disk-hygiene: PowerShell guard misses move/rename/overwrite/format spellings

[kyle-sexton]

Summary

The PowerShell guard's mutation-spelling regex only catches delete/recycle spellings, so on Windows
— where the PowerShell lane is the real deletion/handoff path — common destructive operations get
no ask gate and pass silently.

Details

• destructive_guard.py:217-223 (_POWERSHELL_MUTATION_WORDS) covers remove-item, rm, rmdir,
  del, erase, rd, ri, clear-content, rimraf, unlink, recycle-bin/::delete spellings.
• It does not cover: Move-Item/move/mv, Rename-Item, Set-Content/Out-File/>
  redirection (overwrite), Remove-ItemProperty, Clear-Disk/Format-Volume, or New-Item -Force
  (which truncates an existing file).

The lane is documented as "raised bar, not fail-closed" (safety-model.md:63-66), which is a
deliberate design choice — but a silent move/overwrite of an approved-adjacent path during a manual
handoff is exactly the kind of destructive slip the lane is meant to surface.

Suggested fix

Extend the mutation-spelling set to include move/rename/overwrite/format spellings (at least
Move-Item/mv, Rename-Item, Out-File/Set-Content, New-Item -Force, Format-Volume/
Clear-Disk), surfacing the same ask bar. Document the covered set.

Severity

MEDIUM (security) on Windows; LOW elsewhere.

[kyle-sexton]

This was generated by AI (triage lane — gate-audit claim). Claiming this item for one gate-audit cycle: an independent panel re-classifies whether the needs-human / status: needs-decision gate is still warranted, or whether the item is C2/C3 and liftable to agent-ready. Outcome comment follows in this cycle.

[kyle-sexton]

This was generated by AI (triage lane — gate audit). Independent panel: two fresh-context agents (one fable, one opus), each given only the issue content and the repo's own plugins/autonomy/reference/guardrails/work-classes.md, plus the triage lane's own read. This lane never executes work items, authors fixes, or merges.

Gate audit: GATE UPHELD — C3 shape, security-surface floor

Panel: 2-of-2 STAYS-GATED. Lane read concurs.

Both legs agree the fix is well briefed — a named list of spellings to add to _POWERSHELL_MUTATION_WORDS — and one confirmed the gap live: the set still covers only delete/recycle spellings, with no move/rename/overwrite/format coverage.

The gate holds anyway because the edit lands in destructive_guard.py's mutation-detection set, which is the guard-bypass surface itself. A regex mistake either re-opens silent destructive slips or false-blocks the handoff lane. Well-briefed does not clear a security floor; it just means the human review will be short.

Decision required

How far to widen the covered set — the issue says "at least," which is an open scope.

RECOMMENDED — add the unambiguously destructive spellings now and defer the overwrite spellings. Land Move-Item/mv, Rename-Item, New-Item -Force, Format-Volume/Clear-Disk, each with a per-spelling contract test, and human-review the diff. Hold back Out-File/Set-Content/> redirection: those fire on ordinary file writes and would raise an ask on routine work, and prompt fatigue on a safety gate is itself a safety regression.

Alternative — include the overwrite spellings too, accepting a materially higher prompt rate on Windows. Choose this if silent overwrite is considered as damaging as silent deletion in this environment.

Note both legs independently landed on the same split, from different reasoning.

[kyle-sexton]

This was generated by AI (triage lane — claim release). Gate-audit cycle complete for this item; the triage claim posted earlier this cycle is released. No lease is held — another instance or lane may pick this up immediately. The outcome comment above this one carries the classification and either the lift rationale or the decision summary.

[kyle-sexton]

Drain: tracked by open PR #2470 fix(disk-hygiene): gate PowerShell move/rename/overwrite spellings (no duplicate opened).