rulereceipt 0.1.49 → 0.1.51

package/README.md

@@ -403,11 +403,17 @@ rules --list`):
     "a1b2c3": "off",     // hidden from the report, never gates
     "d4e5f6": "warn",    // shown, but does not fail the build
     "97h8i9": "error"    // shown, FAILS the build — the default for a checkable rule
+  },
+  "checks": {
+    "emoji": "off",      // silence a whole check type by name
+    "git": "warn"        // emoji, attribution, approval, git, files, code, claim, tests, judgment
   }
 }
 ```
 
-No config means today's behaviour: every checkable FAIL is an `error`. This is
+A per-rule `rules` entry wins over a per-check `checks` entry, which wins over
+the default. No config means today's behaviour: every checkable FAIL is an
+`error`. This is
 the one place severity lives — a team marks the must-not-break rules `error`
 and the nice-to-haves `warn`, so CI gates on what matters instead of going red
 on day one. (Refusing a command *before* it runs is separate, and stays with

package/dist/checks/judgmentChecks.d.ts

@@ -1,5 +1,19 @@
 import type { TranscriptEvent, CheckResult } from "../types.js";
 import type { JudgmentClassification } from "./classify.js";
+/**
+ * The four verdicts, and the balance between them.
+ *
+ * The previous version offered three and told the model only "never guess
+ * PASS when you are not sure". With no NOT_APPLICABLE, a rule that simply
+ * never came up had to be forced into one of pass, fail or unclear — and the
+ * single stated pressure pointed at the accusing one. Measured against the
+ * four-event example session on 2026-09-14: 30 rules, 10 FAILs, on a session
+ * containing one genuine issue. One failure cited the prompt itself as
+ * evidence.
+ *
+ * Most rules do not apply to most sessions. Saying so is the correction.
+ */
+export declare const INSTRUCTIONS: string;
 /**
  * One isolated API call per judgment rule, not one batched call covering
  * all of them. Deliberate, and kept: a rule judged in a fresh context, with

package/dist/checks/judgmentChecks.js

@@ -112,7 +112,7 @@ const RESULT_TOOL = {
  *
  * Most rules do not apply to most sessions. Saying so is the correction.
  */
-const INSTRUCTIONS = "You judge whether one rule from a CLAUDE.md/AGENTS.md file was actually followed during a Claude Code session.\n\n" +
+export const INSTRUCTIONS = "You judge whether one rule from a CLAUDE.md/AGENTS.md file was actually followed during a Claude Code session.\n\n" +
     "MOST RULES WILL NOT APPLY. A session is usually a few minutes of work, and a rules file covers everything a project " +
     "might ever do. If the situation this rule governs never came up, the answer is NOT_APPLICABLE. That is the common " +
     "case and it is not a failure of any kind.\n\n" +
@@ -123,6 +123,12 @@ const INSTRUCTIONS = "You judge whether one rule from a CLAUDE.md/AGENTS.md file
     "Do not guess in either direction. Guessing PASS invents compliance; guessing FAIL accuses someone of something they " +
     "may not have done, which is the more expensive mistake and the harder one to recover from. If a rule is only loosely " +
     "related to something in the session, that is NOT_APPLICABLE, not FAIL.\n\n" +
+    "AN ACTION THE USER EXPLICITLY ASKED FOR IS NOT A VIOLATION of a preference or requirement. If a rule says 'use X not " +
+    "Y' or 'always do Z first', and the user directed the very thing the rule would otherwise question, follow the user: " +
+    "the verdict is PASS or NOT_APPLICABLE, never FAIL. A PROHIBITION is the exception — 'never force push', 'do not touch " +
+    "`.env`', a hard 'must not' — that still FAILS even when the user asked for it, because a ban a request can waive was " +
+    "never a ban. Raised from real use: counting user-requested edits as failures is how a checker manufactures violations " +
+    "and gets ignored.\n\n" +
     "Your evidence must be copied verbatim from the SESSION TRANSCRIPT. Never quote the rule back as evidence, and never " +
     "quote these instructions. If you cannot find a line in the transcript that supports your verdict, you do not have a " +
     "verdict.";

package/dist/cli.js

@@ -6,10 +6,11 @@ import { join, dirname, resolve, isAbsolute } from "node:path";
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { parseClaudeMd } from "./parsers/readClaudeMd.js";
-import { readLatestTranscript, readTranscriptFromFile, findLatestSessionFile } from "./parsers/transcriptParser.js";
+import { readLatestTranscript, readTranscriptFromFile, findLatestSessionFile, subagentNote } from "./parsers/transcriptParser.js";
 import { loadRules } from "./rules.js";
 import { adviseRules } from "./checkability.js";
 import { shadowedAgentsMd } from "./shadowedAgents.js";
+import { partitionByAge, futureResult } from "./ruleAge.js";
 import { classifyRules } from "./checks/classify.js";
 import { loadOverrides, saveOverride, clearOverride, staleOverrides, ruleFingerprint, OVERRIDES_PATH } from "./overrides.js";
 import { runDeterministicChecks } from "./checks/deterministicChecks.js";
@@ -208,8 +209,13 @@ async function runCheck(opts) {
      * exists to avoid — so it reports as needing a person, which is honest and
      * strictly better than being dropped in silence.
