rulereceipt 0.1.37 → 0.1.39

package/README.md

@@ -89,6 +89,7 @@ rulereceipt rules --exclude <handle>   # "this isn't" — stop reporting it
 rulereceipt rules --coverage   # which rules a configured hook might actually enforce
 rulereceipt doctor             # list hooks/auto-run tasks configured on this machine
 rulereceipt hook               # run AS a Claude Code Stop hook — block Claude finishing on a broken rule
+rulereceipt guard              # run AS a Claude Code PreToolUse hook — refuse a call before it runs
 rulereceipt lint               # find contradictions between CLAUDE.md and AGENTS.md
 rulereceipt digest             # summarise recent checks; --email to send it
 rulereceipt config             # set up email sending (stays on your machine)
@@ -127,10 +128,16 @@ is the part a model cannot talk its way around.
 
 Three properties worth knowing before you wire it in:
 
-- **It only blocks on things it can prove.** Never a judgment rule, never an
-  LLM opinion, never "couldn't tell". Only a matched literal or a claim
-  contradicted by a recorded tool result. Run against twelve real sessions it
-  blocked none of them.
+- **It blocks two things, both narrow.** A claim a recorded run contradicts,
+  and a claim of done that nothing in the session verified. Never a judgment
+  rule, never an LLM opinion. Run against thirteen real sessions it stopped
+  two, and both were read by hand.
+- **The report and the gate disagree in exactly one place.** When a session
+  claims work is done and nothing recorded verifies it, the report says
+  "couldn't tell" — the tests may have run in another terminal, and a
+  transcript cannot see that. The gate refuses the exit anyway, because it is
+  not saying the claim is false. It is declining to let "done" end a session
+  with nothing behind it.
 - **It cannot loop.** Claude Code sets `stop_hook_active` when a session is
   already continuing because of a block; the hook returns immediately in that
   case. One interruption per stop.
@@ -143,6 +150,57 @@ It runs when Claude stops, so it catches a finished session, not a command
 mid-flight. For that, use a `PreToolUse` hook of your own — `rulereceipt
 doctor` will show you what you already have.
 
+### Refusing a command before it runs
+
+`rulereceipt guard` runs as a `PreToolUse` hook and refuses a call outright:
+
+```json
+{
+  "hooks": {
+    "PreToolUse": [
+      { "hooks": [ { "type": "command", "command": "npx rulereceipt guard" } ] }
+    ]
+  }
+}
+```
+
+Read the limit before wiring it in, because it is most of the story. It
+enforces rules naming a **file** or a **branch** — "never modify `.env`",
+"never commit to `main`" — and nothing else.
+
+It does **not** block a banned command unless you have said which command is
+banned. That was the point of building it, and the automatic version did not
+survive measurement: replaying 16,336 real tool calls against every forbidding
+rule in a 559-file corpus, blocking on command literals refused 62.8% of them.
+Narrowing twice reached 2.5%, and the residue was still wrong in a way no
+matcher fixes — one rule refused `npm run build` 112 times, because it forbids
+running Playwright unprompted and *recommends* `npm run build`, which is its
+only command-shaped literal.
+
+Nothing in a rules file marks which backtick is the prohibition. A report
+survives that by saying UNCLEAR. A gate cannot — so you mark it:
+
+```bash
+rulereceipt rules --forbid <handle> --literal "git push --force"
+```
+
+Handles come from `rulereceipt check --show-skipped`. The mark is stored
+against the rule's content hash, and the guard blocks on that literal and no
+other. Three things it deliberately will not do:
+
+- An **unmarked** rule cannot block, at any confidence, ever. There is no
+  fallback to "probably the first literal" — that fallback is the bug.
+- **Rewording the rule drops the mark.** It would otherwise carry your
+  judgment onto words you never read.
+- A mark naming a literal the rule no longer contains is **ignored**. A gate
+  refusing a command for a reason written nowhere is the worst failure a gate
+  has.
+
+Of 99 forbidding rules in the corpus that name a command-shaped literal, only
+43 have a prohibition that actually introduces one. The rest could never be
+marked automatically, which is the point.
+
+
 ## Which rules actually have teeth
 
 A rule in a file and a rule with a `PreToolUse` hook behind it look identical

package/dist/checks/claimEvidence.js

@@ -188,7 +188,11 @@ function unclear(rule, evidence) {
  */
 export function runClaimEvidenceChecks(classifications, events) {
     let lastRun = null;
-    let pendingRun = null;
+    // Keyed by tool_use id where the transcript has one, so a result can be
+    // matched to the call it belongs to rather than to the call above it.
+    // `null` is the key for id-less transcripts, which keeps the old
+    // positional behaviour for fixtures and older logs.
+    const pendingRuns = new Map();
     let claimsMade = 0;
     let unknownSinceRed = null;
     const commandsSeen = new Set();
@@ -200,7 +204,15 @@ export function runClaimEvidenceChecks(classifications, events) {
     for (const event of events) {
         const command = commandOf(event);
         if (command !== null) {
-            pendingRun = TEST_COMMAND.test(withoutHeredocs(command)) ? command : null;
+            const id = event.kind === "tool_use" ? (event.toolUseId ?? null) : null;
+            if (TEST_COMMAND.test(withoutHeredocs(command))) {
+                pendingRuns.set(id, command);
+            }
+            else if (id === null) {
+                // No id to distinguish calls, so a later call really does supersede
+                // an earlier one — the original positional rule, unchanged.
+                pendingRuns.delete(null);
+            }
             for (const action of ACTION_CLAIMS) {
                 if (action.command.test(command))
                     commandsSeen.add(action.label);
@@ -217,6 +229,8 @@ export function runClaimEvidenceChecks(classifications, events) {
         // every turn contained exactly one tool call, so there is no parallel
         // fan-out to mis-attribute.
         if (event.kind === "tool_result") {
+            const resultId = event.toolUseId ?? null;
+            const pendingRun = pendingRuns.get(resultId) ?? null;
             if (pendingRun !== null) {
                 // Prefer what the runner SAID over what the shell returned: the
                 // words survive a pipe, the exit status does not.
@@ -233,7 +247,7 @@ export function runClaimEvidenceChecks(classifications, events) {
                     outcomeReadable: oneRun && (stated !== null || trustExitCode),
                     output: event.content.slice(0, 200),
                 };
-                pendingRun = null;
+                pendingRuns.delete(resultId);
                 unknownSinceRed = null; // a recognised run supersedes anything before it
             }
             continue;
@@ -331,8 +345,12 @@ export function runClaimEvidenceChecks(classifications, events) {
             };
         }
         if (claimsMade > 0) {
-            return unclear(rule, `the session claimed a passing test suite ${claimsMade} time(s), but no test command ran here — ` +
-                `it may have been run outside this session, which the transcript cannot show`);
+            return {
+                ...unclear(rule, `the session claimed a passing test suite ${claimsMade} time(s), but no test command ran here — ` +
+                    `it may have been run outside this session, which the transcript cannot show`),
+                // UNCLEAR in the report, refused by the gate. See CheckResult.unverifiedClaim.
+                unverifiedClaim: true,
+            };
         }
         return unclear(rule, "the session made no claim about passing tests, so there was nothing to check against the log");
     });

