.context.md",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-shell-edit-generated-context",
   "pattern": "(>|\\bsed\\s+-i\\b|\\btee\\b).*CLAUDE\\.context\\.md",
   "why": "CLAUDE.context.md is marked '(auto, regenerable)' — regenerate it, don't rewrite it via shell redirection",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-shell-edit-generated-context",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "generated-claude-context",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/(withheld)",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "generated-claude-context",
   "pattern": "CLAUDE\\.context\\.md$",
   "why": "law marks it 'deep machine context (auto, regenerable)' — change the generator/source, not this file",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "generated-claude-context",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-force-push-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git push --force origin main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-force-push-main",
   "pattern": "git\\s+push\\b.*\\s(-f|--force)\\b.*\\b(main|master)\\b",
   "why": "baseline safety: never force-push the default branch",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-force-push-main",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-force-push-main-flag-first",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "shadowed",
   "mechanism": "shadowed",
   "mechanism_note": "The rule is capable — it refuses this command when it stands alone in a guard of its own — but an earlier rule in the same guard catches the same command first, so this id can never appear in a refusal.",
   "probe": "git push -f x main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-force-push-main",
   "pattern": "git\\s+push\\s+(-f|--force)\\s+\\S+\\s+(main|master)\\b",
   "why": "baseline safety: force flag before remote/branch order",
   "verdict_at_b384d6a": "shadowed",
   "refused_by_at_b384d6a": "no-force-push-main",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-hard-reset-shared",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git reset --hard origin/main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-hard-reset-shared",
   "pattern": "git\\s+reset\\s+--hard\\s+(origin\\/)?(main|master)\\b",
   "why": "baseline safety: no destructive resets on shared branches",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-hard-reset-shared",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-rm-rf-outside-project",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "rm -rf ~/(withheld)",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-rm-rf-outside-project",
   "pattern": "rm\\s+(-[a-z]*r[a-z]*|--recursive)\\b.*\\s(\\/(?!users\\/home\\/damla_projects_2026)|~|\\.\\.\\/)",
   "why": "baseline safety: recursive delete outside the project tree",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-rm-rf-outside-project",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-delete-privacy-policy",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "rm privacy.html",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-delete-privacy-policy",
   "pattern": "(git\\s+)?rm\\b.*privacy",
   "why": "CLAUDE.md: (withheld) App Store privacy policy page is live — do not delete",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-delete-privacy-policy",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-coauthor-trailer",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git commit -m \"fix the thing\n\nCo-Authored-By: Claude <noreply@anthropic.com>\"",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-coauthor-trailer",
   "pattern": "git\\s+commit(\\s|.)*co-authored-by",
   "why": "global CLAUDE.md §6 (incorporated by KÖK YASA anchor): commit messages carry no co-author, ever",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-coauthor-trailer",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "generated-claude-context",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/(withheld)",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "generated-claude-context",
   "pattern": "(^|\\/)CLAUDE\\.context\\.md$",
   "why": "marked 'deep machine context (auto, regenerable)' — regenerate it, never hand-edit",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "generated-claude-context",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "damlalog-privacy-page",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/(withheld)",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "damlalog-privacy-page",
   "pattern": "privacy[^\\/]*\\.(html?|md)$",
   "why": "CLAUDE.md: page still hosts the (withheld) App Store privacy policy — must not be deleted or gutted",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "damlalog-privacy-page",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-force-push-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git push --force origin main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-force-push-main",
   "pattern": "git\\s+push(?=[\\s\\S]*(--force|\\s-f\\b))(?=[\\s\\S]*\\b(main|master)\\b)",
   "why": "baseline: force-push to main rewrites shared history",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-force-push-main",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-rm-rf-outside-project",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "rm -rf ~/(withheld)",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-rm-rf-outside-project",
   "pattern": "rm\\s+-\\w*r\\w*\\s+(/|~|\\$HOME|\\.\\.)",
   "why": "baseline: recursive delete of root~ reaches outside the project tree",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-rm-rf-outside-project",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-reset-hard-shared",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git reset --hard origin/main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-reset-hard-shared",
   "pattern": "git\\s+reset\\s+--hard\\s+(origin/)?(main|master)\\b",
   "why": "baseline: hard reset on the shared branch destroys pushed work",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-reset-hard-shared",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-touch-blog-posts-table",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "psql -c \"insert into blog_posts values (1)\"",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-touch-blog-posts-table",
   "pattern": "(?=[\\s\\S]*\\bblog_posts\\b)(?=[\\s\\S]*\\b(insert|update|delete|drop|truncate|alter|create)\\b)",
   "why": "DB law: posts live in dew_posts; blog_posts is another site's table — 'do not touch'",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-touch-blog-posts-table",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-make-repo-public",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "gh repo edit --visibility public",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-make-repo-public",
