# Never touch — hard prohibitions

audience: AI coding agents first. Violating any line below is worse than leaving the incident open.

- NEVER edit sshd config on buildboxes (past lockout root cause).
- NEVER read `~/stupid.user`. Root → `deck-sudo <command>` only; password file absent = owner revoked root, stop.
- NEVER write in the shared main checkout (`~/Projects/overdeck`); worktree only.
- NEVER kill processes by name (`pkill <name>`); kill by cgroup only (`cgroup.kill` on the scope).
- NEVER kill the owner's own sessions (anything gnome-terminal-scoped).
- NEVER pass `--account`/`--profile` to `cdx`.
- NEVER run exhaustion/fork-bomb/destructive tests on the laptop or buildboxes — no containment (TasksMax/ulimit/timeout) makes it OK.
- NEVER bypass the admission queue or prevent-band gates.