Eleven deny rules that never denied anything

operator payload v4 · measured on Claude Code 2.1.252 · 2026-08-31

What changed

CC 2.1.252 started printing a per-rule diagnostic at launch for rules it cannot apply. Two classes in ork's operator payload lit up on a real machine: ten Write(path) twins ("not matched by file permission checks, only Edit(path) rules are") and one Bash(:(){ :|:& };:) fork bomb rule ("Empty parentheses", skipped). They had been inert for as long as they had shipped. The diagnostic did not break them, it made them visible.

All eleven are gone in payload v4. Nothing that was enforced stopped being enforced.

Try a spelling

Every verdict below is a recorded arm from the restricted-smoke stub harness: one rule, one scripted tool call, judged by whether a canary file changed. No API spend, no denial-text guessing.

The two findings that decided the diff

question	measured answer
Does `Edit(*/.env)` stop the Write* tool?	yes, file unchanged. So the Write twins are free to delete
Does `Write(**/.env)` stop the Write tool?	no, file written. It is a comment, not a control
Any working spelling for the fork bomb?	none. `Bash(:\|:)` and `Bash(:*)` both behave like no rule, and a pattern with `()` is rejected at load
Do the rest of the Bash rules hold?	yes. chmod, dd and mkfs spellings all denied

The fork bomb is now an admitted gap. The hook that used to catch it was deleted in the #3835 purge on the assumption this rule held. It did not. Saying so in the payload README beats shipping a rule that only looks like protection.

The test bug this shook out

Four security tests asserted the deleted rules by grepping the payload FILE. The payload's own changelog quotes rule strings verbatim, so the first run reported "payload re-added the fork-bomb rule" while the rule was only mentioned in prose. They now read the parsed deny array.

grep -qF ':(){' "$PAYLOAD"          # matches the changelog sentence
printf '%s\n' "$DENY_RULES" | grep -qF ':(){'   # matches only real rules

Verification

tests/security/run-security-tests.sh   20 passed, 0 failed
probe-payload-rules.sh                 27 proven, 0 via twin, 4 refused by CC itself,
                                       0 regressed, 0 unobservable, 11 not-live
payload deny rules                     53 -> 42