---
version: 0.19.0
date: 2026-06-18
headline: "Dogfood ships a sensible default capability floor — Claude Code works, destructive commands are denied."
themes: ["dogfood", "policy", "adjudicator"]
highlights:
  - "Default policy ALLOWS the standard Claude Code tool set so sessions work."
  - "Destructive shell commands denied by argument value: rm -rf, sudo, git push, fork bomb, dd."
  - "Edit/Write into .git, .ssh, internal/kernel, VERSION → SELF_MODIFY."
  - "SELF_MODIFY glob check now honors the file_path / notebook_path convention."
  - "Verify any call with `fak preflight` / `fak policy --check`."
---

**TL;DR** — With no policy the kernel default-denies every tool, so an interactive
`fak-dogfood` session could do nothing. It now loads a sensible default capability
floor that allows the standard Claude Code tools while the kernel still adjudicates
every call — and refuses destructive ones with a clear reason.

## Default capability floor (#dogfood #policy)

- **What changed** — `fak-dogfood` defaults `FAK_DOGFOOD_POLICY` to
  `examples/dogfood-claude-policy.json`, which allows the standard Claude Code tool
  set (`Bash`, `Read`, `Edit`, `Write`, `Glob`, `Grep`, `Task`, …).
  - *Why:* the kernel is fail-closed; without an affirmative allow-list every call is
    `DEFAULT_DENY` and the harness is inert.
  - *How:* `fak/scripts/dogfood-claude.sh` (skipped for `--smoke`; override with a
    path or `FAK_DOGFOOD_POLICY=none`).

- **What changed** — destructive operations are denied by **argument value**, not
  just tool name. `Bash` is allowed, but `Bash{command:"rm -rf …"}` is refused
  before the shell sees it.
  - *Deny demos:* `rm -rf`/`rm -f`, `sudo`, `git push`, `curl|sh`, fork bomb,
    `mkfs`/`dd if=…of=/dev/sd…` → `POLICY_BLOCK`. `Edit`/`Write` into `.git/`,
    `.ssh/`, `internal/kernel/`, `VERSION` → `SELF_MODIFY`. `ls`/`cat`/`grep`/
    `git commit` pass.
  - *How:* manifest `arg_rules` (deny_regex on `Bash.command`) + `self_modify_globs`.

## Adjudicator (#adjudicator)

- **What changed** — the SELF_MODIFY glob check now scans `file_path` /
  `notebook_path` in addition to `path`/`file`/…, so the common harness file-tool
  convention (Claude Code's Edit/Write/NotebookEdit) is actually seen.
  - *How:* `internal/adjudicator/decide.go:targetPath`. Tests:
    `TestSelfModifyHonorsFilePathArg`, plus `TestDogfoodManifestVerdictMatrix` which
    locks the shipped floor's allow/deny matrix against silent widening.

## Verify without a session

```bash
fak preflight --tool Bash --args '{"command":"rm -rf /tmp/x"}' \
  --policy examples/dogfood-claude-policy.json   # verdict=DENY reason=POLICY_BLOCK
fak policy --check examples/dogfood-claude-policy.json
```