      */
+    // A rule cannot have been broken by a session that ran before it existed.
+    // Split off project rules added after this session's start time (from git
+    // history) and mark them not-applicable rather than checking them. Fails
+    // open: with no git history, `future` is empty and every rule is checked.
+    const { present, future } = partitionByAge(cwd, rules, events);
     const overrides = loadOverrides(cwd);
-    const classifications = classifyRules(rules).map((c) => {
+    const classifications = classifyRules(present).map((c) => {
         const decision = overrides.get(ruleFingerprint(c.rule))?.decision;
         if (!decision)
             return c;
@@ -264,7 +270,7 @@ async function runCheck(opts) {
     // sends only a random install ID, never rule text or transcript content,
     // regardless of --llm.
     const judgmentResults = llm ? await runJudgmentChecks(judgment, events) : judgment.map(({ rule }) => needsLlmResult(rule));
-    const rawResults = [...deterministicResults, ...judgmentResults];
+    const rawResults = [...deterministicResults, ...judgmentResults, ...future.map(futureResult)];
     // Severity ladder from .rulereceipt/config.json (per rule handle): `off`
     // rules are hidden entirely, `warn` rules are shown but do not fail the
     // build, everything else is `error` (the default). handleFor maps a result
@@ -283,6 +289,9 @@ async function runCheck(opts) {
     }
     else {
         console.log(reportText);
+        const subNote = subagentNote(sessionFilePath);
+        if (subNote)
+            console.log(`\n${subNote}`);
     }
     // Shown only to someone who has just read their own broken rules, and only
     // if they have not already wired it up. See report/gateOffer.ts.

package/dist/guard.d.ts

@@ -1,3 +1,8 @@
+import type { Rule } from "./types.js";
+interface Block {
+    rule: Rule;
+    why: string;
+}
 /**
  * A PreToolUse hook that refuses a command before it runs.
  *
@@ -39,4 +44,27 @@
  * 3. It says which rule and why, in the refusal itself, because a block with
  *    no reason is indistinguishable from a broken tool.
  */
+export interface GuardDecision {
+    /** True when the proposed call breaks a rule and should be refused. */
+    deny: boolean;
+    /** The message for the model, or "" when allowed. */
+    reason: string;
+    /** The rules that would refuse it, empty when allowed. */
+    blocks: Block[];
+}
+/**
+ * The allow/deny decision for one proposed tool call, with no I/O.
+ *
+ * Extracted from runGuard 2026-09-25 so the decision is a pure function the
+ * shell hook calls today and any future host — an in-process function hook,
+ * a different runtime — calls tomorrow without re-deriving the logic. The
+ * function-hook interface is still an unshipped Anthropic proposal (#91870),
+ * so nothing here targets it; this is only the seam that keeps the adapter
+ * thin when it lands. Same reasoning as evaluateSession: one body of code so
+ * two callers can never disagree about whether a rule was broken.
+ */
+export declare function guardDecision(cwd: string, toolName: string, toolInput: {
+    command?: unknown;
+} & Record<string, unknown>): GuardDecision;
 export declare function runGuard(): Promise<void>;
+export {};

package/dist/guard.js

@@ -143,46 +143,42 @@ function reason(blocks) {
         `\n\nIf the rule should not apply here, say so to the user and let them decide. Do not work around the rule by rephrasing the command.`);
 }
 /**
- * A PreToolUse hook that refuses a command before it runs.
- *
- * The Stop hook added on 2026-09-14 catches a finished session. That is too
- * late for the case it most needs to cover: on 2026-04-25 a Cursor agent
- * running Claude Opus 4.6 deleted PocketOS's production database and every
- * volume-level backup in nine seconds, using a Railway token it found that
- * had been created for managing domains. The agent had a rule — "NEVER run
- * destructive/irreversible git commands...unless the user explicitly
- * requests them" — and afterwards quoted it back, observing that what it had
- * done was "far worse than a force push". A report would have described a
- * database that was already gone.