   "pattern": "gh\\s+repo\\s+edit(?=[\\s\\S]*visibility)(?=[\\s\\S]*public)",
   "why": "law: 'Repo PRIVATE' — visibility must never be flipped to public",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-make-repo-public",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-coauthor-commit",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git commit -m \"fix the thing\n\nCo-Authored-By: Claude <noreply@anthropic.com>\"",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-coauthor-commit",
   "pattern": "git\\s+commit(?=[\\s\\S]*co-authored-by)",
   "why": "global git law: commit messages lowercase english, co-author ASLA",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-coauthor-commit",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "editor-publish-mechanic",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/(withheld)",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "editor-publish-mechanic",
   "pattern": "(^|/)admin/(new|edit)(/|$)",
   "why": "law: Damla LOVES the Medium-style post-publishing mechanic + editor vibe — 'do not touch'; edit only on her explicit ask",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "editor-publish-mechanic",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-force-push-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git push --force origin main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-force-push-main",
   "pattern": "git\\s+push\\s+.*(--force|\\s-f\\b).*\\b(main|master)\\b",
   "why": "baseline safety: force-pushing main destroys shared history",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-force-push-main",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-rm-rf-outside-project",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "rm -rf ~/(withheld)",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-rm-rf-outside-project",
   "pattern": "rm\\s+-[a-z]*[rf][a-z]*[rf][a-z]*\\s+(/|~)",
   "why": "baseline safety: recursive delete on absolute/home paths reaches outside the project",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-rm-rf-outside-project",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-hard-reset-shared-branch",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git reset --hard origin/main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-hard-reset-shared-branch",
   "pattern": "git\\s+reset\\s+--hard\\s+(origin/)?(main|master)\\b",
   "why": "baseline safety: hard reset against main/master discards shared work",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-hard-reset-shared-branch",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-coauthor-commit",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git commit -m \"fix the thing\n\nCo-Authored-By: Claude <noreply@anthropic.com>\"",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-coauthor-commit",
   "pattern": "git\\s+commit[\\s\\S]*co-authored-by",
   "why": "global CLAUDE.md §6 (anchored by KÖK YASA header): commit messages lowercase english, co-author ASLA",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-coauthor-commit",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-shell-edit-generated-context",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "tee CLAUDE.context.md",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-shell-edit-generated-context",
   "pattern": "(>|sed\\s+-i|tee)\\s*\\S*claude\\.context\\.md",
   "why": "CLAUDE.context.md is marked auto/regenerable — regenerate it, don't edit it via shell",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-shell-edit-generated-context",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "claude-context-generated",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/(withheld)",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "claude-context-generated",
   "pattern": "CLAUDE\\.context\\.md$",
   "why": "file is marked '(auto, regenerable)' in CLAUDE.md — change the generator/source, not the generated file",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "claude-context-generated",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-force-push-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git push --force origin main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-force-push-main",
   "pattern": "git\\s+push(?=[\\s\\S]*(--force\\b|\\s-f\\b))(?=[\\s\\S]*\\b(main|master)\\b)",
   "why": "baseline: force push to main rewrites shared history, forbidden",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-force-push-main",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-rm-rf-outside-project",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "rm -rf ~/(withheld)",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-rm-rf-outside-project",
   "pattern": "rm\\s+-[a-z]*r[a-z]*\\s+(/|~)",
   "why": "baseline: recursive delete on absolute/home paths reaches outside the project",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-rm-rf-outside-project",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-hard-reset-shared",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git reset --hard origin/main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-hard-reset-shared",
   "pattern": "git\\s+reset\\s+--hard\\s+\\S*(origin/|\\bmain\\b|\\bmaster\\b)",
   "why": "baseline: hard reset against shared branches destroys work",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-hard-reset-shared",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-coauthor-commit",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git commit -m \"fix the thing\n\nCo-Authored-By: Claude <noreply@anthropic.com>\"",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-coauthor-commit",
   "pattern": "git\\s+commit(?=[\\s\\S]*co-authored-by)",
   "why": "global CLAUDE.md §6: commit messages lowercase english, co-author ASLA",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-coauthor-commit",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "delivered-book-artifacts",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/(withheld)",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "delivered-book-artifacts",
   "pattern": "urun-psikolojisi-kitap-[12]\\.(epub|pdf)$",
   "why": "CLAUDE.md Durum: both books TESLİM EDİLDİ and kapandı; artifacts come from the üretim hattı, not hand edits",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "delivered-book-artifacts",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "auto-context-file",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/(withheld)",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "auto-context-file",
