overview / rules / baseline-delete-not-rm

`baseline-delete-not-rm`

`<verb>` destroys outside the project tree, where git cannot undo it.

what it refuses, and what it lets through

In one line, from native/baseline.h: find -delete, rsync --delete, truncate, dd, shred outside.

The same loss, spelled without the word rm. find -delete, rsync --delete, truncate, dd and shred destroy like rm -r, so they get the rm law's containment test (land_of): inside the project git can undo it.

From the comment in native/baseline.h above the code that decides it.

the refusal, as the agent reads it

rabadon BLOCKED this action.
Rule: baseline-delete-not-rm — `<verb>` destroys outside the project tree, where git cannot undo it
<verb> on '<operand>' resolves to <resolved path>, outside the project tree (<project root>) — <what to use instead>
Adjust the approach instead of retrying the same action.
(only the user can override this: they may add "baseline-delete-not-rm" to disabled[] in .rabadon/guard.json or run `rabadon off`. If this rule looks wrong for the task, stop and ask the user; do not switch supervision off yourself.)

Rendered from the strings in native/baseline.h and the envelope in native/gate_pre.h (Judge::refuse). A word in <angle brackets> is filled in from the command at the moment it is refused.

in watch mode the same verdict is recorded, and nothing is stopped

rabadon (watch) would have blocked this.
Rule: baseline-delete-not-rm — `<verb>` destroys outside the project tree, where git cannot undo it
<verb> on '<operand>' resolves to <resolved path>, outside the project tree (<project root>) — <what to use instead>
Nothing was stopped. `rabadon on` makes this a real refusal.

switching it off

Only the user can switch it off, by id, in the project's guard:

{ "disabled": ["baseline-delete-not-rm"] }

or by pausing supervision with rabadon off, which records the change. Every other rule keeps running.

in the field

1 of the 778 records in the published field dataset (field.jsonl, 2026-07-27 to 2026-08-26) carries this id. STOP is a refusal in enforce mode; WOULD_BLOCK is the same verdict recorded in watch mode, where nothing is stopped.

event	records
STOP	1

Counted from field.jsonl, the file the field page is built from.