Stopping agents deleting code nobody agreed to delete

The most expensive thing an agent does is delete something quietly. A session hits a failing test, removes the assertion, and reports that the task is complete. A refactor drops a validation branch because it was in the way. None of this is malicious and all of it is easy to miss, because a deletion in a large diff looks like every other line.

Why deletions are different

An addition that is wrong gets caught by tests, by review, or by production, and it is visible. A deletion that is wrong removes the thing that would have caught it. It is also the least recoverable: finding when a check disappeared means searching history for the absence of something, which no tool makes easy.

The guard

The check runs at commit time and compares two lists: the symbols removed by the commit, and the removals accounted for by the session's stated intent. Anything in the first list and not the second stops the commit with the names printed.

$ git commit -m "add exponential backoff"
aura: 2 removals not accounted for
  - validate_window        src/limits.rs
  - test_rejects_stale     tests/limits.rs
Explain them with 'aura log-intent', or unlock with a passcode.

The important property is that explaining is cheap and skipping is not. Adding a sentence saying the assertion was replaced by a stronger one takes seconds; bypassing the guard in strict mode needs a human with a passcode, and the bypass is recorded.

Keeping it from becoming noise

• Only symbols, not lines. A guard that fires on every deleted line gets disabled in a week.
• Deleting a whole file with a stated reason should pass in one step, not one per function.
• Generated code and vendored directories are excluded, since nobody reviews those deletions anyway.
• The message names what was removed and where. A guard that says "unaccounted deletions" and nothing else teaches people to skip it.

Where it sits in the workflow

Pre-commit, so the deletion never reaches a branch, and again at review, so the branch as a whole can be checked against the goal. Aura ships this as a pre-commit hook with a strict mode that can be locked by a human, meaning an agent cannot turn it off on its own.

See also: reviewing agent pull requests, where deletions are the first thing to read, and intent poisoning, which is the same check from the other side.