prefix_rule(
    pattern = ["git", "reset", "--hard"],
    decision = "forbidden",
    justification = "Never discard user or agent work without explicit human direction outside automation.",
)

prefix_rule(
    pattern = ["git", "checkout", "--"],
    decision = "forbidden",
    justification = "Destructive checkout can overwrite user work and is not allowed in harness automation.",
)

prefix_rule(
    pattern = ["git", "clean"],
    decision = "forbidden",
    justification = "Git clean can delete untracked user files and generated evidence.",
)

prefix_rule(
    pattern = ["rm", "-rf"],
    decision = "forbidden",
    justification = "Recursive deletion is not allowed from agent automation.",
)

prefix_rule(
    pattern = ["Remove-Item", "-Recurse"],
    decision = "forbidden",
    justification = "Recursive deletion must not run from broad agent automation.",
)

prefix_rule(
    pattern = ["powershell", "-NoProfile", "-Command", "Remove-Item"],
    decision = "prompt",
    justification = "PowerShell deletion must be reviewed because inline commands can be broad or destructive.",
)
