---
name: safe-data-ops
description: Guard destructive, bulk, credential, remote, and production operations.
version: 1.0.0
updated: 2026-08-14
---

# Safe Data Operations

Before a risky operation:

1. Resolve the exact target with read-only inspection.
2. Confirm the action is within current user authority.
3. Preserve a recoverable copy or transaction path.
4. Use bounded batches, dry runs, limits, idempotency, and per-item progress.
5. Stop on ambiguity, unexpected scope, low disk, or environmental instability.

Maintain at least 1 GB free on every local or remote machine involved. Check both sides before and
after bulk transfers or large builds, and stop before the floor is crossed.

Never casually delete files or rows, truncate/drop data, hard-reset work, overwrite user content,
clobber concurrent commits, expose secrets, or copy authentication between machines. Preserve bad
or stale artifacts under a `bad-stale-*` label rather than deleting them. Remote inspection is
read-only by default. A stale remote login is not permission to repair, replace, or synchronize
credentials.

Production writes, paid calls, and destructive cleanup require current explicit authority. Historical approval is not authority for a new charge or mutation.

Before every coding-agent launch, resolve the effective `CODEX_HOME`, remove `OPENAI_API_KEY` and `CODEX_API_KEY`, and require the literal ChatGPT-login success state for that same home. If it is absent, stale, rate-limited, quota-limited, or different, emit `AUTH_POLICY_BLOCKED` and do not launch or retry. Never copy, repair, refresh, route around, or substitute remote authentication.

Express sensitive operations as an actor/action matrix enforced by one shared server-side fail-closed helper. Client visibility is presentation, never authorization. Give owners, reviewers, administrators, support agents, and callbacks only their explicit actions; keep product-provider credentials server-side and separate from coding-agent authentication.

For paid work, fully validate before payment middleware, separate preview or quote from costly execution, make challenge/session creation idempotent, verify before settle, and grant only after successful settlement. Persist work and receipt before or atomically with charging, reject production bypasses, share replay protection across replicas, and survive disconnect or restart. No paid check creates spend authority.

When that receipt is also completion evidence, use the one canonical
[evidence receipt schema](../tutorial-verified-done/references/evidence-receipt-schema.md); payment-
specific fields supplement it and never replace its prompt, story, E2E, regression, or twin gates.