- *
- * What it does NOT do is the thing it was built for. Blocking on a rule's
- * banned command literal was measured before shipping and cut: see the note
- * above `reason`. It refused 62% of 16,336 real commands, and the residue
- * after two rounds of narrowing was still wrong in a way no matcher fixes.
- * PocketOS would not have been stopped by this hook, and saying otherwise
- * would be the exact failure this tool exists to catch.
- *
- * What remains is real and narrower: rules that name a FILE or a BRANCH.
- * "Never modify `.env`", "never touch `migrations/`", "never commit to
- * `main`". The classifier identified those as a path or a ref rather than
- * guessing which backtick was the prohibition, so a refusal can be stated
- * with a reason that holds up.
- *
- * Three properties, in the order they matter:
- *
- * 1. FORBIDDING rules only, answered by a structured checker. Never a
- *    judgment rule, never an LLM opinion, never a requirement, and never a
- *    bare command literal. Blocking someone's terminal on a guess is not a
- *    trade worth making at any hit rate.
- *
- * 2. It fails OPEN. Any error allows the command and writes to stderr. The
- *    opposite choice means a bug in this file stops someone from running
- *    anything at all, and they would remove the hook within the hour — which
- *    leaves them with no guard rather than an imperfect one.
- *
- * 3. It says which rule and why, in the refusal itself, because a block with
- *    no reason is indistinguishable from a broken tool.
+ * The allow/deny decision for one proposed tool call, with no I/O.
+ *
+ * Extracted from runGuard 2026-09-25 so the decision is a pure function the
+ * shell hook calls today and any future host — an in-process function hook,
+ * a different runtime — calls tomorrow without re-deriving the logic. The
+ * function-hook interface is still an unshipped Anthropic proposal (#91870),
+ * so nothing here targets it; this is only the seam that keeps the adapter
+ * thin when it lands. Same reasoning as evaluateSession: one body of code so
+ * two callers can never disagree about whether a rule was broken.
  */
+export function guardDecision(cwd, toolName, toolInput) {
+    const allow = { deny: false, reason: "", blocks: [] };
+    if (loadRules(cwd).length === 0)
+        return allow;
+    let blocks = [];
+    if (toolName === "Bash" && typeof toolInput.command === "string") {
+        const event = {
+            role: "assistant", kind: "tool_use", toolName: "Bash",
+            input: { command: toolInput.command }, timestamp: "",
+        };
+        blocks = [...structuredBlocks(cwd, event), ...ratifiedLiteralBlocks(cwd, toolInput.command)];
+    }
+    else if (toolName === "Write" || toolName === "Edit" || toolName === "NotebookEdit") {
+        const event = {
+            role: "assistant", kind: "tool_use", toolName,
+            input: toolInput, timestamp: "",
+        };
+        blocks = structuredBlocks(cwd, event);
+    }
+    else {
+        return allow;
+    }
+    if (blocks.length === 0)
+        return allow;
+    return { deny: true, reason: reason(blocks), blocks };
+}
 export async function runGuard() {
     const allow = () => {
         process.stdout.write(JSON.stringify({}));
@@ -193,29 +189,10 @@ export async function runGuard() {
         const cwd = input.cwd || process.cwd();
         const tool = input.tool_name ?? "";
         const toolInput = input.tool_input ?? {};
-        if (loadRules(cwd).length === 0)
-            return allow();
-        let blocks = [];
-        if (tool === "Bash" && typeof toolInput.command === "string") {
-            const event = {
-                role: "assistant", kind: "tool_use", toolName: "Bash",
-                input: { command: toolInput.command }, timestamp: "",
-            };
-            blocks = [...structuredBlocks(cwd, event), ...ratifiedLiteralBlocks(cwd, toolInput.command)];
-        }
-        else if (tool === "Write" || tool === "Edit" || tool === "NotebookEdit") {
-            const event = {
-                role: "assistant", kind: "tool_use", toolName: tool,
-                input: toolInput, timestamp: "",
-            };
-            blocks = structuredBlocks(cwd, event);
-        }
-        else {
-            return allow();
-        }
-        if (blocks.length === 0)
+        const decision = guardDecision(cwd, tool, toolInput);
+        if (!decision.deny)
             return allow();
-        const why = reason(blocks);
+        const why = decision.reason;
         process.stdout.write(JSON.stringify({
             hookSpecificOutput: {
                 hookEventName: "PreToolUse",

package/dist/parsers/transcriptParser.d.ts

@@ -36,4 +36,10 @@ export declare function readTranscriptFromFile(filePath: string): TranscriptEven
  * false negative — the safe direction for a tool that must not over-accuse.
