Module anchor

Expand description

How much a write depends on the folder it runs in, for a harness that does not say which folder that is (docs/design/unknown-folder-writes.md §4–§6).

Pure: a path and a level in, an answer out. The ambient state (which level is in force, what a command wrote) lives in folder.

Enums§

Anchor: How much one write depends on the folder the command runs in.
FolderLevel: How far writes are approved when the folder is unknown. A second dial beside --level: a command passes when it passes both, and this one never loosens what --level refuses.
Use: What a resolved path is used for, which is also the face of a region role it reads.

GIT_HOOKS: githooks(5) as of Git 2.51 (researched 2026-10-08). Matched only below a hooks segment, so the command runs in .git and writes hooks/pre-commit.
NAMED_FILES: Files whose name means the same thing in whichever folder they sit, beyond what the region table pins: OpenSSH’s per-user files (ssh(1) and sshd(8) FILES, OpenSSH 10.2, researched 2026-10-08) other than config, GnuPG’s (gpg(1) FILES, 2.4), fish’s startup file, and the hook and permission files Claude Code and Codex read from their own folders (hooks.json, settings.local.json, Codex’s rules/default.rules). config and config.toml are left out on purpose: they are the accepted risk §6 names, since names that common cannot be refused everywhere.

of_path: The anchor value of path as written, relative to the folder the command runs in.
placement: Where path, relative to the unknown folder, is classified for use_ at level: a path relative to the workspace root, which the ordinary classifier then judges, or None to leave it in the unknown folder, where no write lands inside anything.
read_is_secret: Whether a READ of the segments could be a secret under any folder: a node of the credential shield as written or under ~, the end of one (Keychains/login.keychain-db from ~/Library), a key file (id_rsa) or a file a shield node pins (credentials). Reads of other sensitive names (.gitignore, .github/) are ordinary, so only these stay refused.