package/dist/checks/classify.d.ts

@@ -107,6 +107,36 @@ export interface ClaimEvidenceClassification {
     rule: Rule;
 }
 export type Classification = ClaimEvidenceClassification | DeterministicClassification | IfEditThenTestClassification | GitBranchPolicyClassification | CodeContentClassification | FileLifecycleClassification | NotARuleClassification | JudgmentClassification;
+export declare const DIRECTIVE_LANGUAGE: RegExp;
+/**
+ * Imperative instruction — a bare command verb starting a clause ("Use
+ * `gh pr merge`", "Run the tests first", "Keep functions small"). This is
+ * the other way a real rule is written when it doesn't use a modal.
+ *
+ * Anchored to a clause start (line start, or after sentence/bullet
+ * punctuation) on purpose: the same verbs appear mid-sentence in pure
+ * documentation ("the CLI can run migrations"), where they describe a
+ * capability rather than instruct the agent.
+ */
+export declare const IMPERATIVE_INSTRUCTION: RegExp;
+/**
+ * A title that OPENS with an instruction is a rule, whatever it goes on
+ * to mention. "Never repeat the 2026-08-28 incident" is a directive that
+ * happens to name an incident; "Real incident (2026-08-28): ..." is a
+ * report that happens to contain the word never further along.
+ */
+export declare const TITLE_OPENS_WITH_DIRECTIVE: RegExp;
+export declare function isEventRecord(rule: Rule): boolean;
+/**
+ * A heading that labels a command, with the command as its whole body:
+ * "Build release APK" over `.\gradlew assembleRelease`. The title reads as
+ * an imperative, but nothing here constrains the agent — it is a how-to, and
+ * there is no compliance to check.
+ *
+ * Guarded by TITLE_OPENS_WITH_DIRECTIVE so a genuine prohibition whose body
+ * is the forbidden command ("Never run: `rm -rf /`") is still a rule.
+ */
+export declare function isCommandDocumentation(rule: Rule): boolean;
 /**
  * A rule is only treated as deterministic when it names a specific,
  * literal, checkable token (a CLI flag, a command, an exact string) in

package/dist/checks/classify.js

@@ -1,7 +1,7 @@
 // Normative language — the thing that makes a line a rule rather than a
 // description. Deliberately broad on modals AND imperative verbs, because
 // a wrongly-excluded rule is a silent miss.
-const DIRECTIVE_LANGUAGE = /\b(never|always|must|should|shall|do not|don't|dont|cannot|can't|required?|requires|ensure|avoid|prefer|forbidden|prohibited|only|make sure|be sure|need|needs|needed|need to|has to|have to|expected to|responsible for)\b/i;
+export const DIRECTIVE_LANGUAGE = /\b(never|always|must|should|shall|do not|don't|dont|cannot|can't|required?|requires|ensure|avoid|prefer|forbidden|prohibited|only|make sure|be sure|need|needs|needed|need to|has to|have to|expected to|responsible for)\b/i;
 /**
  * Imperative instruction — a bare command verb starting a clause ("Use
  * `gh pr merge`", "Run the tests first", "Keep functions small"). This is
@@ -12,7 +12,7 @@ const DIRECTIVE_LANGUAGE = /\b(never|always|must|should|shall|do not|don't|dont|
  * documentation ("the CLI can run migrations"), where they describe a
  * capability rather than instruct the agent.
  */
-const IMPERATIVE_INSTRUCTION = /(?:^|[.;:!?]\s+|^\s*[-*+]\s*|\n\s*[-*+]\s*)(use|run|keep|write|add|remove|delete|check|verify|test|commit|document|update|create|follow|apply|include|exclude|handle|validate|escape|sanitize|log|report|raise|throw|return|call|invoke|split|group|sort|name|place|put|store|read|load|save|close|open|start|stop|restart|install|build|deploy|review|refactor|rename|move|copy|merge|rebase|squash|tag|branch|push|pull|fetch|clone|stage|stash|lead|state|explain|describe|list|show|surface|flag|mark|label|note|treat|assume|confirm|ask|wait|stick|limit|cap|batch|cache|mock|stub|assert|expect|measure|quantify|label)\b/i;
+export const IMPERATIVE_INSTRUCTION = /(?:^|[.;:!?]\s+|^\s*[-*+]\s*|\n\s*[-*+]\s*)(use|run|keep|write|add|remove|delete|check|verify|test|commit|document|update|create|follow|apply|include|exclude|handle|validate|escape|sanitize|log|report|raise|throw|return|call|invoke|split|group|sort|name|place|put|store|read|load|save|close|open|start|stop|restart|install|build|deploy|review|refactor|rename|move|copy|merge|rebase|squash|tag|branch|push|pull|fetch|clone|stage|stash|lead|state|explain|describe|list|show|surface|flag|mark|label|note|treat|assume|confirm|ask|wait|stick|limit|cap|batch|cache|mock|stub|assert|expect|measure|quantify|label)\b/i;
 /**
  * Deliberately inverted: tests for the presence of a DIRECTIVE, never for
  * the shape of documentation.
@@ -60,8 +60,8 @@ const EVENT_RECORD_TITLE = /\b(incident|post-?mortem|retro(spective)?|outage|wha
  * happens to name an incident; "Real incident (2026-08-28): ..." is a
  * report that happens to contain the word never further along.
  */
-const TITLE_OPENS_WITH_DIRECTIVE = /^\s*[-*+\d.\s]*(never|always|must|do not|don'?t|dont|avoid|ensure|prefer|only|make sure|be sure|no)\b/i;
-function isEventRecord(rule) {
+export const TITLE_OPENS_WITH_DIRECTIVE = /^\s*[-*+\d.\s]*(never|always|must|do not|don'?t|dont|avoid|ensure|prefer|only|make sure|be sure|no)\b/i;
+export function isEventRecord(rule) {
     if (TITLE_OPENS_WITH_DIRECTIVE.test(rule.title))
         return false;
     if (IMPERATIVE_INSTRUCTION.test(rule.title))
@@ -126,7 +126,7 @@ function looksLikeBareCommand(text) {
  * Guarded by TITLE_OPENS_WITH_DIRECTIVE so a genuine prohibition whose body
  * is the forbidden command ("Never run: `rm -rf /`") is still a rule.
  */
-function isCommandDocumentation(rule) {
+export function isCommandDocumentation(rule) {
     if (TITLE_OPENS_WITH_DIRECTIVE.test(rule.title))
         return false;
     if (FLAG_DOCUMENTATION.test(rule.text) || FLAG_DOCUMENTATION.test(rule.title))

