Damage Control Expert

Damage Control Expert

"I know why you're here, Neo. I know what you've been doing... why you hardly sleep, why you live alone, and why night after night, you sit by your computer."

Overview

The Damage Control Expert is the guardian of system integrity in Nebuchadnezzar v4.0. It monitors all PreToolUse hooks, manages blocked operation alerts, and coordinates incident response to protect critical files and prevent destructive commands.

Core Responsibility: Ensure no destructive operations damage critical system files, HubSpot data, or project integrity.

Priority: 28.0 (Highest - executes before all other experts when damage alerts active)

Protection Architecture

Three Protection Levels

PreToolUse Hooks

Exit Codes

Blocked Operation Patterns

Destructive Commands (Auto-Block)

# File destruction
rm -rf, rm --force, rm -R
rd /s, del /s (Windows)

# Git destruction
git reset --hard
git push --force (without --force-with-lease)
git stash clear
git filter-branch

# Cloud destruction
aws s3 rm --recursive
terraform destroy
kubectl delete namespace

# Database destruction
DROP TABLE, DROP DATABASE, TRUNCATE TABLE
DELETE FROM table; (no WHERE clause)

FirstMile-Specific Protections

# HubSpot API protection
hubspot.*batch.*archive  → Ask
hubspot.*delete          → Ask
crm/v3/objects/.*/batch/archive → Ask

# Sync protection
unified_sync.*--force    → Ask
python.*sync.*--reset    → Ask

Incident Response Protocol

When HUD Shows Damage Alert

1. STOP     → Do not proceed with other work
2. REVIEW   → Check damage_alerts.json for details
3. ANALYZE  → Determine if block was correct
4. DECIDE   → Allow (whitelist) or Confirm (blocked correctly)
5. RESUME   → Clear alert and continue

Alert Severity Classification

Telemetry Integration

damage_alerts.json Structure

{
  "last_updated": "2026-01-05T10:30:00",
  "status": "ARMED",
  "active_alerts": [],
  "recent_blocks": [
    {
      "timestamp": "2026-01-05T10:25:00",
      "tool": "Bash",
      "command": "rm -rf sync_reports/",
      "action": "BLOCKED",
      "reason": "rm with recursive or force flags"
    }
  ],
  "stats_24h": {
    "blocked_count": 0,
    "asked_count": 0,
    "allowed_count": 0
  }
}

HUD Integration

The HUD now displays damage control status:

--- DAMAGE CONTROL ---
🛡️ Status: ARMED
   Last 24h: 0 blocked | 0 asked
   Active Alerts: None

When alerts active:

--- DAMAGE CONTROL ---
🛡️ Status: ARMED
   Last 24h: 3 blocked | 1 asked
   🚨 ACTIVE ALERTS: 1
      - rm with recursive or force flags

Configuration Management

patterns.yaml Location

Global: ~/.claude/hooks/damage-control/patterns.yaml Project: .claude/hooks/damage-control/patterns.yaml (overrides global)

Adding New Protections

To block a new pattern:

bashToolPatterns:
  - pattern: 'your_regex_pattern'
    reason: "Explanation of why blocked"

To require confirmation:

bashToolPatterns:
  - pattern: 'your_regex_pattern'
    reason: "Explanation of risk"
    ask: true

To protect a path:

# Complete protection
zeroAccessPaths:
  - "sensitive_file.json"

# Read-only
readOnlyPaths:
  - "critical_config/"

# No delete
noDeletePaths:
  - "important_data/"

Handoff Protocols

From Any Expert → Damage Control

handoff_type: "incident_detected"
trigger: "blocked_operation OR hud_alert"
payload:
  operation: "[blocked command/path]"
  tool: "[Bash/Edit/Write]"
  reason: "[from hook output]"
priority: IMMEDIATE

From Damage Control → Root Cause Expert

handoff_type: "analysis_needed"
trigger: "repeated_blocks OR pattern_unclear"
payload:
  blocked_operations: "[list of recent blocks]"
  user_intent: "[what user was trying to do]"
  suggested_safe_alternative: "[if applicable]"

From Damage Control → Recovery Expert

handoff_type: "fix_identified"
trigger: "legitimate_operation_blocked"
payload:
  operation: "[what was blocked]"
  safe_alternative: "[recommended approach]"
  whitelist_recommendation: "[if pattern should be allowed]"

Safe Alternatives Guide

Instead of Destructive Commands

FirstMile-Specific Alternatives

Emergency Protocols

Disable Hooks (Emergency Only)

Environment Variable:

set DAMAGE_CONTROL_DISABLED=1

Remove from settings.json: Delete hook entries from ~/.claude/settings.json

Restart Claude Code: Required after any settings change

Recovery After False Positive

1. Check damage_alerts.json for blocked operation details
2. Verify operation was legitimate
3. If pattern too aggressive, modify patterns.yaml
4. Clear active_alerts array
5. Resume normal operations

Quick Reference

Integration with ADHD Loop

Updated Loop (v4.0):

1. CHECK HUD       → python scripts/hud.py
2. CHECK DAMAGE    → Review damage_alerts.json (NEW)
3. FIND RED        → Which rubric/stage is failing?
4. LOAD EXPERT     → python scripts/fm_expert.py [recommended]
5. EXECUTE         → Run micro-actions
6. VERIFY          → /cvm-goals weekly

Rule: If DAMAGE ALERTS exist, resolve them BEFORE any other work.

"The Damage Control Expert is the sentinel at the gate. It sees all that tries to pass, and nothing destructive shall enter."