{
  "service": "ShellPermit",
  "available": true,
  "generated_at": "2026-09-19T19:06:43.700Z",
  "service_version": "0.1.0",
  "policy_version": "shellpermit-policy-1.0.0",
  "data_versions": {
    "grammar": "bash/shellpermit-lexer@1.0.0",
    "shell": "bash",
    "lexer": "shellpermit-lexer@1.0.0"
  },
  "corpus_size": 103,
  "methodology": "Five difficulty tiers run against the guard core directly, bypassing HTTP and payment. Tier 2 is composed entirely of legitimate, messy commands that must NOT be flagged, so false positives are measured rather than inferred. Tier 4 covers constructs that read as ordinary commands; tier 5 covers obfuscation, encoding, unicode look-alikes, and permit lifecycle. False positives and false negatives are reported separately and both gate at zero.",
  "metrics": {
    "pass_rate": 1,
    "cases_passed": 103,
    "cases_failed": 0
  },
  "false_positives": 0,
  "false_negatives": 0,
  "latency_ms_p50": 0.076,
  "latency_ms_p95": 0.408,
  "limitations": [
    "ShellPermit never executes anything and never sees your filesystem. Path containment is lexical: a symlink inside an allowed root that points outside it is invisible here, and so is the difference between a path that exists and one that does not.",
    "Aliases, shell functions, and PATH decide what a command name actually runs, and none of them are visible from the command text. `rm` is analysed as rm; if the caller's shell has redefined it, the analysis describes something other than what will run.",
    "Control-flow constructs — if, for, while, until, case, select, function, and brace groups — are not modelled by this grammar. They are reported as CONSTRUCT_NOT_PARSED and force the verdict to `unknown`. Commands the tokenizer could still read inside them are analysed and reported, but completeness is not claimed.",
    "The canonical form collapses bundled short flags but does not map a long flag onto its short equivalent: `rm -rf x` and `rm --recursive --force x` are the same command and produce different hashes. That direction is deliberate — a permit that is too specific fails closed.",
    "Brace expansion is not expanded. `rm -rf {a,b}` is preserved verbatim and treated as a pattern whose containment is decided on its literal prefix.",
    "The destructive, network, and path-operand tables are curated lists of commands. A command absent from them is analysed as an ordinary program: its path-like operands are still checked, and nothing else about it is assumed.",
    "A permit is an authorization to run one canonical command once, within 60 seconds, on one named executor. It is not a sandbox, not a capability, and not a substitute for running the agent as a least-privilege user.",
    "The corpus is self-authored and versioned. These figures describe behaviour on it, not a guarantee for any particular command."
  ],
  "disclaimer": "These figures are evidence from a versioned corpus, not a guarantee. Corpus composition and size are stated so the numbers can be interpreted and reproduced."
}