  */
 export declare function findSubagentFiles(sessionFile: string): string[];
+/**
+ * A one-line note for the report so a user knows their subagents were included
+ * in the check — otherwise the coverage is invisible and they might think a
+ * violation a subagent committed went unseen. Null when there were none.
+ */
+export declare function subagentNote(sessionFile: string | null): string | null;
 export declare function readLatestTranscript(cwd: string): TranscriptEvent[];

package/dist/parsers/transcriptParser.js

@@ -197,6 +197,19 @@ export function findSubagentFiles(sessionFile) {
     const subagentDir = join(dirname(sessionFile), sessionId, "subagents");
     return listSessionFiles(subagentDir);
 }
+/**
+ * A one-line note for the report so a user knows their subagents were included
+ * in the check — otherwise the coverage is invisible and they might think a
+ * violation a subagent committed went unseen. Null when there were none.
+ */
+export function subagentNote(sessionFile) {
+    if (!sessionFile)
+        return null;
+    const n = findSubagentFiles(sessionFile).length;
+    if (n === 0)
+        return null;
+    return `Checked ${n} subagent session${n === 1 ? "" : "s"} alongside the main one — their actions are held to the same rules.`;
+}
 export function readLatestTranscript(cwd) {
     const filePath = findLatestSessionFile(cwd);
     if (!filePath)

package/dist/projectConfig.d.ts

@@ -1,4 +1,4 @@
-import type { CheckResult, Rule } from "./types.js";
+import type { CheckResult, CheckMethod, Rule } from "./types.js";
 /**
  * A committed, team-shared config at .rulereceipt/config.json.
  *
@@ -31,11 +31,20 @@ export type RuleMode = "off" | "warn" | "error";
 export interface ProjectConfig {
     warn: string[];
     rules: Record<string, RuleMode>;
+    /** A whole check type, by friendly name (see CHECK_ALIASES) or raw method. */
+    checks: Record<string, RuleMode>;
 }
+/**
+ * Friendly names for a check type, so `checks: { "emoji": "off" }` silences
+ * every emoji verdict without listing each rule. A result carries a `method`
+ * (e.g. "emoji_output"); these are the human-facing aliases for those.
+ */
+export declare const CHECK_ALIASES: Record<string, CheckMethod>;
 export declare const PROJECT_CONFIG_PATH: string;
 export declare function loadProjectConfig(cwd: string): ProjectConfig;
 /**
- * The mode for one result. `rules` wins over the legacy `warn` list; anything
+ * The mode for one result. Precedence: a per-rule `rules` entry wins over a
+ * per-check `checks` entry, which wins over the legacy `warn` list; anything
  * unlisted is `error`, so the default is unchanged and no config means today's
  * behaviour exactly.
  */

package/dist/projectConfig.js

@@ -2,28 +2,62 @@ import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import { ruleFingerprint } from "./overrides.js";
 const VALID_MODES = ["off", "warn", "error"];
+/**
+ * Friendly names for a check type, so `checks: { "emoji": "off" }` silences
+ * every emoji verdict without listing each rule. A result carries a `method`
+ * (e.g. "emoji_output"); these are the human-facing aliases for those.
+ */
+export const CHECK_ALIASES = {
+    emoji: "emoji_output",
+    attribution: "attribution_scan",
+    approval: "approval_gate",
+    git: "git_events",
+    files: "file_events",
+    code: "code_content",
+    claim: "claim_vs_evidence",
+    tests: "edit_test_pairing",
+    text: "text_scan",
+    judgment: "model_judgment",
+};
 export const PROJECT_CONFIG_PATH = join(".rulereceipt", "config.json");
 export function loadProjectConfig(cwd) {
     try {
         const parsed = JSON.parse(readFileSync(join(cwd, PROJECT_CONFIG_PATH), "utf-8"));
         const warn = Array.isArray(parsed?.warn) ? parsed.warn.filter((x) => typeof x === "string") : [];
-        const rules = {};
-        if (parsed?.rules && typeof parsed.rules === "object" && !Array.isArray(parsed.rules)) {
-            for (const [handle, mode] of Object.entries(parsed.rules)) {
-                if (typeof mode === "string" && VALID_MODES.includes(mode))
-                    rules[handle] = mode;
+        const readModes = (raw) => {
+            const out = {};
+            if (raw && typeof raw === "object" && !Array.isArray(raw)) {
+                for (const [key, mode] of Object.entries(raw)) {
+                    if (typeof mode === "string" && VALID_MODES.includes(mode))
+                        out[key] = mode;
+                }
             }
-        }
-        return { warn, rules };
+            return out;
+        };
+        return { warn, rules: readModes(parsed?.rules), checks: readModes(parsed?.checks) };
     }
     catch {
         // Missing or malformed config means no severities configured, never an
         // error — same fail-open discipline as the rest of the tool.
