rulereceipt 0.1.50 → 0.1.52

package/dist/checks/classify.js

@@ -567,6 +567,13 @@ export function approvalGateActions(rule) {
 function isApprovalGateRule(rule) {
     return approvalGateActions(rule).length > 0;
 }
+/**
+ * A subordinating condition that scopes when a prohibition applies. A literal
+ * matcher cannot read it, so a forbid carrying one is routed to judgment
+ * rather than flagged on every occurrence. Kept to clear scoping words so a
+ * flat prohibition that merely contains "if" in passing is not swept in.
+ */
+const CONDITIONAL_SCOPE = /\b(?:when(?:ever)?|unless|except\s+when|only\s+(?:if|when)|as\s+long\s+as|provided\s+that|in\s+cases?\s+where)\b|\bif\s+(?:you|the|it|they|we|a|an|on|in|running|building|committing|pushing|deploying)\b/i;
 export function classifyRule(rule) {
     // Checked first: if this isn't a rule at all, no check of any kind
     // should run against it — not a keyword match, not an LLM call.
@@ -634,6 +641,19 @@ export function classifyRule(rule) {
     if (BRANCH_WORD.test(text) && branchName !== undefined) {
         return { kind: "gitBranchPolicy", rule, branchName, polarity, polarityInferred };
     }
+    // A forbid scoped by a condition the literal checkers cannot evaluate.
+    //
+    // Raised by etoryoki on anthropics/claude-code#2544: "Never run `terraform
+    // apply` when you're on main" read as "never run it" flags every correct run
+    // elsewhere. A deterministic literal match sees only the command, not the
+    // "when/unless/if" that scopes it, so it accuses every occurrence. Routing
+    // these to judgment lets the condition actually be weighed — the same choice
+    // etoryoki made ("treat conditional or hedged sentences as not checkable
+    // instead of guessing"). Placed AFTER the branch check on purpose:
+    // gitBranchPolicy evaluates its own branch condition and must keep those.
+    if (polarity === "forbid" && CONDITIONAL_SCOPE.test(text)) {
+        return { kind: "judgment", rule };
+    }
     // Route on ANY code-shaped literal, but check ONLY the code-shaped ones.
     // This used to pass every literal through once one of them looked like
     // code, so a rule mentioning `foo(` and `name` searched written files for

package/dist/checks/judgmentChecks.d.ts

@@ -1,5 +1,19 @@
 import type { TranscriptEvent, CheckResult } from "../types.js";
 import type { JudgmentClassification } from "./classify.js";
+/**
+ * The four verdicts, and the balance between them.
+ *
+ * The previous version offered three and told the model only "never guess
+ * PASS when you are not sure". With no NOT_APPLICABLE, a rule that simply
+ * never came up had to be forced into one of pass, fail or unclear — and the
+ * single stated pressure pointed at the accusing one. Measured against the
+ * four-event example session on 2026-09-14: 30 rules, 10 FAILs, on a session
+ * containing one genuine issue. One failure cited the prompt itself as
+ * evidence.
+ *
+ * Most rules do not apply to most sessions. Saying so is the correction.
+ */
+export declare const INSTRUCTIONS: string;
 /**
  * One isolated API call per judgment rule, not one batched call covering
  * all of them. Deliberate, and kept: a rule judged in a fresh context, with

package/dist/checks/judgmentChecks.js

@@ -112,7 +112,7 @@ const RESULT_TOOL = {
  *
  * Most rules do not apply to most sessions. Saying so is the correction.
  */
-const INSTRUCTIONS = "You judge whether one rule from a CLAUDE.md/AGENTS.md file was actually followed during a Claude Code session.\n\n" +
+export const INSTRUCTIONS = "You judge whether one rule from a CLAUDE.md/AGENTS.md file was actually followed during a Claude Code session.\n\n" +
     "MOST RULES WILL NOT APPLY. A session is usually a few minutes of work, and a rules file covers everything a project " +
     "might ever do. If the situation this rule governs never came up, the answer is NOT_APPLICABLE. That is the common " +
     "case and it is not a failure of any kind.\n\n" +
@@ -123,6 +123,12 @@ const INSTRUCTIONS = "You judge whether one rule from a CLAUDE.md/AGENTS.md file
     "Do not guess in either direction. Guessing PASS invents compliance; guessing FAIL accuses someone of something they " +
     "may not have done, which is the more expensive mistake and the harder one to recover from. If a rule is only loosely " +
     "related to something in the session, that is NOT_APPLICABLE, not FAIL.\n\n" +
+    "AN ACTION THE USER EXPLICITLY ASKED FOR IS NOT A VIOLATION of a preference or requirement. If a rule says 'use X not " +
+    "Y' or 'always do Z first', and the user directed the very thing the rule would otherwise question, follow the user: " +
+    "the verdict is PASS or NOT_APPLICABLE, never FAIL. A PROHIBITION is the exception — 'never force push', 'do not touch " +
+    "`.env`', a hard 'must not' — that still FAILS even when the user asked for it, because a ban a request can waive was " +
+    "never a ban. Raised from real use: counting user-requested edits as failures is how a checker manufactures violations " +
+    "and gets ignored.\n\n" +
     "Your evidence must be copied verbatim from the SESSION TRANSCRIPT. Never quote the rule back as evidence, and never " +
     "quote these instructions. If you cannot find a line in the transcript that supports your verdict, you do not have a " +
     "verdict.";

