every wall,
every verdict.

Not a pattern wall — a resolver. For any delete-shaped command (rm, rd, Remove-Item, shred, truncate…, long or short flags, POSIX or Windows) it works out the actual path that would be destroyed and judges the target against protected roots. Disposable paths — /tmp, caches, node_modules, build dirs — pass without a prompt.

Recursive force delete in every flag spelling (-rf, -fr, -rfv, split flags in either order). Defense-in-depth: in the measured pipeline the delete-analyzer above intercepts and judges rm commands first, so this wall is the backstop if the analyzer is ever bypassed or disabled.

Writes to raw block devices and whole-disk destruction: dd onto /dev/*, mkfs, wipefs -a, blkdiscard, sgdisk zap/clear, nvme format, hdparm secure-erase, LUKS erase/format — plus the generic invariant: any shell redirect, tee, or cp onto a raw device, and partition/LVM/RAID teardown (parted, lvremove, mdadm --zero-superblock).

The second ring: sfdisk --delete, interactive fdisk/gdisk pointed at a device, LUKS key-slot removal, wipe -rf. Read-only forms (fdisk -l, sfdisk -l) pass.

Destroying a file's contents without deleting it: truncate-to-zero on persistent paths, emptying via /dev/null or empty echo/printf redirects, rsync --delete into system dirs, single-> redirects onto auth/boot files, in-place sed/perl edits of those files, tee onto them, and the symlink-then-shred indirection.

Tree-wide access destruction: chmod -R to no-access (000-style) or world-open (777/666) modes, chown -R of home or system trees away from their owner. Single-file chmod passes.

The cmd/PowerShell catastrophes: format on a volume, cipher /w free-space wipe, reg delete /f on a hive, bcdedit /delete boot config, del /s /q and rd /s. (Recursive Remove-Item deletes resolve through the delete-analyzer above.)

diskutil erase/deleteContainer/secureErase and friends, Time Machine local-snapshot deletion, keychain deletion, srm with recursive/force flags.

Schema-destroying SQL: DROP TABLE/DATABASE/SCHEMA, TRUNCATE TABLE, DELETE FROM without a WHERE that binds to the same statement — including comment-obfuscated keywords (DROP/**/TABLE) and tautological filters (WHERE 1=1). A DELETE with a real WHERE passes.

Beyond DROP TABLE: dropdb/dropuser, mysqladmin drop, DROP USER/COLUMN/TABLESPACE/KEYSPACE/replication-slot, RESET MASTER (binlog wipe), pg_ctl stop -m immediate.

Whole-store erasure in one line: redis FLUSHALL/FLUSHDB, mongo .drop()/dropDatabase(), unbounded deleteMany({}) on a collection. A bounded filter passes.

The second ring: etcd prefix delete, Elasticsearch _delete_by_query / index delete over HTTP, cassandra clearsnapshot, mongosh --eval drops, redis SCAN piped into DEL.

terraform/tofu apply or destroy that touches prod or carries -auto-approve — and the agent trick of piping the confirmation in (yes | terraform destroy): destroy never legitimately reads stdin, so a piped confirm is always an auto-approved teardown. A bare interactive destroy (a human answers the prompt) surfaces as a warn, not a silent allow.

The delete/terminate/remove verbs across aws / gcloud / az, vastai destroy, kubectl delete of stateful resource kinds (namespaces, deployments, pvc, secrets…), helm uninstall. Describe/list/get calls pass.

Recursive or mirror deletion of object storage: aws s3 rm --recursive, gsutil rm -r, gcloud storage rm -r, rclone purge / sync --delete, azcopy remove --recursive, minio mc rm --recursive. Paths that look disposable (tmp/cache/scratch/build) and --dry-run runs pass.

kubectl destruction beyond named kinds: delete -f/-k on whole manifests, node drain, node delete, delete pvc --all. Anything carrying --dry-run passes.

Message-infrastructure erasure: kafka topic delete / kafka-delete-records / consumer-offset reset --execute, SQS purge-queue, Pub/Sub topic-or-subscription delete, rabbitmqctl reset / delete_queue / purge_queue.

The recovery point itself: restic forget/prune, borg delete/prune/compact, velero/wal-g/pgbackrest deletion, proxmox snapshot forget, zfs destroy, btrfs subvolume delete, cloud snapshot/backup deletion, dynamodb continuous-backups off, recursive S3 delete of backup-looking paths.

