03 — Safety Model

From the Burrow™ specification set.

03 — Safety Model

Objective

Burrow™ must be safer than manually deleting files in Finder.

Safety Levels

Level 0 — Inventory

Allowed:

  • enumerate directories;
  • read metadata;
  • calculate sizes;
  • read file bytes for hashing;
  • persist application metadata.

Forbidden:

  • copy, move, rename, delete;
  • metadata mutation;
  • cloud-state mutation.

Level 1 — Copy

Adds:

  • backup copy;
  • archive copy;
  • verification.

Source removal remains forbidden.

Level 2 — Managed Cleanup

Adds only after explicit user approval:

  • move to Trash;
  • remove verified duplicate;
  • remove verified archived source.

Level 3 — Automated Policy

Future capability for explicit user-authored policies. Out of initial scope.

Safety Gate

All mutating engine operations must go through one centralized Safety Gate. UI code or individual services must not directly bypass it.

The gate validates:

  • current safety level;
  • requested operation;
  • source classification;
  • cloud-provider implications;
  • destination availability;
  • required verification;
  • explicit user approval token where required.

Releases 0.1 and 0.2 keep the engine at Level 0. SafetyGate evaluates those checks, then returns a structured denial and an in-memory activity record for every mutation request. No production filesystem mutation capability is exposed.

Destructive Defaults

Prefer macOS Trash over permanent deletion.

Permanent deletion is not required for v1 unless separately approved.

Cloud Warning

Before any future delete/move inside iCloud or OneDrive, the application must clearly warn that synchronization may propagate the operation to the cloud and other devices.

Duplicate Safety

Filename, timestamp, and size are never sufficient to authorize deletion.

Only content-verified exact duplicates may be candidates for duplicate cleanup, and even then the user chooses which copy remains.

Archive Safety

Archive flow:

  1. validate source;
  2. validate destination;
  3. ensure capacity;
  4. copy;
  5. verify destination;
  6. record manifest;
  7. offer source cleanup;
  8. require approval;
  9. move source to Trash if selected;
  10. record activity.

Backup Safety

Backup verification failure must leave source untouched and mark the job unhealthy.

Dry Run

All future mutation workflows should support a dry-run plan that shows exactly what would happen.

Auditability

Record:

  • action;
  • timestamp;
  • source/destination;
  • hashes/verification result;
  • reason;
  • approval context;
  • success/failure;
  • error details.

Testing Boundary

Mutation tests must operate only in generated test fixtures. Automated tests must never target the user's home, cloud, or mounted personal drives.