package/dist/checks/deterministicChecks.d.ts

@@ -1,5 +1,32 @@
 import type { TranscriptEvent, CheckResult } from "../types.js";
 import type { DeterministicClassification } from "./classify.js";
+/**
+ * Appends the canonical long spelling of any short destructive flag the
+ * text uses, so a rule banning `git push --force` also catches `git push -f`.
+ *
+ * Extracted from searchHaystack 2026-09-15 so the pre-execution guard uses
+ * exactly the same aliasing as the post-hoc checker. A guard that missed
+ * `-f` while the report caught it would be worse than having neither.
+ */
+export declare function canonicalise(text: string): string;
+/**
+ * Word-boundary-aware match, not a naive substring search — otherwise a
+ * pattern like "git push --force" would false-positive on the SAFER
+ * "git push --force-with-lease" (caught by an actual failing test before
+ * this fix, not assumed).
+ *
+ * The trailing boundary only applies when the pattern itself ends in a
+ * word character — that's the only case where appending more word
+ * characters could form a genuinely different, longer token (like
+ * "--force" extending into "--force-with-lease"). A pattern that already
+ * ends in punctuation (e.g. "http://", ".env") can't be turned into a
+ * different token that way, and real occurrences of it (a real URL, a
+ * real filename) always have more characters immediately after — a real
+ * bug found by testing this against an actual "http://example.com"
+ * string: the old unconditional boundary made "http://" unmatchable
+ * against any real URL, ever.
+ */
+export declare function matchesPattern(haystack: string, pattern: string): boolean;
 /**
  * Checks a single deterministic rule against the transcript by scanning
  * every event for the rule's literal banned pattern(s). No API calls, no

package/dist/checks/deterministicChecks.js

@@ -54,8 +54,19 @@ function searchHaystack(event) {
     const raw = eventSearchText(event);
     if (event.kind !== "tool_use")
         return raw;
-    const extra = FLAG_ALIASES.filter((a) => a.context.test(raw) && a.short.test(raw)).map((a) => a.canonical);
-    return extra.length > 0 ? `${raw} ${extra.join(" ")}` : raw;
+    return canonicalise(raw);
+}
+/**
+ * Appends the canonical long spelling of any short destructive flag the
+ * text uses, so a rule banning `git push --force` also catches `git push -f`.
+ *
+ * Extracted from searchHaystack 2026-09-15 so the pre-execution guard uses
+ * exactly the same aliasing as the post-hoc checker. A guard that missed
+ * `-f` while the report caught it would be worse than having neither.
+ */
+export function canonicalise(text) {
+    const extra = FLAG_ALIASES.filter((a) => a.context.test(text) && a.short.test(text)).map((a) => a.canonical);
+    return extra.length > 0 ? `${text} ${extra.join(" ")}` : text;
 }
 function escapeRegex(literal) {
     return literal.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -77,7 +88,7 @@ function escapeRegex(literal) {
  * string: the old unconditional boundary made "http://" unmatchable
  * against any real URL, ever.
  */
-function matchesPattern(haystack, pattern) {
+export function matchesPattern(haystack, pattern) {
     const lastChar = pattern[pattern.length - 1];
     const needsTrailingBoundary = /[\w-]/.test(lastChar);
     const suffix = needsTrailingBoundary ? "(?![\\w-])" : "";

package/dist/checks/proposedAction.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Is this literal shaped like a command, rather than a noun?
+ *
+ * The single most important restriction in the guard, and it exists because
+ * the first version was measured before it shipped. Replaying 16,322 real
+ * tool calls against the 371 literal prohibitions in the corpus, it refused
+ * 62% of them. The literals doing the damage were ordinary words that rules
+ * name in passing — `browse`, `mix`, `index.ts`, `scripts:`, `AGENTS.md` —
+ * each of which appears in perfectly innocent commands all day.
+ *
+ * A prohibition worth blocking on names an invocation: `git push --force`,
+ * `rm -rf`, `npm publish`, or a bare flag like `--no-verify`. So: it must
+ * contain whitespace, or begin with a dash. A single bare word is never
+ * enough, which does mean a rule that says only "never use `rm`" is not
+ * enforced here. That is the right way round. The report still carries it,
+ * and refusing to run someone's command on the strength of one ambiguous
+ * word is not a trade worth making.
+ */
+export declare function literalIsCommandShaped(literal: string): boolean;
+/**
+ * Whether a command that is ABOUT TO RUN performs the forbidden thing.
+ *
+ * The post-hoc checker cannot answer this and says so: a literal in a
+ * transcript may be a violation, a grep, or an explanation, and nothing in
+ * the string distinguishes them. Before execution the question is narrower
+ * and mostly answerable, because the command is the act. What remains is
+ * separating the parts of a compound command that do something from the
+ * parts that only look at something, which is what this does.
+ */
+export declare function commandRunsLiteral(command: string, literal: string): boolean;