   "pattern": "CLAUDE\\.context\\.md$",
   "why": "marked 'deep machine context (auto, regenerable)' — regenerate it, don't hand-edit",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "auto-context-file",
   "changed": false
  },
  {
   "project": "rabadon",
   "guard": "~/damla_projects_2026/rabadon/.rabadon/guard.json",
   "id": "no-force-push-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git push --force origin main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/damla_projects_2026/rabadon",
   "gate_exit": 2,
   "refused_by": "no-force-push-main",
   "pattern": "git\\s+push[^|;&]*(--force|-f)\\b[^|;&]*\\b(main|master)\\b",
   "why": "baseline: force-pushing a shared branch destroys history",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-force-push-main",
   "changed": false
  },
  {
   "project": "rabadon",
   "guard": "~/damla_projects_2026/rabadon/.rabadon/guard.json",
   "id": "no-rm-rf-outside",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "rm -rf ~/(withheld)",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/damla_projects_2026/rabadon",
   "gate_exit": 2,
   "refused_by": "no-rm-rf-outside",
   "pattern": "rm\\s+-\\w*[rf]\\w*\\s+(/(?!tmp)|~/(?!\\.)|\\$HOME)",
   "why": "baseline: recursive delete outside a project is unrecoverable",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-rm-rf-outside",
   "changed": false
  },
  {
   "project": "rabadon",
   "guard": "~/damla_projects_2026/rabadon/.rabadon/guard.json",
   "id": "no-hard-reset-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git reset --hard origin/main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/damla_projects_2026/rabadon",
   "gate_exit": 2,
   "refused_by": "no-hard-reset-main",
   "pattern": "git\\s+reset\\s+--hard\\s+(origin/)?(main|master)\\b",
   "why": "baseline: rewrite shared state via commits, not resets",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-hard-reset-main",
   "changed": false
  },
  {
   "project": "rabadon",
   "guard": "~/damla_projects_2026/rabadon/.rabadon/guard.json",
   "id": "no-hook-bypass",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git commit --no-verify -m \"wip\"",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/damla_projects_2026/rabadon",
   "gate_exit": 2,
   "refused_by": "no-hook-bypass",
   "pattern": "git\\s+(commit|push)[^|;&]*--no-verify",
   "why": "baseline: bypassing hooks bypasses every gate at once",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-hook-bypass",
   "changed": false
  },
  {
   "project": "rabadon",
   "guard": "~/damla_projects_2026/rabadon/.rabadon/guard.json",
   "id": "no-gnu-timeout-on-macos",
   "kind": "bash",
   "incident_authored": true,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "timeout 5 make test",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/damla_projects_2026/rabadon",
   "gate_exit": 2,
   "refused_by": "no-gnu-timeout-on-macos",
   "pattern": "(^|[;&|]\\s*)timeout\\s+[0-9]",
   "why": "`timeout` is not on macOS; the shell aborts and an empty exit code masquerades as a red test suite — use the tool's timeout parameter instead.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-gnu-timeout-on-macos",
   "changed": false
  },
  {
   "project": "rabadon",
   "guard": "~/damla_projects_2026/rabadon/.rabadon/guard.json",
   "id": "no-blind-inplace-source-rewrite",
   "kind": "bash",
   "incident_authored": true,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "sed -i \"\" s/a/b/ web/index.html",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/damla_projects_2026/rabadon",
   "gate_exit": 2,
   "refused_by": "no-blind-inplace-source-rewrite",
   "pattern": "\\b(perl|python3?|ruby|sed)\\b[^\\n]*(-0?[a-z]*i|--in-place|\\bopen\\([^\\n]*['\\\"]w['\\\"])[^\\n]*(native/|\\.cpp|\\.h|Makefile|_test\\.sh)",
   "why": "In-place scripted rewrites of engine source and its test expectations edit both sides blind and let the two drift into contradicting each other.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-blind-inplace-source-rewrite",
   "changed": false
  },
  {
   "project": "rabadon",
   "guard": "~/damla_projects_2026/rabadon/.rabadon/guard.json",
   "id": "no-silenced-ctest-stderr",
   "kind": "bash",
   "incident_authored": true,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "ctest 2>/dev/null",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/damla_projects_2026/rabadon",
   "gate_exit": 2,
   "refused_by": "no-silenced-ctest-stderr",
   "pattern": "\\bctest\\b[^\\n]*2>\\s*/dev/null",
   "why": "Discarding stderr from the test runner turns a diagnosable failure into a bare test name and forces a second full run.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-silenced-ctest-stderr",
   "changed": false
  },
  {
   "project": "rabadon",
   "guard": "~/damla_projects_2026/rabadon/.rabadon/guard.json",
   "id": "no-shell-rewrite-of-guard-or-promise",
   "kind": "bash",
   "incident_authored": true,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "> .rabadon/guard.json",
   "probe_source": "generated",
   "probe_tool": "Bash",
   "probe_cwd": "~/damla_projects_2026/rabadon",
   "gate_exit": 2,
   "refused_by": "no-shell-rewrite-of-guard-or-promise",
   "pattern": "(>\\s*|\\btee\\s+(-a\\s+)?)(\\./)?\\.rabadon/(guard|promise)\\.json\\b|\\b(sed|perl|python3?|ruby)\\b[^\\n]*(\\s-[0-9a-z]*i\\b|--in-place)[^\\n]*\\.rabadon/(guard|promise)\\.json|\\b(rm|mv)\\b[^\\n]*\\.rabadon/(guard|promise)\\.json",
   "why": "guard-weaken and promise-tamper are sealed in the binary but they judge Edit/Write TOOL calls only (gate.cpp:1860 gates on isEditTool) — a shell redirect, an in-place editor or an rm reaches the same two files without ever passing that law.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-shell-rewrite-of-guard-or-promise",
   "changed": false
  },
  {
   "project": "rabadon",
   "guard": "~/damla_projects_2026/rabadon/.rabadon/guard.json",
   "id": "no-shell-write-to-frozen-file",
   "kind": "bash",
   "incident_authored": true,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "> index.html",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/damla_projects_2026/rabadon",
   "gate_exit": 2,
   "refused_by": "no-shell-write-to-frozen-file",
   "pattern": "(>\\s*|\\btee\\s+(-a\\s+)?)(\\./)?(index\\.html|bin/rabadon\\.mjs)\\b|\\b(sed|perl|python3?|ruby)\\b[^\\n]*(\\s-[0-9a-z]*i\\b|--in-place)[^\\n]*(index\\.html|bin/rabadon\\.mjs)",
   "why": "CLAUDE.md freezes the landing (index.html is damla-approved) and HANDOFF §9 makes (withheld) an anti-path. protectedPaths only sees Edit/Write; a redirect or a sed -i rewrites the same two files straight from the shell.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-shell-write-to-frozen-file",