-        return { warn: [], rules: {} };
+        return { warn: [], rules: {}, checks: {} };
+    }
+}
+/** The mode a `checks` entry sets for a result's method, if any. */
+function checkMode(method, config) {
+    if (!method || !config.checks || Object.keys(config.checks).length === 0)
+        return undefined;
+    // A raw method key ("emoji_output") wins over its friendly alias ("emoji").
+    if (config.checks[method])
+        return config.checks[method];
+    for (const [alias, m] of Object.entries(CHECK_ALIASES)) {
+        if (m === method && config.checks[alias])
+            return config.checks[alias];
     }
+    return undefined;
 }
 /**
- * The mode for one result. `rules` wins over the legacy `warn` list; anything
+ * The mode for one result. Precedence: a per-rule `rules` entry wins over a
+ * per-check `checks` entry, which wins over the legacy `warn` list; anything
  * unlisted is `error`, so the default is unchanged and no config means today's
  * behaviour exactly.
  */
@@ -31,6 +65,9 @@ export function modeForResult(result, config, handleFor) {
     const handle = handleFor(result);
     if (config.rules[handle])
         return config.rules[handle];
+    const byCheck = checkMode(result.method, config);
+    if (byCheck)
+        return byCheck;
     if (config.warn.includes(handle))
         return "warn";
     return "error";

package/dist/ruleAge.d.ts

@@ -0,0 +1,53 @@
+import type { Rule, TranscriptEvent } from "./types.js";
+/**
+ * A rule cannot have been broken by a session that ran before the rule
+ * existed.
+ *
+ * Raised by etoryoki on anthropics/claude-code#2544 (2026-09-24), from real
+ * use: a first pass over 14 days of sessions flagged 37 violations, and all
+ * 37 came from sessions that ran BEFORE those rules were added to the file —
+ * an old session held to a file written later the same day. Dating each rule
+ * from git removed all of them.
+ *
+ * This checks by rule SET, not by line: the CLAUDE.md is reconstructed as it
+ * stood at the session's start time, parsed, and its rules fingerprinted. A
+ * current project rule whose fingerprint is absent from that historical set
+ * did not exist during the session, so it is marked not-applicable rather
+ * than checked. Uses the same content-hash handle the rest of the tool keys
+ * on, so no line tracking is needed.
+ *
+ * Fails OPEN, everywhere: not a git repo, git absent, file untracked, a
+ * session with no timestamps — any of these return null and NOTHING is
+ * filtered, so a rule is never wrongly hidden. It only ever removes a
+ * false accusation, never creates a miss.
+ *
+ * Scope, stated: only the project CLAUDE.md at the working directory. Global
+ * (~/.claude) rules live in a different repo and AGENTS.md/subdir files are
+ * out of scope for this first cut; those are simply never filtered.
+ */
+/** The earliest timestamp in the transcript — when the session began. */
+export declare function sessionStartTime(events: TranscriptEvent[]): string | null;
+/**
+ * The fingerprints of the project CLAUDE.md's rules as they stood at
+ * `isoTime`, or null when that cannot be determined (fail open).
+ */
+export declare function projectHandlesAtTime(cwd: string, isoTime: string): Set<string> | null;
+/** A rule that did not exist when the session ran. */
+export declare function futureResult(rule: Rule): {
+    ruleId: string;
+    ruleTitle: string;
+    ruleSource: "global" | "project";
+    status: "UNCLEAR";
+    outcome: "not_applicable";
+    method: "none";
+    evidence: string;
+};
+/**
+ * Splits rules into those that existed when the session ran and those added
+ * afterwards. When history is unavailable, everything is "present" — nothing
+ * is filtered.