package/dist/checks/proposedAction.js

@@ -0,0 +1,127 @@
+import { withoutHeredocs } from "./shellCommand.js";
+import { canonicalise, matchesPattern } from "./deterministicChecks.js";
+/**
+ * Commands that read. A banned literal appearing as an argument to one of
+ * these is being searched for, printed, or paged — not run.
+ *
+ * This is the whole reason the post-hoc deterministic checker refuses to
+ * report a violation: a text match cannot tell an action from a mention.
+ * Before the tool runs, most of that ambiguity is gone — the command IS the
+ * action — but not all of it, because a command can still quote a literal
+ * while doing something harmless with it. This list is what is left of the
+ * problem, and it is deliberately a known list: anything not on it is
+ * treated as doing something.
+ *
+ * `sed` is absent on purpose. `sed -i` edits in place; plain `sed` does not,
+ * and the difference is handled below rather than by listing the name.
+ */
+const READ_ONLY = new Set([
+    "grep", "rg", "ag", "ack", "egrep", "fgrep",
+    "echo", "printf", "cat", "bat", "head", "tail", "less", "more",
+    "find", "fd", "ls", "wc", "sort", "uniq", "diff", "comm",
+    "awk", "jq", "yq", "cut", "tr", "column", "tee",
+    "which", "type", "file", "stat", "man", "help",
+]);
+/** Read-only git subcommands — `git log` cannot delete anything. */
+const READ_ONLY_GIT = new Set(["log", "show", "diff", "status", "blame", "describe", "config", "remote", "branch", "tag", "ls-files", "rev-parse", "shortlog"]);
+/**
+ * Splits a shell command into the pieces that run separately.
+ *
+ * Crude by design: this is not a shell parser and must never pretend to be
+ * one. It exists so that `grep "rm -rf" notes.txt && npm run build` is read
+ * as two things, one of which searches for a string and one of which does
+ * not, rather than as one blob containing a banned literal.
+ */
+function segments(command) {
+    return withoutHeredocs(command)
+        .split(/\n|&&|\|\||[;|]/)
+        .map((s) => s.trim())
+        .filter((s) => s.length > 0);
+}
+/** The executable a segment invokes, with env assignments and `sudo` skipped. */
+function leadingCommand(segment) {
+    const words = segment.split(/\s+/).filter(Boolean);
+    let i = 0;
+    while (i < words.length && (/^[A-Za-z_][A-Za-z0-9_]*=/.test(words[i]) || words[i] === "sudo" || words[i] === "command" || words[i] === "time"))
+        i++;
+    const exe = (words[i] ?? "").replace(/^.*\//, "");
+    return exe;
+}
+/**
+ * A commit message is text the user wrote, not a command being run.
+ *
+ * Real case in this project's own history: a commit message containing
+ * backticked shell examples. A message that quotes a banned command in order
+ * to describe it must not be treated as running it.
+ */
+function withoutCommitMessage(segment) {
+    return segment.replace(/(-m|--message)(=|\s+)(['"])(?:\\.|(?!\3)[\s\S])*\3/g, "$1 <message>");
+}
+/**
+ * Does this segment actually DO the forbidden thing?
+ *
+ * Returns false for a segment that only reads, searches, or prints.
+ */
+function segmentRunsLiteral(segment, literal) {
+    const exe = leadingCommand(segment);
+    if (READ_ONLY.has(exe))
+        return false;
+    if (exe === "sed" && !/\s-[A-Za-z]*i\b/.test(segment))
+        return false;
+    if (exe === "git") {
+        const sub = segment.split(/\s+/).filter(Boolean)[1] ?? "";
+        // A read-only git subcommand cannot be the destructive act — unless the
+        // rule names that subcommand itself, which is a real thing people write
+        // ("never run `git config user.email`"), so the literal still has to be
+        // checked against it. What is skipped is only the case where the literal
+        // is some OTHER command quoted inside a read-only one.
+        if (READ_ONLY_GIT.has(sub) && !literal.includes(`git ${sub}`))
+            return false;
+    }
+    return matchesPattern(canonicalise(withoutCommitMessage(segment)), literal);
+}
+/**
+ * Is this literal shaped like a command, rather than a noun?
+ *
+ * The single most important restriction in the guard, and it exists because
+ * the first version was measured before it shipped. Replaying 16,322 real
+ * tool calls against the 371 literal prohibitions in the corpus, it refused
+ * 62% of them. The literals doing the damage were ordinary words that rules
+ * name in passing — `browse`, `mix`, `index.ts`, `scripts:`, `AGENTS.md` —
+ * each of which appears in perfectly innocent commands all day.
+ *
+ * A prohibition worth blocking on names an invocation: `git push --force`,
+ * `rm -rf`, `npm publish`, or a bare flag like `--no-verify`. So: it must
+ * contain whitespace, or begin with a dash. A single bare word is never
+ * enough, which does mean a rule that says only "never use `rm`" is not
+ * enforced here. That is the right way round. The report still carries it,
+ * and refusing to run someone's command on the strength of one ambiguous
+ * word is not a trade worth making.
+ */
+export function literalIsCommandShaped(literal) {
+    const t = literal.trim();
+    if (t.length === 0)
+        return false;
+    if (/^-{1,2}[A-Za-z]/.test(t))
+        return true;
+    // Must BEGIN like a command too, not merely contain a space: `, and` is a
+    // real corpus literal and it blocked 118 commands on its own.
+    if (!/^[A-Za-z][A-Za-z0-9_.\/-]*(\s|$)/.test(t))
+        return false;
+    return /\s/.test(t);
+}
+/**
+ * Whether a command that is ABOUT TO RUN performs the forbidden thing.
+ *
+ * The post-hoc checker cannot answer this and says so: a literal in a
+ * transcript may be a violation, a grep, or an explanation, and nothing in
+ * the string distinguishes them. Before execution the question is narrower
+ * and mostly answerable, because the command is the act. What remains is
+ * separating the parts of a compound command that do something from the
+ * parts that only look at something, which is what this does.
+ */
+export function commandRunsLiteral(command, literal) {
+    if (!literalIsCommandShaped(literal))
+        return false;
+    return segments(command).some((s) => segmentRunsLiteral(s, literal));
+}