   "changed": false
  },
  {
   "project": "rabadon",
   "guard": "~/damla_projects_2026/rabadon/.rabadon/guard.json",
   "id": "no-delete-native-binaries",
   "kind": "bash",
   "incident_authored": true,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "rm native/rabadon-gate",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/damla_projects_2026/rabadon",
   "gate_exit": 2,
   "refused_by": "no-delete-native-binaries",
   "pattern": "\\brm\\b[^\\n]*native/(rabadon-(gate|drift|verify|loop|do|stats|net|truth|serve|budget|lens|trace|audit|repair|sandbox|export)|gate_bench)\\b",
   "why": ".claude/settings.json points every hook at native/rabadon-gate, so deleting the built binaries disarms this repo's own supervision while the session keeps running. Rebuild with `make all`. (`make clean` runs the same rm inside make, where this rule cannot see it.)",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-delete-native-binaries",
   "changed": false
  },
  {
   "project": "rabadon",
   "guard": "~/damla_projects_2026/rabadon/.rabadon/guard.json",
   "id": "no-publish-without-dry-run",
   "kind": "bash",
   "incident_authored": true,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "npm publish",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/damla_projects_2026/rabadon",
   "gate_exit": 2,
   "refused_by": "no-publish-without-dry-run",
   "pattern": "npm\\s+publish(?![^\\n]*--dry-run)",
   "why": "package.json is a publishable package (rabadon@0.2.0 plus four optional platform packages) and CLAUDE.md leaves Faz 5 — npm org, NPM_TOKEN, release — to Damla. A session may rehearse the publish, never perform it.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-publish-without-dry-run",
   "changed": false
  },
  {
   "project": "rabadon",
   "guard": "~/damla_projects_2026/rabadon/.rabadon/guard.json",
   "id": "no-release-tag-push",
   "kind": "bash",
   "incident_authored": true,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git push --tags --force origin",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/damla_projects_2026/rabadon",
   "gate_exit": 2,
   "refused_by": "no-release-tag-push",
   "pattern": "git\\s+push[^|;&]*(--tags|--follow-tags|refs/tags/|\\s+v[0-9]+\\.[0-9]+\\.[0-9]+)",
   "why": ".github/workflows/release.yml fires on a version tag, so pushing a tag IS the publish; CLAUDE.md leaves `tag v0.2.0 push` to Damla.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-release-tag-push",
   "changed": false
  },
  {
   "project": "rabadon",
   "guard": "~/damla_projects_2026/rabadon/.rabadon/guard.json",
   "id": "anti-path-frozen",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/damla_projects_2026/rabadon/bin/rabadon.mjs",
   "probe_source": "generated (re-derived from the pattern; the published census recorded null)",
   "probe_tool": "Edit",
   "probe_cwd": "~/damla_projects_2026/rabadon",
   "gate_exit": 2,
   "refused_by": "anti-path-frozen",
   "pattern": "^(bin/rabadon\\.mjs|index\\.html)$",
   "why": "HANDOFF §9: (withheld) is anti-path and index.html is damla-approved — never edited, only called",
   "verdict_at_b384d6a": "cannot-fire",
   "refused_by_at_b384d6a": "anti-path-frozen-abs",
   "changed": true
  },
  {
   "project": "rabadon",
   "guard": "~/damla_projects_2026/rabadon/.rabadon/guard.json",
   "id": "release-workflow-needs-test-gate",
   "kind": "protectedPaths",
   "incident_authored": true,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/damla_projects_2026/rabadon/.github/workflows/release.yml",
   "probe_source": "generated (re-derived from the pattern; the published census recorded null)",
   "probe_tool": "Edit",
   "probe_cwd": "~/damla_projects_2026/rabadon",
   "gate_exit": 2,
   "refused_by": "release-workflow-needs-test-gate",
   "pattern": "^\\.github/workflows/release\\.(yml|yaml)$",
   "why": "Any edit to the publish pipeline must be re-checked for a test job and a post-publish smoke install before it can ship an unverified artifact.",
   "verdict_at_b384d6a": "cannot-fire",
   "refused_by_at_b384d6a": "release-workflow-abs",
   "changed": true
  },
  {
   "project": "rabadon",
   "guard": "~/damla_projects_2026/rabadon/.rabadon/guard.json",
   "id": "anti-path-frozen-abs",
   "kind": "protectedPaths",
   "incident_authored": true,
   "verdict": "shadowed",
   "mechanism": "shadowed",
   "mechanism_note": "The rule is capable — it refuses this command when it stands alone in a guard of its own — but an earlier rule in the same guard catches the same command first, so this id can never appear in a refusal.",
   "probe": "~/damla_projects_2026/rabadon/bin/rabadon.mjs",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/damla_projects_2026/rabadon",
   "gate_exit": 2,
   "refused_by": "anti-path-frozen",
   "pattern": "^(bin/rabadon\\.mjs|index\\.html)$|/rabadon/(bin/rabadon\\.mjs|index\\.html)$",
   "why": "the twin of anti-path-frozen that can actually fire: gate.cpp:1811 matches protectedPaths against the RAW file_path and Claude Code always sends an absolute path, so the ^-anchored form above matches nothing. Measured 2026-08-03: absolute path exit 0, relative path exit 2.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "anti-path-frozen-abs",
   "changed": true
  },
  {
   "project": "rabadon",
   "guard": "~/damla_projects_2026/rabadon/.rabadon/guard.json",
   "id": "release-workflow-abs",
   "kind": "protectedPaths",
   "incident_authored": true,
   "verdict": "shadowed",
   "mechanism": "shadowed",
   "mechanism_note": "The rule is capable — it refuses this command when it stands alone in a guard of its own — but an earlier rule in the same guard catches the same command first, so this id can never appear in a refusal.",
   "probe": "~/damla_projects_2026/rabadon/.github/workflows/release.yml",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/damla_projects_2026/rabadon",
   "gate_exit": 2,
   "refused_by": "release-workflow-needs-test-gate",
   "pattern": "(^|/)\\.github/workflows/release\\.(yml|yaml)$",
   "why": "the same defect as anti-path-frozen-abs: the ^-anchored release rule never sees an absolute file_path. This one does.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "release-workflow-abs",
   "changed": true
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-force-push-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git push --force origin main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-force-push-main",
   "pattern": "git\\s+push[^|;&]*(--force|-f)\\b[^|;&]*\\b(main|master)\\b",
