Asymmetric data flow

Data flows down. Code flows up. Nothing moves sideways by accident.

Database and uploads move remote → local. Code — the tracked paths — moves local → remote. Anything going against the grain needs an explicit flag and a confirmation.

The word doing the work is “bulk”

What the rule protects against is a write of unbounded extent: one where nobody can say beforehand what will be different afterwards. That is a whole database, and it is the thing cwp does not do.

Individually named items may flow upward, under the full guard set, with every affected item printed before the write. cwp bricks push has replaced global classes on a protected environment since 0.4.0, and cwp content push does the same for a named list of pages. Nobody calls either a breach, and the only structural difference to a page is which table the row sits in. So the rule is:

Bulk database state flows downward. Individually named items may flow upward, under the full guard set, with the affected items listed before the write.

Direction lives on the effect, not on the command

This is the part that makes the guard list complete rather than remembered.

Every operation declares its effects, and each effect says whether it writes locally or remotely. The protected-environment refusal reads that declaration — so it fires on push, deploy, plugins apply, bricks push, content push and content pull, which is a downward command that writes one marker upward.

A guard keyed on the command’s name would have missed that last one, and would have gone on missing it. A guard keyed on the effect could not: the marker write declares writes: "remote", and a structural test fails the build if an effect that declares it does not call the refusal.

What that costs, honestly

cwp content pull against a protected environment needs --force, which reads as absurd until you know what it writes: the uid of anything it adopted, and the hash of what it just took. Both are writes to a production database. cwp says so rather than exempting them because the command is spelled pull.