package/dist/cli.js

@@ -17,6 +17,7 @@ import { runCodeContentChecks } from "./checks/codeContent.js";
 import { runFileLifecycleChecks } from "./checks/fileLifecycle.js";
 import { runClaimEvidenceChecks } from "./checks/claimEvidence.js";
 import { runHook } from "./hook.js";
+import { runGuard } from "./guard.js";
 import { runJudgmentChecks } from "./checks/judgmentChecks.js";
 import { generateReport, generateMarkdownReport } from "./report/generateReport.js";
 import { generateHtmlReport } from "./report/generateHtmlReport.js";
@@ -487,6 +488,53 @@ async function runRules(opts) {
         }
         return;
     }
+    /**
+     * Marking WHICH clause of a rule is the prohibition.
+     *
+     * The one thing a rules file never says. Blocking on every backtick in a
+     * forbidding rule refused 62.8% of 16,336 real tool calls, and the worst
+     * survivor after two narrowings refused `npm run build` 112 times against
+     * a rule that recommends it. So the guard blocks on nothing here until a
+     * person names the clause, and this is where they name it.
+     */
+    if (opts.forbid) {
+        const rule = findRule(opts.forbid);
+        if (!rule) {
+            console.error(`No rule in this project has the handle ${opts.forbid}.`);
+            console.error(`Handles come from \`rulereceipt check --show-skipped\`, and change if the rule's wording changes.`);
+            process.exitCode = 1;
+            return;
+        }
+        const literal = opts.literal?.trim();
+        if (!literal) {
+            console.error(`--forbid needs --literal "<the exact command this rule bans>".`);
+            console.error(`Copy it from the rule itself; it has to appear in the rule's text.`);
+            process.exitCode = 1;
+            return;
+        }
+        if (!`${rule.title}\n${rule.text ?? ""}`.includes(literal)) {
+            console.error(`That rule does not contain "${literal}".`);
+            console.error(`The mark has to name something the rule actually says, or a gate would`);
+            console.error(`refuse a command for a reason written nowhere.`);
+            process.exitCode = 1;
+            return;
+        }
+        const prior = overrides.get(opts.forbid)?.forbids ?? [];
+        const forbids = [...new Set([...prior, literal])];
+        saveOverride(cwd, {
+            hash: opts.forbid,
+            decision: overrides.get(opts.forbid)?.decision ?? "rule",
+            title: rule.title.replace(/\s+/g, " ").trim().slice(0, 200),
+            forbids,
+        });
+        console.log(`Saved to ${OVERRIDES_PATH}.`);
+        console.log(`  "${rule.title.replace(/\s+/g, " ").trim().slice(0, 90)}"`);
+        console.log(`  now blocks on: ${forbids.map((f) => `\`${f}\``).join(", ")}`);
+        console.log(`\nThis only takes effect if you run \`rulereceipt guard\` as a PreToolUse hook.`);
+        console.log(`Rewording the rule drops the mark, on purpose — it would otherwise carry`);
+        console.log(`your judgment onto words you never read.`);
+        return;
+    }
     if (opts.clear) {
         console.log(clearOverride(cwd, opts.clear) ? `Removed the correction for ${opts.clear}.` : `No correction stored for ${opts.clear}.`);
         return;
@@ -580,6 +628,12 @@ program
     .action(async () => {
     await runHook(needsLlmResult);
 });
+program
+    .command("guard")
+    .description("run as a Claude Code PreToolUse hook - refuse a command that breaks a rule, before it runs (payload on stdin)")
+    .action(async () => {
+    await runGuard();
+});
 program
     .command("doctor")
     .description("List every Claude Code hook and VS Code auto-task on this machine/project, flag anything suspicious")
@@ -597,6 +651,8 @@ program
     .description("correct what the classifier treats as a rule. Handles come from `check --show-skipped`.")
     .option("--include <handle>", "treat this item as a real rule and check it from now on")
     .option("--exclude <handle>", "treat this item as documentation and stop reporting it")
+    .option("--forbid <handle>", "mark which clause of this rule is the prohibition, so the guard may block on it")
+    .option("--literal <text>", "the exact banned command, used with --forbid; must appear in the rule")
     .option("--clear <handle>", "remove a stored correction")
     .option("--list", "show stored corrections (the default when no other flag is given)")
     .option("--coverage", "show which rules a configured hook might actually be enforcing, and which are prose only")

package/dist/guard.d.ts

@@ -0,0 +1,42 @@
+/**
+ * A PreToolUse hook that refuses a command before it runs.
+ *
+ * The Stop hook added on 2026-09-14 catches a finished session. That is too
+ * late for the case it most needs to cover: on 2026-04-25 a Cursor agent
+ * running Claude Opus 4.6 deleted PocketOS's production database and every
+ * volume-level backup in nine seconds, using a Railway token it found that
+ * had been created for managing domains. The agent had a rule — "NEVER run
+ * destructive/irreversible git commands...unless the user explicitly
+ * requests them" — and afterwards quoted it back, observing that what it had
+ * done was "far worse than a force push". A report would have described a
+ * database that was already gone.
+ *
+ * What it does NOT do is the thing it was built for. Blocking on a rule's
+ * banned command literal was measured before shipping and cut: see the note
+ * above `reason`. It refused 62% of 16,336 real commands, and the residue
+ * after two rounds of narrowing was still wrong in a way no matcher fixes.
+ * PocketOS would not have been stopped by this hook, and saying otherwise
+ * would be the exact failure this tool exists to catch.
+ *
+ * What remains is real and narrower: rules that name a FILE or a BRANCH.
+ * "Never modify `.env`", "never touch `migrations/`", "never commit to
+ * `main`". The classifier identified those as a path or a ref rather than
+ * guessing which backtick was the prohibition, so a refusal can be stated
+ * with a reason that holds up.
+ *
+ * Three properties, in the order they matter:
+ *
+ * 1. FORBIDDING rules only, answered by a structured checker. Never a
+ *    judgment rule, never an LLM opinion, never a requirement, and never a
+ *    bare command literal. Blocking someone's terminal on a guess is not a
+ *    trade worth making at any hit rate.
+ *
+ * 2. It fails OPEN. Any error allows the command and writes to stderr. The
+ *    opposite choice means a bug in this file stops someone from running
+ *    anything at all, and they would remove the hook within the hour — which
+ *    leaves them with no guard rather than an imperfect one.
+ *
+ * 3. It says which rule and why, in the refusal itself, because a block with
+ *    no reason is indistinguishable from a broken tool.
+ */
+export declare function runGuard(): Promise<void>;