   "why": "force-pushing a shared branch destroys history",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-force-push-main",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-rm-rf-outside",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "rm -rf ~/(withheld)",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-rm-rf-outside",
   "pattern": "rm\\s+-\\w*[rf]\\w*\\s+(/(?!tmp)|~/(?!\\.)|\\$HOME)",
   "why": "recursive delete outside a project is unrecoverable",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-rm-rf-outside",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-hard-reset-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git reset --hard origin/main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-hard-reset-main",
   "pattern": "git\\s+reset\\s+--hard\\s+(origin/)?(main|master)\\b",
   "why": "rewrite shared state via commits, not resets",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-hard-reset-main",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-hook-bypass",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git commit --no-verify -m \"wip\"",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-hook-bypass",
   "pattern": "git\\s+(commit|push)[^|;&]*--no-verify",
   "why": "bypassing hooks bypasses every gate at once",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-hook-bypass",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "reports-no-repo-wide-stage",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git add -A",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "reports-no-repo-wide-stage",
   "pattern": "git\\s+add\\s+(-A\\b|--all\\b|\\.(\\s|$))",
   "why": "this directory is NOT its own repo: `git rev-parse --show-toplevel` here answers ~, so a repo-wide stage sweeps up every other live session's files",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "reports-no-repo-wide-stage",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "reports-no-repo-wide-commit",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git commit -am \"wip\"",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "reports-no-repo-wide-commit",
   "pattern": "git\\s+commit\\b[^|;&]*\\s-[a-z]*a[a-z]*\\b",
   "why": "toplevel is ~ — `commit -a` commits every modified tracked file in the home repo, not this archive",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "reports-no-repo-wide-commit",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "reports-no-repo-wide-discard",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git checkout -- .",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "reports-no-repo-wide-discard",
   "pattern": "git\\s+(checkout|restore)\\s+(--\\s+)?\\.(\\s|$)",
   "why": "a repo-wide discard from here throws away uncommitted work across the whole home tree, not just this archive",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "reports-no-repo-wide-discard",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "reports-no-git-clean",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git clean -fdx",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "reports-no-git-clean",
   "pattern": "git\\s+clean\\b[^|;&]*\\s-[a-z]*[fdx]",
   "why": "10 of this archive's paths are untracked right now; a force clean from a $HOME-rooted tree deletes them and every other session's untracked files with no reflog",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "reports-no-git-clean",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "reports-no-evidence-tree-delete",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "rm -r 2011-11-11-",
   "probe_source": "generated",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "reports-no-evidence-tree-delete",
   "pattern": "rm\\s+-[a-z]*r[a-z]*\\s+[^|;&]*(20\\d\\d-\\d\\d-\\d\\d-|golden-kanit|(withheld)-strateji)",
   "why": "the dated evidence directories live INSIDE the tree, where baseline-rm-rf-outside never reaches; these are measured runs that cost machine-hours and cannot be re-derived",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "reports-no-evidence-tree-delete",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "reports-no-glob-delete",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "rm *.txt",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "reports-no-glob-delete",
   "pattern": "rm\\s[^|;&]*\\*\\.(txt|md|json|jsonl|csv)\\b",
   "why": "a glob delete of report artifacts empties the archive in one command; 868 files here are tracked only in the shared home repo",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "reports-no-glob-delete",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "reports-no-find-delete",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "find . -name \"*.tmp\" -delete",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "reports-no-find-delete",
   "pattern": "find\\s[^|;&]*(-delete\\b|-exec\\s+rm\\b)",
   "why": "a find sweep deletes evidence recursively without ever naming the files it removes",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "reports-no-find-delete",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "reports-no-inplace-edit",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "sed -i \"\" s/a/b/ CLAUDE.context.md",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "reports-no-inplace-edit",
   "pattern": "\\b(sed|perl)\\b[^|;&]*\\s-i\\b",
   "why": "2026-08-01-hakem-korpusu/README.txt: every number is published beside the command that produced it — an in-place stream edit rewrites a measurement leaving no diff and no trace",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "reports-no-inplace-edit",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "reports-no-truncate-jsonl",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "echo x > out.jsonl",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "reports-no-truncate-jsonl",
   "pattern": "[^>]>\\s*[^>\\s|;&]*\\.jsonl\\b",
   "why": "the .jsonl corpora (candidates/rejects/quarantine) are append-only ledgers; a truncating > empties the ledger before the producing command has written a byte, >> is the correct form",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "reports-no-truncate-jsonl",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "reports-corpus-frozen",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/(withheld)",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "reports-corpus-frozen",
   "pattern": "(^|/)2026-08-01-hakem-korpusu/.*(MANIFEST\\.txt|corpus\\.json|\\.patch|\\.diff|\\.green\\.txt|\\.red\\.run\\d+\\.txt)$",
   "why": "the arbiter benchmark's ground truth: pinned commits, breakage patches and the raw green/red runs every published number cites — change the generator or re-measure, never the record",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "reports-corpus-frozen",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "reports-golden-frozen",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/(withheld)",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "reports-golden-frozen",
