# Safety contract

`rao` is a non-destructive filesystem inventory tool.

## Scanned paths

The scanner only enumerates directory entries and reads filesystem metadata. It
does not expose commands or code paths that delete, rename, move, truncate,
change permissions, change ownership, or modify file contents.

Symbolic links are not followed unless `--follow-symlinks` is explicitly used.

## Report output

The only intentional filesystem write is a path explicitly supplied with
`--out`. By default, `rao` uses create-new semantics and refuses to replace an
existing report. Replacing that report requires both `--out` and `--force`.

Stdout output never creates a file; shell redirection remains controlled by the
user's shell.

## Scope of the guarantee

This is an application-level guarantee, not an operating-system sandbox. The
process still inherits the permissions of the account that launches it.