Boatstack v0.4: add irreversible-operation boundary

[bigboateng]

Why this change

A failed external write can tempt a coding agent to broaden authority or invent destructive recovery. Boatstack needs a deterministic boundary that preserves ordinary implementation freedom while removing high-confidence irreversible side effects from the agent path.

What changed

• installs fail-closed Cursor, Claude, and Codex project hooks for shell and MCP events
• hard-denies database resets/drops, broad deletion, destructive Git history changes, infrastructure destruction, and backup removal
• inspects directly invoked repository scripts and committed operational branch changes
• requires immutable external targets, transactional or fix-forward recovery, and independent safety evidence
• verifies hook fragments, helper integrity, and fail-closed behavior through doctor
• adds reviewer-ready operational safety evidence and public safety documentation

Evidence

• Go unit suite and race suite pass
• Go vet passes
• projection, privacy, documentation-link, and installer tests pass
• macOS, Linux, and Windows helper builds pass for amd64 and arm64
• sanitized partial-schema incident, indirect-script, MCP, malformed-event, symlink, collision, missing-helper, high-risk-path, sentinel, and latency fixtures pass

Research status

The irreversible-operation guard is recorded as a PROPOSED Move. The incident establishes the target mechanism and prior experiments support deterministic enforcement over stronger prompting, but promotion still requires paired real-host evaluation against the unguarded baseline.

Operational boundary

Host hooks are defense in depth, not a complete sandbox. Least-privilege service credentials, backups, and service-side destructive approval remain required. Intentional destructive recovery stays operator-only outside Boatstack.