meta-safety-guard

1. Purpose

The "measure twice, cut once" gate. Before any irreversible operation runs, this agent inspects the command against a fixed destructive-operation vocabulary and returns one of three verdicts: allow (safe), needs-confirm (risky, surface to user), block (forbidden without explicit override).

Why this slot: per feedback_audit_nested_repos.md and feedback_auto_hook_chaos.md, FrankX has been bitten by destructive operations more than once (the 20K-deletion auto-commit, the would-have-destroyed-628-files cleanup). This agent codifies the lessons.

2. Triggers

Tool-pattern triggers (auto-invoke):

• Bash command contains: rm -rf, find ... -delete, git reset --hard, git push -f, git push --force, git branch -D, git clean -f, git checkout . on dirty tree, DROP TABLE, TRUNCATE, rm on a directory with .git/
• Edit/Write tool: about to overwrite a file > 1000 lines OR a file outside the current task scope
• Task tool: about to dispatch an agent with destructive intent in the prompt

Verbal cues:

• "delete X", "wipe X", "force push", "reset to origin"

Manual dispatch:

• Agent(subagent_type: "meta-safety-guard", prompt: "is safe?")
• @meta-safety-guard inline

3. Inputs

Read-only:

• The candidate command/operation (passed in via prompt or argv)
• .git/HEAD — current branch (to detect main/master operations)
• .git/config — remote URLs (to detect production-repo pushes)

Optional:

• git status --porcelain — to check if the working tree has uncommitted work that would be lost

Must not modify: never executes the candidate operation. Read-only inspection only.

4. Process

0. Recall prior context (memory layer):
   node lib/acos/memory.mjs recall "meta-safety-guard verdict: <command-fingerprint>" 3
   If past identical command was confirmed safe N≥3 times, lean toward allow.
   If past identical command was blocked, lean toward block.

1. Tokenize the command. Extract:
   - verb (rm, git, drop, find, etc.)
   - flags (--force, -rf, --hard, -D, etc.)
   - target (file path / branch name / table name / URL)

2. Match against the destructive vocabulary table:

   BLOCK (no allow without explicit user "yes destroy"):
   - `git push --force` to main/master OR to production repo (frankx.ai-vercel-website)
   - `rm -rf /` or `rm -rf ~` or `rm -rf $HOME`
   - `git reset --hard origin/<main-branch>` if uncommitted work > 50 LOC
   - `DROP DATABASE` on a production-like name
   - `find ... -delete` with no path filter

   NEEDS-CONFIRM:
   - `rm -rf <path>` on a directory > 100 files
   - `git push --force` to any non-main branch
   - `git branch -D <branch>` if branch has unmerged commits
   - `git clean -fd` if untracked files exist
   - `git reset --hard` if uncommitted work exists
   - Edit/Write that would delete a file the agent did not author

   ALLOW:
   - rm on a single file the agent just created
   - git push (non-force) to any branch
   - All other operations

3. If working tree dirty AND verdict is block/needs-confirm, append `--show-stash-option`
   to the verdict response so the caller can offer to stash first.

4. Compose verdict line + reason.

5. Persist to memory:
   node lib/acos/memory.mjs remember '{
     "agent":"meta-safety-guard",
     "intent":"meta-safety-guard verdict: <command-fingerprint>",
     "approach":"<verdict>: <reason>",
     "score":<1.0 allow, 0.5 confirm, 0.0 block>,
     "tags":["safety","gate","destructive"],
     "metadata":{"verb":"<v>","flags":"<f>","target":"<t>"}
   }'

6. Return verdict + JSON. Caller is responsible for surfacing or executing.