package/dist/cli.js

@@ -10,6 +10,7 @@ import { readLatestTranscript, readTranscriptFromFile, findLatestSessionFile, su
 import { loadRules } from "./rules.js";
 import { adviseRules } from "./checkability.js";
 import { shadowedAgentsMd } from "./shadowedAgents.js";
+import { partitionByAge, futureResult } from "./ruleAge.js";
 import { classifyRules } from "./checks/classify.js";
 import { loadOverrides, saveOverride, clearOverride, staleOverrides, ruleFingerprint, OVERRIDES_PATH } from "./overrides.js";
 import { runDeterministicChecks } from "./checks/deterministicChecks.js";
@@ -208,8 +209,13 @@ async function runCheck(opts) {
      * exists to avoid — so it reports as needing a person, which is honest and
      * strictly better than being dropped in silence.
      */
+    // A rule cannot have been broken by a session that ran before it existed.
+    // Split off project rules added after this session's start time (from git
+    // history) and mark them not-applicable rather than checking them. Fails
+    // open: with no git history, `future` is empty and every rule is checked.
+    const { present, future } = partitionByAge(cwd, rules, events);
     const overrides = loadOverrides(cwd);
-    const classifications = classifyRules(rules).map((c) => {
+    const classifications = classifyRules(present).map((c) => {
         const decision = overrides.get(ruleFingerprint(c.rule))?.decision;
         if (!decision)
             return c;
@@ -264,7 +270,7 @@ async function runCheck(opts) {
     // sends only a random install ID, never rule text or transcript content,
     // regardless of --llm.
     const judgmentResults = llm ? await runJudgmentChecks(judgment, events) : judgment.map(({ rule }) => needsLlmResult(rule));
-    const rawResults = [...deterministicResults, ...judgmentResults];
+    const rawResults = [...deterministicResults, ...judgmentResults, ...future.map(futureResult)];
     // Severity ladder from .rulereceipt/config.json (per rule handle): `off`
     // rules are hidden entirely, `warn` rules are shown but do not fail the
     // build, everything else is `error` (the default). handleFor maps a result

package/dist/ruleAge.d.ts

@@ -0,0 +1,53 @@
+import type { Rule, TranscriptEvent } from "./types.js";
+/**
+ * A rule cannot have been broken by a session that ran before the rule
+ * existed.
+ *
+ * Raised by etoryoki on anthropics/claude-code#2544 (2026-09-24), from real
+ * use: a first pass over 14 days of sessions flagged 37 violations, and all
+ * 37 came from sessions that ran BEFORE those rules were added to the file —
+ * an old session held to a file written later the same day. Dating each rule
+ * from git removed all of them.
+ *
+ * This checks by rule SET, not by line: the CLAUDE.md is reconstructed as it
+ * stood at the session's start time, parsed, and its rules fingerprinted. A
+ * current project rule whose fingerprint is absent from that historical set
+ * did not exist during the session, so it is marked not-applicable rather
+ * than checked. Uses the same content-hash handle the rest of the tool keys
+ * on, so no line tracking is needed.
+ *
+ * Fails OPEN, everywhere: not a git repo, git absent, file untracked, a
+ * session with no timestamps — any of these return null and NOTHING is
+ * filtered, so a rule is never wrongly hidden. It only ever removes a
+ * false accusation, never creates a miss.
+ *
+ * Scope, stated: only the project CLAUDE.md at the working directory. Global
+ * (~/.claude) rules live in a different repo and AGENTS.md/subdir files are
+ * out of scope for this first cut; those are simply never filtered.
+ */
+/** The earliest timestamp in the transcript — when the session began. */
+export declare function sessionStartTime(events: TranscriptEvent[]): string | null;
+/**
+ * The fingerprints of the project CLAUDE.md's rules as they stood at
+ * `isoTime`, or null when that cannot be determined (fail open).
+ */
+export declare function projectHandlesAtTime(cwd: string, isoTime: string): Set<string> | null;
+/** A rule that did not exist when the session ran. */
+export declare function futureResult(rule: Rule): {
+    ruleId: string;
+    ruleTitle: string;
+    ruleSource: "global" | "project";
+    status: "UNCLEAR";
+    outcome: "not_applicable";
+    method: "none";
+    evidence: string;
+};
+/**
+ * Splits rules into those that existed when the session ran and those added
+ * afterwards. When history is unavailable, everything is "present" — nothing
+ * is filtered.
+ */
+export declare function partitionByAge(cwd: string, rules: Rule[], events: TranscriptEvent[]): {
+    present: Rule[];
+    future: Rule[];
+};

