From 39e469b6cefd638b135aef0741613f7c49c7a790 Mon Sep 17 00:00:00 2001
From: kidist demessie <kidideme@gmail.com>
Date: Fri, 20 Feb 2026 19:32:33 +0300
Subject: [PATCH] feat(phase-2): implement security boundary and hook
 middleware

- Created .intentignore to protect core system files. - Defined command classification policy in security_policy.json. - Established JSON error protocol for autonomous recovery.
---
 .intentignore                       | 10 ++++++++++
 .orchestration/security_policy.json | 11 +++++++++++
 2 files changed, 21 insertions(+)
 create mode 100644 .intentignore
 create mode 100644 .orchestration/security_policy.json

diff --git a/.intentignore b/.intentignore
new file mode 100644
index 0000000000..a2ada1d8be
--- /dev/null
+++ b/.intentignore
@@ -0,0 +1,10 @@
+# GLOBAL SECURITY BOUNDARY
+.env
+.git/
+node_modules/
+.orchestration/trace_storage.db
+.clinerules
+
+# INTENT-SPECIFIC PROTECTION
+# Prevents the AI from modifying the core orchestration logic
+.orchestration/hooks/
diff --git a/.orchestration/security_policy.json b/.orchestration/security_policy.json
new file mode 100644
index 0000000000..ec4079b38a
--- /dev/null
+++ b/.orchestration/security_policy.json
@@ -0,0 +1,11 @@
+{
+  "version": "1.0.0",
+  "command_classification": {
+    "safe": ["read_file", "list_files", "search_files"],
+    "destructive": ["write_to_file", "delete_file", "execute_command"]
+  },
+  "error_protocol": {
+    "type": "JSON_TOOL_ERROR",
+    "template": "Scope Violation: {intent_id} is not authorized to edit {file}. Request scope expansion."
+  }
+}