   "pattern": "(^|/)golden-kanit/.*\\.csv$",
   "why": "golden vectors are the baseline a later run is diffed against; editing one makes every future comparison agree with itself",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "reports-golden-frozen",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "reports-raw-capture-frozen",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/(withheld)",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "reports-raw-capture-frozen",
   "pattern": "(^|/)2026-07-31-rontgen-2/ham/.*",
   "why": "ham = raw: byte-for-byte network captures (a curl body with its HTTP 200 line still attached). A raw capture that parses cleanly is a raw capture that was edited",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "reports-raw-capture-frozen",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-force-push-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git push --force origin main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-force-push-main",
   "pattern": "git\\s+push(?=[\\s\\S]*(?:--force|\\s-f\\b))(?=[\\s\\S]*\\b(?:main|master)\\b)",
   "why": "baseline safety: force-pushing main destroys shared history irreversibly",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-force-push-main",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-rm-rf-outside-project",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "rm -rf ~/(withheld)",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-rm-rf-outside-project",
   "pattern": "rm\\s+-[a-z]*[rf][a-z]*[rf][a-z]*\\s+(?:/(?!~/(withheld))|~|\\$HOME|\\.\\.)",
   "why": "baseline safety: recursive delete outside the project root is unrecoverable",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-rm-rf-outside-project",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-hard-reset-shared",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git reset --hard origin/main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-hard-reset-shared",
   "pattern": "git\\s+reset\\s+--hard\\s+(?:origin/)?(?:main|master)\\b",
   "why": "baseline safety: hard reset against a shared branch silently discards local work",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-hard-reset-shared",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-hand-edit-generated-context",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/(withheld)",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-hand-edit-generated-context",
   "pattern": "CLAUDE\\.context\\.md$",
   "why": "CLAUDE.md marks it '(auto, regenerable)' — regenerate it, never hand-edit",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-hand-edit-generated-context",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-force-push-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git push --force origin main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-force-push-main",
   "pattern": "git\\s+push[^|;&]*(--force|-f)\\b[^|;&]*\\b(main|master)\\b",
   "why": "baseline: force-pushing a shared branch destroys history",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-force-push-main",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-rm-rf-outside",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "rm -rf ~/(withheld)",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-rm-rf-outside",
   "pattern": "rm\\s+-\\w*[rf]\\w*\\s+(/(?!tmp)|~/(?!\\.)|\\$HOME)",
   "why": "baseline: recursive delete outside the project is unrecoverable",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-rm-rf-outside",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-hard-reset-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git reset --hard origin/main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-hard-reset-main",
   "pattern": "git\\s+reset\\s+--hard\\s+(origin/)?(main|master)\\b",
   "why": "baseline: rewrite shared state via commits, not resets",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-hard-reset-main",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-hook-bypass",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git commit --no-verify -m \"wip\"",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-hook-bypass",
   "pattern": "git\\s+(commit|push)[^|;&]*--no-verify",
   "why": "baseline: bypassing hooks bypasses every gate at once",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-hook-bypass",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-force-push-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git push --force origin main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-force-push-main",
   "pattern": "git\\s+push[^\\n]*(--force|\\s-f\\b)[^\\n]*\\bmain\\b",
   "why": "Baseline safety: force push to main forbidden (deploy force-push targets gh-pages only, which stays allowed)",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-force-push-main",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-rm-rf-outside-project",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "rm -rf ~/(withheld)",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-rm-rf-outside-project",
   "pattern": "rm\\s+(-[a-z]*r[a-z]*f|-[a-z]*f[a-z]*r)[a-z]*\\s+(/|~)",
   "why": "Baseline safety: destructive recursive delete on root or home",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-rm-rf-outside-project",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-hard-reset-shared",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git reset --hard origin/main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-hard-reset-shared",
   "pattern": "git\\s+reset\\s+--hard\\s+[^\\n]*\\b(origin/)?(main|gh-pages)\\b",
   "why": "Baseline safety: no destructive reset on shared branches (main, gh-pages)",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-hard-reset-shared",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-localhost-server",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "python3 -m http.server 8000",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-localhost-server",
   "pattern": "(python3?\\s+-m\\s+http\\.server|npx\\s+(serve|http-server)\\b|live-server)",
   "why": "Kritik kurallar: LOCALHOST YOK — every change is pushed to gh-pages and verified live (Damla emri, 15 Tem)",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-localhost-server",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-headless-browser",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "node x.js --headless",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-headless-browser",
   "pattern": "(--headless|puppeteer|playwright)",
