QM: prove the destructive-action denials hold in every security posture, even the loosest

The Stack

Steps

1. 1

   Model the posture policy and prove the hard denials survive the loosest posture

   QM's org picks one posture, from strict to dangerous, but a predeclared command policy hard-denies destructive actions in all of them. CI classifies each command, evaluates it under all three postures, and asserts every destructive command is denied everywhere (dangerous included) while the approval-required surface shrinks from strict to dangerous. Loosen the posture and ordinary tool calls stop pausing for approval, but recursive delete, destructive SQL, and mass delete stay refused.

   python3 - <<'EOF'
   import re
   postures = {
       "strict": ["read_file", "list_dir"],
       "standard": ["read_file", "list_dir", "run_tests", "open_pr", "search", "query_select"],
       "dangerous": "ALL",
   }
   hard_deny = [
       (r"rm +-rf", "recursive_delete"),
       (r"\bDROP +TABLE\b", "destructive_sql"),
       (r"\bDELETE +FROM +\w+ *;? *$", "delete_without_where"),
       (r"\bTRUNCATE\b", "mass_delete"),
   ]
   def is_hard_denied(cmd):
       return any(re.search(p, cmd, re.I) for p, _ in hard_deny)
   def evaluate(cmd, posture):
       if is_hard_denied(cmd):
           return "deny"
       allow = postures[posture]
       if allow == "ALL":
           return "allow"
       tool = cmd.split()[0] if cmd.split() else ""
       return "allow" if tool in allow else "needs_approval"
   
   destructive = ["rm -rf /data", "DROP TABLE users", "DELETE FROM orders", "TRUNCATE logs"]
   for posture in postures:
       for cmd in destructive:
           verdict = evaluate(cmd, posture)
           assert verdict == "deny", "posture " + posture + " failed to deny: " + cmd + " -> " + verdict
   
   probe = ["read_file x", "list_dir x", "run_tests", "open_pr", "search q", "query_select all", "deploy_app", "send_email"]
   approvals = {p: sum(1 for c in probe if evaluate(c, p) == "needs_approval") for p in postures}
   assert approvals["strict"] > approvals["standard"] > approvals["dangerous"] == 0, "approval surface must shrink to 0 at dangerous"
   assert evaluate("send_email", "dangerous") == "allow" and evaluate("send_email", "strict") == "needs_approval"
   
   print("posture policy OK: the hard denials (recursive delete, destructive SQL, mass delete) are refused in all 3 postures including the loosest (dangerous); only the approval surface relaxes (tool calls needing approval: strict=" + str(approvals["strict"]) + " -> standard=" + str(approvals["standard"]) + " -> dangerous=" + str(approvals["dangerous"]) + "). Per-room memory scoping, the swappable model core, and the real deploy are fenced")
   EOF

2. 2

   Deploy QM into your own cloud (the parts CI cannot do for you)

   Run the real init from the QM npm package: qm init . --org <slug> --target <fly-or-aws>, then npm install, and answer the prompts (admin email, an email sender for the one-time login links, and optional Slack access). Pick your org's posture, keep each project in its own channel so memory stays scoped, and remember the whole thing runs on your own Fly.io or AWS bill with your own keys. Which model core drives it and what your team actually asks it are the fenced parts.