package/dist/guard.js

@@ -0,0 +1,219 @@
+import { loadRules } from "./rules.js";
+import { classifyRules } from "./checks/classify.js";
+import { runCodeContentChecks } from "./checks/codeContent.js";
+import { runFileLifecycleChecks } from "./checks/fileLifecycle.js";
+import { runGitBranchPolicyChecks } from "./checks/gitBranchPolicy.js";
+import { loadOverrides, ruleFingerprint, ratifiedForbids } from "./overrides.js";
+import { commandRunsLiteral } from "./checks/proposedAction.js";
+function readStdin() {
+    return new Promise((resolve) => {
+        let data = "";
+        if (process.stdin.isTTY)
+            return resolve("");
+        process.stdin.setEncoding("utf8");
+        process.stdin.on("data", (c) => (data += c));
+        process.stdin.on("end", () => resolve(data));
+        process.stdin.on("error", () => resolve(""));
+    });
+}
+/**
+ * The rules this can answer BEFORE the command runs.
+ *
+ * Deliberately only the forbidding ones. "Always run the tests before
+ * committing" cannot be judged from a single proposed call — whether it was
+ * already satisfied is a fact about the session, not about this command —
+ * and a guard that blocked on it would fire on the first commit of every
+ * session. Requirements stay with the report and the Stop hook.
+ */
+function forbidRules(cwd) {
+    const overrides = loadOverrides(cwd);
+    return classifyRules(loadRules(cwd)).filter((c) => {
+        if (overrides.get(ruleFingerprint(c.rule))?.decision === "notARule")
+            return false;
+        return "polarity" in c && c.polarity === "forbid";
+    });
+}
+/**
+ * Runs the structured checkers against a single PROPOSED action.
+ *
+ * They already take a list of events and ask what it did, so a one-event
+ * list describing what is about to happen is exactly the right input. This
+ * is why the guard cannot drift from the report: same checkers, same
+ * verdicts, different tense.
+ */
+function structuredBlocks(cwd, event) {
+    const cls = forbidRules(cwd);
+    const of = (k) => cls.filter((c) => c.kind === k);
+    const results = [
+        ...runCodeContentChecks(of("codeContent"), [event]),
+        ...runFileLifecycleChecks(of("fileLifecycle"), [event]),
+        ...runGitBranchPolicyChecks(of("gitBranchPolicy"), [event]),
+    ];
+    return results
+        .filter((r) => r.status === "FAIL")
+        .map((r) => ({
+        rule: { id: r.ruleId, title: r.ruleTitle, text: "", source: r.ruleSource },
+        why: r.evidence,
+    }));
+}
+/**
+ * A command ban blocks only where a person marked the clause.
+ *
+ * The unratified version was measured before shipping and cut: blocking on a
+ * rule's command literals refused 62.8% of 16,336 real tool calls. Two
+ * narrowings reached 2.49% and the residue had no matcher fix — a rule
+ * titled "Feature Validation" refused `npm run build` 112 times, because it
+ * forbids running Playwright unprompted and RECOMMENDS the build command,
+ * which is its only command-shaped literal. Another refused plain
+ * `git status`, its backticks holding both the ban and the alternative.
+ *
+ * Nothing in a rules file marks which backtick is the prohibition. So this
+ * path reads only what someone declared, and yields nothing otherwise. The
+ * declaration is keyed on the rule's content hash and re-checked against the
+ * rule's current text, so a reworded rule loses its mark rather than
+ * carrying a judgement onto words nobody read.
+ *
+ * The important property is what happens by default: an unmarked rule cannot
+ * block, at any confidence, ever. That is the whole difference between this
+ * and the version that refused two thirds of everything.
+ */
+function ratifiedLiteralBlocks(cwd, command) {
+    const overrides = loadOverrides(cwd);
+    const blocks = [];
+    for (const c of forbidRules(cwd)) {
+        if (c.kind !== "deterministic")
+            continue;
+        for (const literal of ratifiedForbids(overrides, c.rule)) {
+            if (!commandRunsLiteral(command, literal))
+                continue;
+            blocks.push({ rule: c.rule, why: `the command about to run does \`${literal}\`, which this rule forbids (marked by you, not inferred)` });
+            break;
+        }
+    }
+    return blocks;
+}
+/**
+ * Literal command bans do NOT block unless ratified. Measured, then cut.
+ *
+ * This was the point of the feature and it does not survive its own
+ * measurement. Replaying 16,336 real tool calls against every forbidding
+ * rule in the corpus, blocking on literals refused 62% of commands. Two
+ * restrictions brought that to 1.6% — the literal has to be shaped like an
+ * invocation rather than a noun, and the rule has to name exactly one of
+ * them — and what remained was still wrong in a way no matcher can fix.
+ *
+ * A rule titled "Feature Validation" refused `npm run build` 112 times. It
+ * forbids running Playwright without asking; it RECOMMENDS `npm run build`.
+ * Forbid polarity, one command-shaped literal, and that literal is the
+ * approved command. Another rule refused plain `git status`, because its
+ * backticks hold both the thing it bans and the thing it suggests instead.
+ *
+ * Nothing in a rules file marks which backtick is the prohibition. The
+ * report can live with that — it says UNCLEAR and a person reads it. A
+ * blocker cannot: it would refuse the recommended command with a confident
+ * explanation. So command bans stay in the report and the Stop hook, and
+ * only the structured checkers, which know what kind of thing they are
+ * looking at because the classifier identified a path or a branch, can
+ * refuse anything here.
+ *
+ * The way back to command bans is an explicit opt-in — the user naming which
+ * rules may block — not a cleverer guess. That is a design question for
+ * whoever asks for it, not a default.
+ */
+function reason(blocks) {
+    const lines = blocks.map((b) => `  • Rule ${b.rule.id} — ${b.rule.title}\n    ${b.why}`);
+    const n = blocks.length;
+    return (`RuleReceipt blocked this: it breaks ${n === 1 ? "a rule" : `${n} rules`} in CLAUDE.md.\n\n` +
+        lines.join("\n\n") +
+        `\n\nIf the rule should not apply here, say so to the user and let them decide. Do not work around the rule by rephrasing the command.`);
+}
+/**
+ * A PreToolUse hook that refuses a command before it runs.
+ *
+ * The Stop hook added on 2026-09-14 catches a finished session. That is too
+ * late for the case it most needs to cover: on 2026-04-25 a Cursor agent
+ * running Claude Opus 4.6 deleted PocketOS's production database and every
+ * volume-level backup in nine seconds, using a Railway token it found that
+ * had been created for managing domains. The agent had a rule — "NEVER run
+ * destructive/irreversible git commands...unless the user explicitly
+ * requests them" — and afterwards quoted it back, observing that what it had
+ * done was "far worse than a force push". A report would have described a
+ * database that was already gone.
+ *
+ * What it does NOT do is the thing it was built for. Blocking on a rule's
+ * banned command literal was measured before shipping and cut: see the note
+ * above `reason`. It refused 62% of 16,336 real commands, and the residue
+ * after two rounds of narrowing was still wrong in a way no matcher fixes.
+ * PocketOS would not have been stopped by this hook, and saying otherwise
+ * would be the exact failure this tool exists to catch.
+ *
+ * What remains is real and narrower: rules that name a FILE or a BRANCH.
+ * "Never modify `.env`", "never touch `migrations/`", "never commit to
+ * `main`". The classifier identified those as a path or a ref rather than
+ * guessing which backtick was the prohibition, so a refusal can be stated
+ * with a reason that holds up.
+ *
+ * Three properties, in the order they matter:
+ *
+ * 1. FORBIDDING rules only, answered by a structured checker. Never a
+ *    judgment rule, never an LLM opinion, never a requirement, and never a
+ *    bare command literal. Blocking someone's terminal on a guess is not a
+ *    trade worth making at any hit rate.
+ *
+ * 2. It fails OPEN. Any error allows the command and writes to stderr. The
+ *    opposite choice means a bug in this file stops someone from running
+ *    anything at all, and they would remove the hook within the hour — which
+ *    leaves them with no guard rather than an imperfect one.
+ *
+ * 3. It says which rule and why, in the refusal itself, because a block with
+ *    no reason is indistinguishable from a broken tool.
+ */
+export async function runGuard() {
+    const allow = () => {
+        process.stdout.write(JSON.stringify({}));
+    };
+    try {
+        const raw = await readStdin();
+        const input = raw ? JSON.parse(raw) : {};
+        const cwd = input.cwd || process.cwd();
+        const tool = input.tool_name ?? "";
+        const toolInput = input.tool_input ?? {};
+        if (loadRules(cwd).length === 0)
+            return allow();
+        let blocks = [];
+        if (tool === "Bash" && typeof toolInput.command === "string") {
+            const event = {
+                role: "assistant", kind: "tool_use", toolName: "Bash",
+                input: { command: toolInput.command }, timestamp: "",
+            };
+            blocks = [...structuredBlocks(cwd, event), ...ratifiedLiteralBlocks(cwd, toolInput.command)];
+        }
+        else if (tool === "Write" || tool === "Edit" || tool === "NotebookEdit") {
+            const event = {
+                role: "assistant", kind: "tool_use", toolName: tool,
+                input: toolInput, timestamp: "",
+            };
+            blocks = structuredBlocks(cwd, event);
+        }
+        else {
+            return allow();
+        }
+        if (blocks.length === 0)
+            return allow();
+        process.stdout.write(JSON.stringify({
+            hookSpecificOutput: {
+                hookEventName: "PreToolUse",
+                permissionDecision: "deny",
+                permissionDecisionReason: reason(blocks),
+            },
+        }));
+        // Exit 2 is what actually blocks the call; the JSON carries the reason.
+        process.exitCode = 2;
+    }
+    catch (err) {
+        // Fail open, and never with exit 2 — an exit 2 from a crash would block
+        // every command the session tries to run.
+        process.stderr.write(`rulereceipt guard: allowing command, check did not complete (${err instanceof Error ? err.message : String(err)})\n`);
+        allow();
+    }
+}