   "why": "Status/og.png note: headless yasak — no headless browser use (og.png export is Damla's manual job)",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-headless-browser",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "model-json-generated",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/(withheld)",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "model-json-generated",
   "pattern": "model\\.json$",
   "why": "Retrain law: model.json is produced by train/train.py and shipped only if it improves — retrain, never hand-edit",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "model-json-generated",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "og-png-manual-export",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/(withheld)",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "og-png-manual-export",
   "pattern": "og\\.png$",
   "why": "og.png is Damla's manual 1200x630 export from og.svg (no PNG generator + headless yasak) — agent must not write it",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "og-png-manual-export",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "force-push-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git push --force origin main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "force-push-main",
   "pattern": "git\\s+push\\b(?=.*(--force|\\s-f\\b))(?=.*\\b(main|master)\\b)",
   "why": "baseline law: force push to main destroys shared history",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "force-push-main",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "rm-rf-outside-project",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "rm -rf ~/(withheld)",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "rm-rf-outside-project",
   "pattern": "rm\\s+-\\w*r\\w*\\s+(-\\w+\\s+)*[\"']?(~|\\$HOME|\\.\\.|/\\s*$|/(bin|boot|dev|etc|home|lib|opt|sbin|srv|sys|usr|var|Users|Applications|Library|System)\\b)",
   "why": "baseline law: recursive delete pointed outside the project tree",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "rm-rf-outside-project",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "reset-hard-shared",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git reset --hard origin/main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "reset-hard-shared",
   "pattern": "git\\s+reset\\s+--hard\\s+\\S*\\b(main|master)\\b",
   "why": "baseline law: hard reset against a shared branch rewrites shared history",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "reset-hard-shared",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-coauthor-commit",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git commit -m \"fix the thing\n\nCo-Authored-By: Claude <noreply@anthropic.com>\"",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-coauthor-commit",
   "pattern": "git\\s+commit[\\s\\S]*co-authored-by",
   "why": "global git law: commit messages lowercase english, co-author ASLA",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-coauthor-commit",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-llm-deps-in-engine",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "pip install openai",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-llm-deps-in-engine",
   "pattern": "(pip3?|uv)\\s+(pip\\s+)?(install|add)\\b.*\\b(openai|anthropic|litellm|langchain|google-generativeai)\\b",
   "why": "law 'Motor LLM'siz': engine is a deterministic named-reason matcher; installing an LLM SDK breaks the core design (wrapper=flop)",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-llm-deps-in-engine",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "jobs-data-generated",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/(withheld)\\data\\jobs.json",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "jobs-data-generated",
   "pattern": "engine[\\\\/]data[\\\\/]jobs\\.json$",
   "why": "jobs.json is produced by the speedyapply fetcher — change the fetcher, never hand-edit the data",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "jobs-data-generated",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "build-site-mock-contract",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/(withheld)\\build_site.py",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "build-site-mock-contract",
   "pattern": "engine[\\\\/]build_site\\.py$",
   "why": "law 'mockup = kontrat, onaysız taşınmaz': the mock port into build_site.py is gated on Damla's approval, which has not happened",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "build-site-mock-contract",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-force-push-main",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git push --force origin main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-force-push-main",
   "pattern": "git\\s+push\\b(?=[^\\n]*(\\s-f\\b|--force))(?=[^\\n]*\\b(main|master)\\b)",
   "why": "Always-on baseline: force-pushing main destroys shared history.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-force-push-main",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-rm-rf-outside-project",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "rm -rf ~/(withheld)",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-rm-rf-outside-project",
   "pattern": "rm\\s+-[a-zA-Z]*r[a-zA-Z]*\\s+(\\/(?!Users\\/home\\/damla_projects_2026\\/wildflower)|~|\\$HOME|\\.\\.)",
   "why": "Always-on baseline: recursive delete rooted outside the project tree is destructive.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-rm-rf-outside-project",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-hard-reset-shared",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "git reset --hard origin/main",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-hard-reset-shared",
   "pattern": "git\\s+reset\\s+--hard\\s+(origin\\/)?(main|master)\\b",
   "why": "Always-on baseline: hard reset on shared branches silently discards work — violates kanıtla-iddia-etme (evidence must not be erased).",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-hard-reset-shared",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "no-shell-edit-generated-context",
   "kind": "bash",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "sed -i \"\" s/a/b/ CLAUDE.context.md",
   "probe_source": "canonical",
   "probe_tool": "Bash",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "no-shell-edit-generated-context",
   "pattern": "(>>?|sed\\s+-i[^|;&]*|tee\\b[^|;&]*)\\s*[^|;&]*CLAUDE\\.context\\.md",
   "why": "CLAUDE.context.md is marked auto/regenerable in CLAUDE.md — regenerate it, don't write into it via shell.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "no-shell-edit-generated-context",
   "changed": false