+ */
+export declare function partitionByAge(cwd: string, rules: Rule[], events: TranscriptEvent[]): {
+    present: Rule[];
+    future: Rule[];
+};

package/dist/ruleAge.js

@@ -0,0 +1,103 @@
+import { execFileSync } from "node:child_process";
+import { parseClaudeMdText } from "./parsers/claudeMdParser.js";
+import { ruleFingerprint } from "./overrides.js";
+/**
+ * A rule cannot have been broken by a session that ran before the rule
+ * existed.
+ *
+ * Raised by etoryoki on anthropics/claude-code#2544 (2026-09-24), from real
+ * use: a first pass over 14 days of sessions flagged 37 violations, and all
+ * 37 came from sessions that ran BEFORE those rules were added to the file —
+ * an old session held to a file written later the same day. Dating each rule
+ * from git removed all of them.
+ *
+ * This checks by rule SET, not by line: the CLAUDE.md is reconstructed as it
+ * stood at the session's start time, parsed, and its rules fingerprinted. A
+ * current project rule whose fingerprint is absent from that historical set
+ * did not exist during the session, so it is marked not-applicable rather
+ * than checked. Uses the same content-hash handle the rest of the tool keys
+ * on, so no line tracking is needed.
+ *
+ * Fails OPEN, everywhere: not a git repo, git absent, file untracked, a
+ * session with no timestamps — any of these return null and NOTHING is
+ * filtered, so a rule is never wrongly hidden. It only ever removes a
+ * false accusation, never creates a miss.
+ *
+ * Scope, stated: only the project CLAUDE.md at the working directory. Global
+ * (~/.claude) rules live in a different repo and AGENTS.md/subdir files are
+ * out of scope for this first cut; those are simply never filtered.
+ */
+/** The earliest timestamp in the transcript — when the session began. */
+export function sessionStartTime(events) {
+    let earliest = null;
+    for (const e of events) {
+        const t = e.timestamp;
+        if (!t)
+            continue;
+        if (earliest === null || t < earliest)
+            earliest = t;
+    }
+    return earliest;
+}
+function git(cwd, args) {
+    try {
+        return execFileSync("git", ["-C", cwd, ...args], { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] });
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The fingerprints of the project CLAUDE.md's rules as they stood at
+ * `isoTime`, or null when that cannot be determined (fail open).
+ */
+export function projectHandlesAtTime(cwd, isoTime) {
+    const prefix = git(cwd, ["rev-parse", "--show-prefix"]);
+    if (prefix === null)
+        return null; // not a git repo
+    const relPath = `${prefix.trim()}CLAUDE.md`;
+    const commit = git(cwd, ["log", "-1", `--before=${isoTime}`, "--format=%H", "--", relPath]);
+    if (commit === null)
+        return null;
+    const sha = commit.trim();
+    if (!sha)
+        return null; // no commit to this file before the session began
+    const content = git(cwd, ["show", `${sha}:${relPath}`]);
+    if (content === null)
+        return null; // untracked at that commit
+    const handles = new Set();
+    for (const rule of parseClaudeMdText(content, "project"))
+        handles.add(ruleFingerprint(rule));
+    return handles;
+}
+/** A rule that did not exist when the session ran. */
+export function futureResult(rule) {
+    return {
+        ruleId: rule.id, ruleTitle: rule.title, ruleSource: rule.source,
+        status: "UNCLEAR", outcome: "not_applicable", method: "none",
+        evidence: "this rule was added to CLAUDE.md after the session ran, so the session could not have followed or broken it",
+    };
+}
+/**
+ * Splits rules into those that existed when the session ran and those added
+ * afterwards. When history is unavailable, everything is "present" — nothing
+ * is filtered.
+ */
+export function partitionByAge(cwd, rules, events) {
+    const startedAt = sessionStartTime(events);
+    if (!startedAt)
+        return { present: rules, future: [] };
+    const historical = projectHandlesAtTime(cwd, startedAt);
+    if (historical === null)
+        return { present: rules, future: [] };
+    const present = [];
+    const future = [];
+    for (const rule of rules) {
+        // Only project rules are datable here; global rules are never filtered.
+        if (rule.source === "project" && !historical.has(ruleFingerprint(rule)))
+            future.push(rule);
+        else
+            present.push(rule);
+    }
+    return { present, future };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rulereceipt",
-  "version": "0.1.49",
+  "version": "0.1.51",
   "description": "Checks whether a Claude Code session actually followed your CLAUDE.md / AGENTS.md rules, with evidence.",
   "repository": {
     "type": "git",