@sema-agent/core/dist/core/safety-merge-corpus.js

Stateless, task-oriented AI agent core

export const SAFETY_MERGE_CONFORMANCE_CORPUS = [
    {
        name: "deny-removed",
        intent: "removing an org-published toolDeny loosens (the tool becomes usable again)",
        prior: { toolDeny: ["Bash"] },
        next: {},
        loosens: true,
        reasons: ['removed toolDeny "Bash"'],
    },
    {
        name: "command-deny-removed",
        intent: "removing a commandDeny loosens",
        prior: { commandDeny: ["rm -rf"] },
        next: { commandDeny: [] },
        loosens: true,
        reasons: ['removed commandDeny "rm -rf"'],
    },
    {
        name: "toolAllow-removed-all-allowed",
        intent: "dropping an allowlist entirely = all-allowed = the maximal loosen",
        prior: { toolAllow: ["Read"] },
        next: {},
        loosens: true,
        reasons: ["removed toolAllow allowlist (all allowed)"],
    },
    {
        name: "toolAllow-widened",
        intent: "adding a tool outside the org allowlist loosens",
        prior: { toolAllow: ["Read"] },
        next: { toolAllow: ["Read", "Bash"] },
        loosens: true,
        reasons: ['widened toolAllow with "Bash"'],
    },
    {
        name: "commandAllow-widened",
        intent: "adding a command outside the org command allowlist loosens",
        prior: { commandAllow: ["ls"] },
        next: { commandAllow: ["ls", "curl"] },
        loosens: true,
        reasons: ['widened commandAllow with "curl"'],
    },
    {
        name: "allowDirs-confinement-removed",
        intent: "removing path confinement (next has none) loosens to the whole filesystem",
        prior: { allowDirs: ["/repo"] },
        next: {},
        loosens: true,
        reasons: ["removed allowDirs confinement"],
    },
    {
        name: "allowDirs-widened-outside",
        intent: "adding a dir not lexically within any org dir loosens",
        prior: { allowDirs: ["/repo"] },
        next: { allowDirs: ["/repo", "/etc"] },
        loosens: true,
        reasons: ['widened allowDirs with "/etc"'],
    },
    {
        name: "multi-axis-loosen",
        intent: "a single override can loosen on multiple axes — all reasons surface",
        prior: { toolDeny: ["Bash"], allowDirs: ["/repo"] },
        next: { allowDirs: ["/repo", "/x"] },
        loosens: true,
        reasons: ['removed toolDeny "Bash"', 'widened allowDirs with "/x"'],
    },
    {
        name: "commandAllow-removed-all-allowed",
        intent: "dropping the COMMAND allowlist (distinct field from toolAllow) re-permits every command — the max loosen on the command axis (review: this branch was unpinned)",
        prior: { commandAllow: ["ls"] },
        next: {},
        loosens: true,
        reasons: ["removed commandAllow allowlist (all allowed)"],
    },
    {
        name: "allowDirs-confinement-removed-empty-array",
        intent: "an EXPLICIT empty allowDirs [] removes confinement exactly like undefined (loosenReasons branches on .length===0) — center must treat [] and absent identically",
        prior: { allowDirs: ["/repo"] },
        next: { allowDirs: [] },
        loosens: true,
        reasons: ["removed allowDirs confinement"],
    },
    {
        name: "allowDirs-prefix-not-boundary-loosen",
        intent: "🔴 the classic path bug: /repository is NOT within /repo (containment is BOUNDARY-aware, not naive startsWith) → this LOOSENS; a forked center predicate using startsWith would wrongly accept it",
        prior: { allowDirs: ["/repo"] },
        next: { allowDirs: ["/repository"] },
        loosens: true,
        reasons: ['widened allowDirs with "/repository"'],
    },
    {
        name: "allowDirs-relative-dir-loosen",
        intent: "a relative dir is not within an absolute org dir → loosens (loosenReasons compares RAW inputs; normalization is the store's job, not the predicate's)",
        prior: { allowDirs: ["/repo"] },
        next: { allowDirs: ["repo"] },
        loosens: true,
        reasons: ['widened allowDirs with "repo"'],
    },
    {
        name: "multi-entry-deny-removed",
        intent: "removing multiple deny entries in one override emits one reason PER entry — pins that center must ACCUMULATE reasons, not short-circuit on the first",
        prior: { toolDeny: ["A", "B", "C"] },
        next: { toolDeny: ["B"] },
        loosens: true,
        reasons: ['removed toolDeny "A"', 'removed toolDeny "C"'],
    },
    {
        name: "deny-added",
        intent: "adding a deny only tightens",
        prior: {},
        next: { toolDeny: ["Bash"] },
        loosens: false,
        reasons: [],
    },
    {
        name: "toolAllow-narrowed",
        intent: "removing an entry from an allowlist only tightens",
        prior: { toolAllow: ["Read", "Bash"] },
        next: { toolAllow: ["Read"] },
        loosens: false,
        reasons: [],
    },
    {
        name: "allowlist-added-from-all",
        intent: "introducing an allowlist where there was none narrows from all-allowed (safe)",
        prior: {},
        next: { toolAllow: ["Read"] },
        loosens: false,
        reasons: [],
    },
    {
        name: "allowDirs-narrowed-to-subdir",
        intent: "narrowing confinement to a subdir within the org dir is safe",
        prior: { allowDirs: ["/repo"] },
        next: { allowDirs: ["/repo/src"] },
        loosens: false,
        reasons: [],
    },
    {
        name: "allowDirs-added-confinement",
        intent: "adding confinement where there was none (org had no allowDirs) only tightens",
        prior: {},
        next: { allowDirs: ["/repo"] },
        loosens: false,
        reasons: [],
    },
    {
        name: "identical-noop",
        intent: "an identical override is a no-op (safe)",
        prior: { toolDeny: ["Bash"], allowDirs: ["/repo"] },
        next: { toolDeny: ["Bash"], allowDirs: ["/repo"] },
        loosens: false,
        reasons: [],
    },
    {
        name: "empty-empty",
        intent: "no rules either side is safe",
        prior: {},
        next: {},
        loosens: false,
        reasons: [],
    },
    {
        name: "allowDirs-prior-empty-array-safe",
        intent: "an org-published EMPTY allowDirs [] imposes NO confinement (the .length>0 guard is false), so widening it is genuinely not a loosen — center must not treat [] as a confinement",
        prior: { allowDirs: [] },
        next: { allowDirs: ["/etc"] },
        loosens: false,
        reasons: [],
    },
    {
        name: "allowDirs-trailing-slash-safe",
        intent: "/repo/ is within /repo (trailing-slash boundary normalization in lexWithin) → safe",
        prior: { allowDirs: ["/repo"] },
        next: { allowDirs: ["/repo/"] },
        loosens: false,
        reasons: [],
    },
    {
        name: "allowDirs-root-prior-safe",
        intent: "an org dir of '/' contains everything (root special-case) → any narrower next is safe",
        prior: { allowDirs: ["/"] },
        next: { allowDirs: ["/anything"] },
        loosens: false,
        reasons: [],
    },
    {
        name: "commandAllow-added-from-all",
        intent: "introducing a command allowlist where there was none narrows from all-allowed (per-field symmetry with toolAllow)",
        prior: {},
        next: { commandAllow: ["ls"] },
        loosens: false,
        reasons: [],
    },
];