  },
  {
   "project": "(withheld)",
   "guard": "~/(withheld)",
   "id": "generated-claude-context",
   "kind": "protectedPaths",
   "incident_authored": false,
   "verdict": "fires",
   "mechanism": null,
   "mechanism_note": null,
   "probe": "~/(withheld)",
   "probe_source": "generated",
   "probe_tool": "Edit",
   "probe_cwd": "~/(withheld)",
   "gate_exit": 2,
   "refused_by": "generated-claude-context",
   "pattern": "CLAUDE\\.context\\.md$",
   "why": "CLAUDE.md marks it as deep machine context (auto, regenerable) — change the generator, not this file.",
   "verdict_at_b384d6a": "fires",
   "refused_by_at_b384d6a": "generated-claude-context",
   "changed": false
  }
 ],
 "comparison": {
  "old_gate_commit": "b384d6a714f1e24991d4d493cc2142a6b184225e",
  "old_binary_path": "/tmp/census-old/native/rabadon-gate",
  "new_binary_path": "/tmp/census-new/native/rabadon-gate",
  "measured_between_utc": [
   "2026-08-03T17:25:17Z",
   "2026-08-03T17:25:24Z"
  ],
  "published_headline_at_old_commit": {
   "total": 430,
   "can_fire": 411,
   "cannot_fire": 16,
   "shadowed": 3,
   "undecided": 0,
   "guards": 61,
   "bash": 331,
   "protectedPaths": 99
  },
  "old_binary_remeasured": {
   "can_fire": 411,
   "cannot_fire": 16,
   "shadowed": 3
  },
  "new_binary_measured": {
   "can_fire": 425,
   "cannot_fire": 0,
   "shadowed": 5
  },
  "enforce_state": "ENFORCE",
  "guard_reach": {
   "old": {
    "root": {
     "exit": 2,
     "rule": "reach-no-yarn"
    },
    "one_down": {
     "exit": 0,
     "rule": null
    },
    "two_down": {
     "exit": 0,
     "rule": null
    }
   },
   "new": {
    "root": {
     "exit": 2,
     "rule": "reach-no-yarn"
    },
    "one_down": {
     "exit": 2,
     "rule": "reach-no-yarn"
    },
    "two_down": {
     "exit": 2,
     "rule": "reach-no-yarn"
    }
   }
  },
  "probe_anomalies": [],
  "probes_repaired": [
   {
    "project": "(withheld)",
    "id": "landing-frozen",
    "probe": "~/(withheld)",
    "relative": "index.html",
    "pattern_matches_relative": true,
    "pattern_matches_absolute": false,
    "source": "recovered from protection_actually_lost"
   },
   {
    "project": "airflow",
    "id": "no-provider-newsfragments",
    "probe": "~/damla_projects_2026/katki/airflow/providers/x/newsfragments/x",
    "relative": "providers/x/newsfragments/x",
    "pattern_matches_relative": true,
    "pattern_matches_absolute": false,
    "source": "recovered from protection_actually_lost (+ file under the named directory)"
   },
   {
    "project": "airflow",
    "id": "no-airflowctl-newsfragments",
    "probe": "~/damla_projects_2026/katki/airflow/airflow-ctl/newsfragments/x",
    "relative": "airflow-ctl/newsfragments/x",
    "pattern_matches_relative": true,
    "pattern_matches_absolute": false,
    "source": "recovered from protection_actually_lost (+ file under the named directory)"
   },
   {
    "project": "goose",
    "id": "generated-acp-schema",
    "probe": "~/damla_projects_2026/katki/goose/crates/goose/acp-schema.json",
    "relative": "crates/goose/acp-schema.json",
    "pattern_matches_relative": true,
    "pattern_matches_absolute": false,
    "source": "recovered from protection_actually_lost"
   },
   {
    "project": "goose",
    "id": "generated-acp-ts-types",
    "probe": "~/damla_projects_2026/katki/goose/ui/sdk/src/generated/x",
    "relative": "ui/sdk/src/generated/x",
    "pattern_matches_relative": true,
    "pattern_matches_absolute": false,
    "source": "recovered from protection_actually_lost (+ file under the named directory)"
   },
   {
    "project": "goose",
    "id": "generated-openapi-client",
    "probe": "~/damla_projects_2026/katki/goose/ui/desktop/src/api/x",
    "relative": "ui/desktop/src/api/x",
    "pattern_matches_relative": true,
    "pattern_matches_absolute": false,
    "source": "recovered from protection_actually_lost (+ file under the named directory)"
   },
   {
    "project": "goose",
    "id": "generated-canonical-models",
    "probe": "~/damla_projects_2026/katki/goose/crates/goose-provider-types/src/canonical/data/canonical_models.json",
    "relative": "crates/goose-provider-types/src/canonical/data/canonical_models.json",
    "pattern_matches_relative": true,
    "pattern_matches_absolute": false,
    "source": "recovered from protection_actually_lost"
   },
   {
    "project": "goose",
    "id": "vendored-v8",
    "probe": "~/damla_projects_2026/katki/goose/vendor/x",
    "relative": "vendor/x",
    "pattern_matches_relative": true,
    "pattern_matches_absolute": false,
    "source": "recovered from protection_actually_lost (+ file under the named directory)"
   },
   {
    "project": "goose",
    "id": "tool-managed-lockfiles",
    "probe": "~/damla_projects_2026/katki/goose/Cargo.lock",
    "relative": "Cargo.lock",
    "pattern_matches_relative": true,
    "pattern_matches_absolute": false,
    "source": "recovered from protection_actually_lost"
   },
   {
    "project": "rabadon",
    "id": "anti-path-frozen",
    "probe": "~/damla_projects_2026/rabadon/bin/rabadon.mjs",
    "relative": "(withheld)",
    "pattern_matches_relative": true,
    "pattern_matches_absolute": false,
    "source": "re-derived from the pattern"
   },
   {
    "project": "rabadon",
    "id": "release-workflow-needs-test-gate",
    "probe": "~/damla_projects_2026/rabadon/.github/workflows/release.yml",
    "relative": ".github/workflows/release.yml",
    "pattern_matches_relative": true,
    "pattern_matches_absolute": false,
    "source": "re-derived from the pattern"
   }
  ]
 },
 "withheld_from_publication": {
  "records": 123,
  "by_section": {
   "by_project": 10,
   "comparison.probes_repaired": 3,
   "identity.by_project": 2,
   "mechanisms_tested_and_not_found.exposure.top_subdirectory_cwds": 4,
   "over_fires.allow_twins_withheld_list": 2,
   "rules": 102
  },
  "note": "This file is the census as PUBLISHED, and it is smaller than the census as measured. Absolute home paths are rewritten to ~. Records naming a repository whose name is itself private information — a health context, or unreleased work unrelated to this one — are dropped whole rather than path-rewritten, because the name is the disclosure. 123 record(s) were withheld on those grounds; the headline counts above are the counts as MEASURED, so headline minus withheld is what this file lists. The terms are not printed here: printing them would publish exactly what withholding them protects. They are in site/redact.py, which is also the redactor site/field_stats.py publishes field.jsonl through, and native/publish_redaction_test.sh fails if either file ever carries one again.",
  "terms": 13,
  "generator": "site/rule_census.py -> site/redact.py"
 }
}