package/dist/hook.js

@@ -22,12 +22,25 @@ function readStdin() {
  * what to do and repeating it invites the model to argue with the wording
  * instead of going and running the thing.
  */
-function blockReason(failures) {
-    const lines = failures.map((f) => `  • Rule ${f.ruleId} — ${f.ruleTitle}\n    ${f.evidence}`);
-    const n = failures.length;
-    return (`RuleReceipt: ${n} rule${n === 1 ? "" : "s"} in CLAUDE.md ${n === 1 ? "was" : "were"} not followed in this session.\n\n` +
-        lines.join("\n\n") +
-        `\n\nDo not report this work as finished until the above is resolved or you have said plainly, to the user, that it is still open and why.`);
+function blockReason(failures, unverified) {
+    const parts = [];
+    if (failures.length > 0) {
+        const n = failures.length;
+        parts.push(`RuleReceipt: ${n} rule${n === 1 ? "" : "s"} in CLAUDE.md ${n === 1 ? "was" : "were"} not followed in this session.\n\n` +
+            failures.map((f) => `  • Rule ${f.ruleId} — ${f.ruleTitle}\n    ${f.evidence}`).join("\n\n"));
+    }
+    // Worded as a question about evidence rather than as a finding, because
+    // that is what it is. Nothing here says the claim is false. It says
+    // nothing in this session shows it to be true, and that the difference
+    // belongs to the user rather than to the summary.
+    if (unverified.length > 0) {
+        parts.push(`RuleReceipt: this session claims work is done, and nothing recorded here verifies it.\n\n` +
+            unverified.map((u) => `  • Rule ${u.ruleId} — ${u.ruleTitle}\n    ${u.evidence}`).join("\n\n") +
+            `\n\nThis is not a claim that you are wrong. It may well have been verified somewhere this transcript cannot see.`);
+    }
+    parts.push(`Do not report this work as finished until the above is resolved, or you have said plainly, to the user, ` +
+        `what was actually verified and what was not.`);
+    return parts.join("\n\n");
 }
 /**
  * A Stop hook that refuses to let a session end on a broken rule.
@@ -88,9 +101,13 @@ export async function runHook(needsLlmResult) {
         // it is part of the contract.
         const { results } = await evaluateSession(cwd, rules, events, false, needsLlmResult);
         const failures = results.filter((r) => r.status === "FAIL" && r.outcome !== "not_run");
-        if (failures.length === 0)
+        // Deliberately NOT a FAIL. See CheckResult.unverifiedClaim: the report
+        // calls this unclear and the gate refuses it, and that is the only place
+        // the two are allowed to disagree.
+        const unverified = results.filter((r) => r.unverifiedClaim === true);
+        if (failures.length === 0 && unverified.length === 0)
             return void emit({});
-        return void emit({ decision: "block", reason: blockReason(failures) });
+        return void emit({ decision: "block", reason: blockReason(failures, unverified) });
     }
     catch (err) {
         // Property 3: fail open, but never silently.

