fix(guardrails): decide the root-delete chrt, runuser and chroot overblocks

[kyle-sexton]

Problem

plugins/guardrails/hooks/block-root-delete-target.sh refuses three commands whose launcher reading differs from what the real tool does:

• chrt -r rm -rf / exits 2. chrt with -r expects a priority before the command, so the real tool rejects this line; the guard reads rm as the command.
• runuser -u bob rm -rf / exits 2. Reported by the fix(guardrails): unwrap runuser, taskset and the launcher family in the root-delete guard #4469 lane as rejected by the real tool; confirm on a Linux host before changing.
• chroot /mnt rm -rf / exits 2. This one is deliberate and fail-closed: inside the chroot, / is host /mnt, so the delete removes the new root.

Evidence

Measured this pass (2026-09-27, main a6ba321): all three exit 2, JSON payload on stdin, nothing executed. That the real tools reject the first two lines is the #4469 lane's reading, not re-verified here.

Proposed approach

1. chrt and runuser: leave as is. An overblock of a line the tool itself rejects costs one retry and never a lost file; loosening risks the misreads fix(guardrails): unwrap runuser, taskset and the launcher family in the root-delete guard #4469 guarded against. Close with a documented note in the guard header.
2. chroot: keep refusing (recommended). Deleting a chroot's root is almost never intended from an agent session.

Decisions needed (Kyle)

1. The chroot case was marked user-reserved by the fix(guardrails): unwrap runuser, taskset and the launcher family in the root-delete guard #4469 lane: keep refusing chroot <dir> rm -rf /, or allow it because the target is <dir>, not the host root?
2. Accept the chrt and runuser overblocks as documented?

Acceptance criteria

• The guard header's declared-behavior section records each decision.
• If any case is loosened, the differential shows it is the only verdict that moved.

Constraints and gotchas

• Guards only add refusals; any loosening is an explicit exception and needs Kyle's call.

Context

Source: local handoff item 20260925-070000-guardrails-root-delete-launcher-remainder-after-4469.md, item 2 (retired into this issue and draft 20260925-070000-a). Prior: #4468 / PR #4469.

[kyle-sexton]

Posted from the 2026-09-29 audit of the Cursor run (499 PRs, 2026-09-27 to 2026-09-29). The owner authorized fixing the findings; merging is not authorized. Fix PR: #5340 (draft).

Reopened. This issue reserved two decisions for you under "Decisions needed (Kyle)": keep refusing chroot <dir> rm -rf / or allow it, and accept the chrt and runuser overblocks as documented. #4755 (464dba2, merged by app/cursor) took both recommended options with no comment from you. It keeps all three refusals, records them in the guard header under "LAUNCHER LINES REFUSED BY DECISION", and adds 60 assertions. No verdict moved.

#4755's body also changes the premise: it reports that two of the three lines are not overblocks (a chrt option form under util-linux 2.42 runs the command; runuser -u bob rm -rf / runs the delete under POSIXLY_CORRECT, which it says it measured). The audit did not re-verify those claims.

Decision needed (nothing is implemented)

Question. Ratify #4755's record (keep refusing all three launcher lines), or reverse part of it?

Options.

• A. Ratify: keep the three refusals and the header record, and close.
• B. Allow chroot <dir> rm -rf / (its target is <dir>, not the host root); keep chrt and runuser refused.
• C. Hold until someone re-verifies docs(guardrails): record root-delete chrt/runuser/chroot decisions (#4681) #4755's util-linux and POSIXLY_CORRECT claims on a Linux host, then decide.

Recommendation: A. Basis: the issue's own recommendation for both items; the audit's owner-decision table rates this row "ratify"; no verdict moved, so ratifying changes nothing on main; refusing is the fail-closed side for a root delete. This comment does not state or imply that you have ratified it.

Unblocks. Closing this issue. The wider question, whether launcher-grammar completeness is in scope for this guard at all, is #5341.

[kyle-sexton]

Owner decision (2026-09-29): accepted the recommendation: "A. Ratify: keep the three refusals and the header record, and close."

The owner accepted every standing recommendation on 2026-09-29.

Evidence (origin/main, fetched 2026-09-29): #4755 (464dba2) is an ancestor of origin/main, and plugins/guardrails/hooks/block-root-delete-target.sh carries the "LAUNCHER LINES REFUSED BY DECISION (#4681)" header (line 120) covering chrt and runuser. The chroot refusal is kept as-is. No verdict moves.

Next: closing this issue as completed. Whether launcher-grammar completeness is in scope for this guard stays with #5341.