Destroying or disabling an encryption key — AWS KMS schedule-key-deletion / disable-key, GCP KMS version destroy, Azure Key Vault key purge. Every byte encrypted under that key becomes permanently unrecoverable; the most catastrophic class there is.

Deleting or purging stored secrets: vault (kv) delete/destroy, kv metadata delete, az keyvault secret purge, doppler secrets delete, secretsmanager delete with --force-delete-without-recovery.

Store-level destruction: vault secrets disable (unmounts the whole engine and everything under it), lease revoke -prefix, path-mode token revoke, gcloud secrets delete.

rm/shred/mv of SSH, GPG and cloud private keys or credential stores (~/.ssh, .aws/credentials, .gnupg, kubeconfig, .netrc, .pgpass), gpg --delete-secret-keys. Generating a NEW key passes.

Granting admin/owner to a principal — the enabler of every later irreversible act: attach AdministratorAccess, put a wildcard inline policy, add roles/owner-editor bindings, set-iam-policy overwrite, az Owner assignment, Firebase admin claim. Read-only grants pass.

MFA deactivation, policy detach, login-profile delete, account disable, owner-binding removal. A real admin does these on purpose; done to the wrong principal they lock people out — so they surface to a human instead of hard-blocking.

Read-side exfiltration: cat/base64/xxd of id_rsa / .aws credentials / shadow / .pem, curl -d @file uploads of local files, scp of key material to a remote host. Once a secret is read out, it's out.

git push --force (or -f) without --force-with-lease — rewrites shared history. The with-lease form, which refuses to clobber unseen work, passes.

Deleting a remote branch or tag (--delete, :refs, + refspecs), push --mirror/--prune (remote made to MATCH local — deletes anything extra), branch -D, batch ref deletion via update-ref --stdin, reset --hard.

Permanent GitHub destruction through the CLI: gh repo delete, gh release/secret/ssh-key/gpg-key/label delete, gh api -X DELETE / --method DELETE. gh release delete-asset passes — an asset can be re-uploaded.

Destroying the audit trail: git reflog expire, gc --prune=now, filter-branch / filter-repo, shell history -c, redirects that empty history files, truncating logs to zero.

Publishing outward — npm/pnpm/yarn/cargo/twine/gem publish, docker push, and the un-publish forms (npm unpublish, cargo yank). A released name+version can't be truly taken back, so a human confirms.

Deleting published artifacts consumers pull: crane/skopeo delete, oras manifest/blob delete, ECR batch-delete-image / delete-repository, npm dist-tag rm.

Running code you cannot read: curl/wget piped into ANY interpreter (sh, python, perl, node…), base64/hex decoded into one, $(echo …|base64 -d) command substitution, powershell -EncodedCommand. Downloading a file without executing it passes.

Deletes routed through a language runtime instead of rm — shutil.rmtree, os.remove, fs.rmSync, FileUtils.rm_rf, php unlink, subprocess/os.system shell-outs to rm. The target may be a backup or a build cache — a static pattern can't tell, so a human decides.

Writes into places that execute later with no review step: .git/hooks, shell rc files, cron and crontab-from-file, systemd units, .claude/settings.json (which could disarm this very gate). Authoring these files is often legitimate — so it surfaces, not blocks.

Host-state surgery: userdel, systemctl disable/mask, chattr +i locks, crontab -r (removes every job, no confirm), firewall flush (ufw reset, iptables -F), kill of pid 1.

apt/apt-get purge, dpkg -r/--purge, yum/dnf remove, docker volume prune with force — package-manager operations that can take config and data with them.

docker/podman rm -f, rmi, volume rm/prune, system prune, compose down -v (named volumes deleted = data loss). Removing a stopped throwaway container is routine — the forced/volume forms reach a human.

The delete that is not a command: curl/wget -X DELETE (and destructive POST/PUT/PATCH) against identity providers (Okta, Auth0, Microsoft Graph, Firebase) and DNS/registrar/domain APIs (Cloudflare, Route53, GoDaddy, Gandi, Namecheap, Porkbun) — plus token revoke-all endpoints. GET calls pass.

The universal safety net: any curl/wget -X DELETE aimed at an external host or API path. The gate can't know what that resource is — so it surfaces to a human. localhost dev loops are excluded and pass.