LAWDE Shield · Documentation

.lawdeignore Protocol (Nuclear Abort)

Nuclear Abort is LAWDE Shield’s .lawdeignore boundary: matching stack paths immediately stop GitHub fetch and LLM grounding for that event so sensitive code never enters Athena — aligning with 0 bytes durable source retention.

What is Nuclear Abort?

Nuclear Abort is the fail-closed reaction when any frame path matches a synced .lawdeignore rule (gitignore syntax). Beacon and Athena stop; the scrubbed log still lands so you know a restricted crash occurred.

StageOn match
BeaconNo GitHub source fetch
AthenaNo LLM grounding / fix payload
Durable storeScrubbed log only (0 bytes source)

How it works

  1. File location: repository root (same level as .gitignore).
  2. Syntax: gitignore-compatible globs — src/payments/**, *.env, **/*.key.
  3. Sync: when Beacon maps a repo, LAWDE fetches and caches .lawdeignore. Re-sync anytime from Restricted Zone or Profile → Security.
  4. Enforcement: matching frames trigger Nuclear Abort:
    • No GitHub code fetch
    • No AI analysis
    • Only the scrubbed log is stored

Example file

text
# .lawdeignore - same syntax as .gitignore
# Paths matching these globs trigger a Nuclear Abort
# (no GitHub fetch, no LLM / RAG on those frames)

# Secrets & env
*.env
*.env.*
**/.env

# Payment / PCI surfaces
src/payments/**

# Crypto & private keys
lib/crypto/*.key
**/auth/private_keys.pem
config/secrets.json