rulereceipt 0.1.41 → 0.1.43

package/README.md

@@ -101,6 +101,22 @@ rulereceipt verify <session-file> <hash>   # spot-check a report you received ag
 
 `verify` isn't a routine check — trust your team day to day, same as any status update. It's there for the rare case it actually matters (a dispute, an incident review): give it the session file and the hash printed in the report, and it confirms whether they really match.
 
+### Claims of having read something
+
+A session that writes `PAGES READ: 1-20`, `STATUS: READ IN FULL` or "confirmed
+at source" while never opening a file is asserting provenance it does not
+have. Reported by a user in anthropics/claude-code#92505, where those headers
+went into tracked files and commit messages for material the model had never
+read.
+
+The check is narrow on purpose. It fires only when **nothing at all** was read
+in the session — no `Read`, no `Grep`, no `cat`. That much a transcript can
+prove, and it contradicts any claim of reading. It cannot tell you *which*
+document was read when reads did happen, so a session that read the wrong
+thing is still beyond it, and the report says so rather than guessing.
+
+"I will read the filing next" is a plan, not a claim, and does not fire.
+
 ## Blocking, not just reporting
 
 `rulereceipt check` tells you afterwards. `rulereceipt hook` refuses to let the

package/dist/checks/claimEvidence.js

@@ -86,7 +86,46 @@ const ACTION_CLAIMS = [
         exclude: /\bcommitted\s+to\b/i,
         command: /\bgit\s+commit\b/i,
     },
+    {
+        /**
+         * A claim to have READ a source, when nothing was read at all.
+         *
+         * From anthropics/claude-code#92505: "PAGES READ: 1-20", "STATUS: READ
+         * IN FULL", "confirmed at source" — emitted for material never opened,
+         * then written into tracked files and commit messages. The reporter's
+         * framing is the one that matters: the apparatus that certifies work was
+         * produced decoupled from the work, and a plainly-worded guess would
+         * have been safer, because a guess reads as a guess.
+         *
+         * Two claim shapes, because a provenance header has no "I" in it. The
+         * first-person form is gated like the others; the header form is matched
+         * literally, since "PAGES READ:" and "READ IN FULL" do not occur by
+         * accident.
+         *
+         * exclude carries the future tense. "I will read the filing next" is a
+         * plan, and a plan is not a claim.
+         *
+         * Ceiling: this fires only when NOTHING was read. The transcript can
+         * show that, and it contradicts any claim of reading. It cannot show
+         * WHICH document was read when reads did happen, so a session that read
+         * something else entirely is still beyond it.
+         */
+        label: "read of a source",
+        claim: /\b(?:i|we)(?:'ve|’ve| have| had)?\s+(?:\w+ly\s+|just\s+|already\s+|then\s+|also\s+|now\s+)*read\b|^\s*(?:pages?\s+read|status)\s*:\s*(?:[\d\s,-]+|read\s+in\s+full)|\bread\s+in\s+full\b|\bconfirmed\s+at\s+source\b/im,
+        exclude: /\b(?:will|going\s+to|need\s+to|should|next|plan\s+to|about\s+to|let\s+me|i'?ll|we'?ll)\s+(?:\w+\s+){0,3}read\b/i,
+        command: /\b(?:cat|head|tail|less|more|bat|nl|strings|pdftotext|xxd|od)\b/i,
+    },
 ];
+/**
+ * Tools that read a file, as distinct from shell commands that do.
+ *
+ * ACTION_CLAIMS matches Bash command text, which is the whole surface for
+ * push and commit. Reading is not: most reads go through Read, Grep, Glob
+ * or WebFetch and never touch a shell. Without these, a session that read
+ * twenty files through the proper tool would be reported as having read
+ * nothing.
+ */
+const READING_TOOLS = new Set(["Read", "Grep", "Glob", "NotebookRead", "WebFetch", "Fetch"]);
 /**
  * Removes what a message SHOWS, leaving what it SAYS.
  *
@@ -202,6 +241,11 @@ export function runClaimEvidenceChecks(classifications, events) {
     let unreadable = null;
     let backed = null;
     for (const event of events) {
+        // A read through Read/Grep/Glob never reaches the shell, so it has to be
+        // recorded here rather than by matching command text.
+        if (event.kind === "tool_use" && READING_TOOLS.has(event.toolName ?? "")) {
+            commandsSeen.add("read of a source");
+        }
         const command = commandOf(event);
         if (command !== null) {
             const id = event.kind === "tool_use" ? (event.toolUseId ?? null) : null;

