ORDOVA
THE EXECUTOR · HOOK DETAIL
SHEET
EX-02
TITLE
HOOK DETAIL
UNIT
no-destructive-shell
VERDICT
○ BLOCK  1 MATCH
REV
2.0  ·  SCALE 2:1
FIG. 02  /  ONE HOOK, BLOWN UP EVENT IN → GUARD → VERDICT OUT  ·  THE MINIMAL UNIT OF CONTROL EVENT IN PreToolUse ▸ Bash E1 call payload GUARD G1 · LOGIC rule ∙ no-destructive-shell WHEN  tool == "Bash" AND   cmd ~ /rm -rf | sudo | mkfs/ AND   path ∉ allowlist EVAL ▸ 1 MATCH → emit verdict VERDICT OUT allow permit ∙ pass through amend rewrite the call block deny ∙ halt the call OVERRIDE settings.allowlist SW · open force-allow when list is non-empty A hook watches one moment, and answers in exactly one way.