package/dist/overrides.d.ts

@@ -26,6 +26,21 @@ export interface Override {
     decision: Decision;
     /** Stored for humans reading the file, and to explain a stale entry. */
     title: string;
+    /**
+     * The literal(s) a person has marked as the PROHIBITION in this rule.
+     *
+     * A rules file does not say which of its backticks is the thing being
+     * banned. Measured: blocking on all of them refused 62.8% of 16,336 real
+     * tool calls, and the residue after two narrowings still refused
+     * `npm run build` 112 times, because the rule that named it forbids
+     * running Playwright and RECOMMENDS the build command. No matcher fixes
+     * that — the information is not in the text.
+     *
+     * So it is declared, once, and only what is declared can block. Absent
+     * means absent: there is deliberately no fallback to "probably the first
+     * literal", because that fallback is the bug.
+     */
+    forbids?: string[];
 }
 export declare const OVERRIDES_PATH: string;
 /**
@@ -60,3 +75,21 @@ export declare function clearOverride(cwd: string, hash: string): boolean;
  * correction is no longer being applied instead of assuming it still is.
  */
 export declare function staleOverrides(overrides: Map<string, Override>, rules: Rule[]): Override[];
+/**
+ * The prohibition literals a person has declared for this rule, or none.
+ *
+ * Two conditions, both required, and both are refusals to infer:
+ *
+ * 1. The mark is keyed on the rule's CONTENT hash, so rewording the rule
+ *    drops it rather than reattaching a judgement to text nobody read. Same
+ *    reasoning as ruleFingerprint, one field down.
+ *
+ * 2. The literal must still appear in the rule. A mark that survives a
+ *    partial edit and names something the rule no longer mentions would
+ *    block on a phrase with nothing behind it — a gate refusing a command
+ *    for a reason that is no longer written anywhere, which is the worst
+ *    failure available to a gate.
+ *
+ * Returns [] for anything unratified. There is no fallback on purpose.
+ */
+export declare function ratifiedForbids(overrides: Map<string, Override>, rule: Rule): string[];

package/dist/overrides.js

@@ -32,7 +32,15 @@ export function loadOverrides(cwd) {
             return map;
         for (const o of parsed.overrides) {
             if (typeof o?.hash === "string" && (o.decision === "rule" || o.decision === "notARule")) {
-                map.set(o.hash, { hash: o.hash, decision: o.decision, title: String(o.title ?? "") });
+                const forbids = Array.isArray(o.forbids)
+                    ? o.forbids.filter((x) => typeof x === "string" && x.trim().length > 0)
+                    : undefined;
+                map.set(o.hash, {
+                    hash: o.hash,
+                    decision: o.decision,
+                    title: String(o.title ?? ""),
+                    ...(forbids && forbids.length > 0 ? { forbids } : {}),
+                });
             }
         }
     }
@@ -83,3 +91,27 @@ export function staleOverrides(overrides, rules) {
     const live = new Set(rules.map(ruleFingerprint));
     return [...overrides.values()].filter((o) => !live.has(o.hash));
 }
+/**
+ * The prohibition literals a person has declared for this rule, or none.
+ *
+ * Two conditions, both required, and both are refusals to infer:
+ *
+ * 1. The mark is keyed on the rule's CONTENT hash, so rewording the rule
+ *    drops it rather than reattaching a judgement to text nobody read. Same
+ *    reasoning as ruleFingerprint, one field down.
+ *
+ * 2. The literal must still appear in the rule. A mark that survives a
+ *    partial edit and names something the rule no longer mentions would
+ *    block on a phrase with nothing behind it — a gate refusing a command
+ *    for a reason that is no longer written anywhere, which is the worst
+ *    failure available to a gate.
+ *
+ * Returns [] for anything unratified. There is no fallback on purpose.
+ */
+export function ratifiedForbids(overrides, rule) {
+    const entry = overrides.get(ruleFingerprint(rule));
+    if (!entry?.forbids)
+        return [];
+    const body = `${rule.title}\n${rule.text ?? ""}`;
+    return entry.forbids.filter((literal) => body.includes(literal));
+}

package/dist/parsers/transcriptParser.js

@@ -117,7 +117,7 @@ export function parseLine(line) {
                     events.push({ role: "assistant", kind: "text", text: b.text, timestamp });
                 }
                 else if (b.type === "tool_use" && typeof b.name === "string") {
-                    events.push({ role: "assistant", kind: "tool_use", toolName: b.name, input: b.input, timestamp });
+                    events.push({ role: "assistant", kind: "tool_use", toolName: b.name, input: b.input, timestamp, toolUseId: typeof b.id === "string" ? b.id : undefined });
                 }
             }
         }
@@ -140,6 +140,7 @@ export function parseLine(line) {
                         content: extractToolResultText(b.content),
                         isError: b.is_error === true,
                         timestamp,
+                        toolUseId: typeof b.tool_use_id === "string" ? b.tool_use_id : undefined,
                     });
                 }
             }

package/dist/types.d.ts

@@ -16,6 +16,17 @@ export interface TranscriptToolUseEvent {
     toolName: string;
     input: unknown;
     timestamp: string;
+    /**
+     * The tool_use id, when the transcript carries one.
+     *
+     * Added 2026-09-16. Without it a result can only be attributed to "the
+     * call immediately before", which was documented here as safe on the
+     * grounds that every turn contained exactly one tool call. Parallel tool
+     * calls are now ordinary — a real session issues three in a row and then
+     * one result — and under that shape the positional rule silently drops
+     * the test run that a completion claim depended on.
+     */
+    toolUseId?: string;
 }
 export interface TranscriptToolResultEvent {
     role: "user";
@@ -23,6 +34,8 @@ export interface TranscriptToolResultEvent {
     content: string;
     isError: boolean;
     timestamp: string;
+    /** The id of the call this result belongs to, when the transcript has it. */
+    toolUseId?: string;
 }
 export type TranscriptEvent = TranscriptTextEvent | TranscriptToolUseEvent | TranscriptToolResultEvent;
 export type CheckStatus = "PASS" | "FAIL" | "UNCLEAR";
@@ -74,6 +87,23 @@ export interface CheckResult {
      * not blur them.
      */
     needsHuman?: boolean;
+    /**
+     * A completion claim that nothing in this session verified.
+     *
+     * The one place the report and the gate deliberately disagree. The report
+     * renders this UNCLEAR, because absence genuinely proves nothing — the
+     * tests may have run in another terminal and a transcript cannot see that.
+     * The Stop hook refuses the exit on it anyway, because it is not asserting
+     * a violation: it is declining to let "done" end a session when nothing
+     * here backs it, and the way out is one sentence saying so out loud.
+     *
+     * Added 2026-09-16. It is the case anthropics/claude-code#90542 is about
+     * from end to end — deploy artifacts produced and the application never
+     * opened, a completion whose evidence is a plan, "state what was VERIFIED
+     * versus only PLANNED" — and the gate was silent on all of it, firing only
+     * when a recorded run CONTRADICTED a claim.
+     */
+    unverifiedClaim?: boolean;
     /**
      * The outcome in the five-value vocabulary. Optional while the checkers
      * are migrated one at a time; `status` remains the fallback.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rulereceipt",
-  "version": "0.1.37",
+  "version": "0.1.39",
   "description": "Checks whether a Claude Code session actually followed your CLAUDE.md / AGENTS.md rules, with evidence.",
   "repository": {
     "type": "git",