Groundwork Rule

Keep operations inside Groundwork

Complete user-readable behavior generated from the authoritative rule module.

Rule decision

Prevent traversal, absolute-path injection, and escaping symlinks.

Protected

Resolve and validate every target against the application root; Reject traversal, absolute injected paths, and escaping symlinks

Required

Write outside the application root; Create unsafe archive entries

Prohibited

Reject the unsafe target and preserve existing state.

Boundary