package/dist/ruleAge.js

@@ -0,0 +1,103 @@
+import { execFileSync } from "node:child_process";
+import { parseClaudeMdText } from "./parsers/claudeMdParser.js";
+import { ruleFingerprint } from "./overrides.js";
+/**
+ * A rule cannot have been broken by a session that ran before the rule
+ * existed.
+ *
+ * Raised by etoryoki on anthropics/claude-code#2544 (2026-09-24), from real
+ * use: a first pass over 14 days of sessions flagged 37 violations, and all
+ * 37 came from sessions that ran BEFORE those rules were added to the file —
+ * an old session held to a file written later the same day. Dating each rule
+ * from git removed all of them.
+ *
+ * This checks by rule SET, not by line: the CLAUDE.md is reconstructed as it
+ * stood at the session's start time, parsed, and its rules fingerprinted. A
+ * current project rule whose fingerprint is absent from that historical set
+ * did not exist during the session, so it is marked not-applicable rather
+ * than checked. Uses the same content-hash handle the rest of the tool keys
+ * on, so no line tracking is needed.
+ *
+ * Fails OPEN, everywhere: not a git repo, git absent, file untracked, a
+ * session with no timestamps — any of these return null and NOTHING is
+ * filtered, so a rule is never wrongly hidden. It only ever removes a
+ * false accusation, never creates a miss.
+ *
+ * Scope, stated: only the project CLAUDE.md at the working directory. Global
+ * (~/.claude) rules live in a different repo and AGENTS.md/subdir files are
+ * out of scope for this first cut; those are simply never filtered.
+ */
+/** The earliest timestamp in the transcript — when the session began. */
+export function sessionStartTime(events) {
+    let earliest = null;
+    for (const e of events) {
+        const t = e.timestamp;
+        if (!t)
+            continue;
+        if (earliest === null || t < earliest)
+            earliest = t;
+    }
+    return earliest;
+}
+function git(cwd, args) {
+    try {
+        return execFileSync("git", ["-C", cwd, ...args], { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] });
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The fingerprints of the project CLAUDE.md's rules as they stood at
+ * `isoTime`, or null when that cannot be determined (fail open).
+ */
+export function projectHandlesAtTime(cwd, isoTime) {
+    const prefix = git(cwd, ["rev-parse", "--show-prefix"]);
+    if (prefix === null)
+        return null; // not a git repo
+    const relPath = `${prefix.trim()}CLAUDE.md`;
+    const commit = git(cwd, ["log", "-1", `--before=${isoTime}`, "--format=%H", "--", relPath]);
+    if (commit === null)
+        return null;
+    const sha = commit.trim();
+    if (!sha)
+        return null; // no commit to this file before the session began
+    const content = git(cwd, ["show", `${sha}:${relPath}`]);
+    if (content === null)
+        return null; // untracked at that commit
+    const handles = new Set();
+    for (const rule of parseClaudeMdText(content, "project"))
+        handles.add(ruleFingerprint(rule));
+    return handles;
+}
+/** A rule that did not exist when the session ran. */
+export function futureResult(rule) {
+    return {
+        ruleId: rule.id, ruleTitle: rule.title, ruleSource: rule.source,
+        status: "UNCLEAR", outcome: "not_applicable", method: "none",
+        evidence: "this rule was added to CLAUDE.md after the session ran, so the session could not have followed or broken it",
+    };
+}
+/**
+ * Splits rules into those that existed when the session ran and those added
+ * afterwards. When history is unavailable, everything is "present" — nothing
+ * is filtered.
+ */
+export function partitionByAge(cwd, rules, events) {
+    const startedAt = sessionStartTime(events);
+    if (!startedAt)
+        return { present: rules, future: [] };
+    const historical = projectHandlesAtTime(cwd, startedAt);
+    if (historical === null)
+        return { present: rules, future: [] };
+    const present = [];
+    const future = [];
+    for (const rule of rules) {
+        // Only project rules are datable here; global rules are never filtered.
+        if (rule.source === "project" && !historical.has(ruleFingerprint(rule)))
+            future.push(rule);
+        else
+            present.push(rule);
+    }
+    return { present, future };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rulereceipt",
-  "version": "0.1.50",
+  "version": "0.1.52",
   "description": "Checks whether a Claude Code session actually followed your CLAUDE.md / AGENTS.md rules, with evidence.",
   "repository": {
     "type": "git",