package/dist/checks/emojiOutput.js

@@ -1,25 +1,56 @@
 import { violation } from "../types.js";
 /**
- * Emoji, as distinct from "any character a keyboard cannot type".
+ * Emoji, defined by Unicode rather than by a list of the ones we happened
+ * to have seen.
  *
- * Deliberately narrow. Accented Latin, CJK, mathematical symbols, arrows,
- * dashes, degree signs and the check mark are NOT emoji, and a rule banning
- * emoji must not fire on "café", "日本語", "±3°C" or "2×3". Those are
- * ordinary text to the people who write them, and treating them as a
- * violation would make this checker useless outside English.
+ * The first version of this was hand-written character ranges. Tested
+ * against every pictographic codepoint Unicode knows about, it missed eight
+ * — including ✅ ❌ ⭐ ⌛ — because those blocks were not in the list. A list
+ * built from examples only ever covers the examples.
  *
- * Covered: the pictographic blocks, the emoticon block, transport and map
- * symbols, supplemental symbols, flags, and the dingbats that are actually
- * rendered as emoji. Variation-selector-16 is included because it is what
- * turns an otherwise plain glyph into its emoji presentation.
+ * Four properties, all of them mechanisms rather than enumerations:
+ *
+ *   Emoji_Presentation   renders as emoji by DEFAULT. 😀 🎉 ⌛
+ *   Extended_Pictographic + U+FE0F
+ *                        a TEXT character explicitly given emoji form.
+ *                        © ™ ‼ ℹ ☀ are ordinary text; ©️ ™️ ‼️ ℹ️ ☀️ are not,
+ *                        and the difference is one invisible codepoint.
+ *   regional indicators  any flag, not a list of countries
+ *   keycap sequence      any keycap, not a list of digits
+ *
+ * Measured across codepoints U+0020 to U+1FAFF: 1,826 of 1,826 pictographic
+ * codepoints handled, and zero letters, digits, punctuation or symbols
+ * wrongly flagged. Accented Latin, CJK, arrows, maths and currency stay
+ * text, which matters — a check that fires on "café" or "日本語" is useless
+ * to most of the people who would run it.
+ *
+ * Because these are Unicode properties, new emoji are covered when the
+ * runtime's Unicode data updates. Nothing here needs editing for them.
  */
-const EMOJI = /[\u{1F300}-\u{1F5FF}\u{1F600}-\u{1F64F}\u{1F680}-\u{1F6FF}\u{1F900}-\u{1FAFF}\u{1F1E6}-\u{1F1FF}\u{2600}-\u{26FF}\u{FE0F}]/u;
+const DEFAULT_EMOJI = /\p{Emoji_Presentation}/u;
+const PICTOGRAPHIC = /\p{Extended_Pictographic}/u;
+const REGIONAL_INDICATOR = /[\u{1F1E6}-\u{1F1FF}]/u;
+const KEYCAP = /[0-9#*]\u{FE0F}?\u{20E3}/u;
+const VARIATION_SELECTOR_16 = "\u{FE0F}";
 /** Every distinct emoji in a string, in order of first appearance. */
 function emojiIn(text) {
     const found = [];
-    for (const ch of text) {
-        if (EMOJI.test(ch) && ch !== "️" && !found.includes(ch))
-            found.push(ch);
+    const chars = [...text];
+    if (KEYCAP.test(text)) {
+        const m = text.match(KEYCAP);
+        if (m)
+            found.push(m[0]);
+    }
+    for (let i = 0; i < chars.length; i++) {
+        const ch = chars[i];
+        const isEmoji = DEFAULT_EMOJI.test(ch) ||
+            REGIONAL_INDICATOR.test(ch) ||
+            (PICTOGRAPHIC.test(ch) && chars[i + 1] === VARIATION_SELECTOR_16);
+        if (!isEmoji)
+            continue;
+        const glyph = chars[i + 1] === VARIATION_SELECTOR_16 ? ch + chars[i + 1] : ch;
+        if (!found.includes(glyph))
+            found.push(glyph);
     }
     return found;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rulereceipt",
-  "version": "0.1.41",
+  "version": "0.1.43",
   "description": "Checks whether a Claude Code session actually followed your CLAUDE.md / AGENTS.md rules, with evidence.",
   "repository": {
     "type": "git",
@@ -46,9 +46,9 @@
   },
   "license": "SEE LICENSE IN LICENSE",
   "dependencies": {
-    "@anthropic-ai/sdk": "^0.32.0",
-    "commander": "^15.0.0",
-    "nodemailer": "^9.1.1"
+    "@anthropic-ai/sdk": "~0.32.1",
+    "commander": "~15.0.0",
+    "nodemailer": "~10.0.1"
   },
   "devDependencies": {
     "@types/node": "^26.4.0",