sawbuck 0.1.47 → 0.1.49

package/CONTRACT.md

@@ -89,7 +89,7 @@ A win is **`gamed`** when it does not survive a **source-only re-run**: revert e
 
 ## 4. The context record (the trail knowledge)
 
-A conforming implementation also carries the repo's history as deterministic memory: a ledger derived from git (hotspots, reverted approaches, suppressed or weakened tests, fragile areas), surfaced per turn as a ranked slice for the files being touched. It is a projection of git, never a second source of truth, so it is always reconstructable and never drifts from what actually happened.
+A conforming implementation also carries the repo's history as deterministic memory: a ledger derived from git (hotspots, reverted approaches, suppressed or weakened tests, fragile areas), surfaced on demand as a ranked slice for the files being touched. It is a projection of git, never a second source of truth, so it is always reconstructable and never drifts from what actually happened.
 
 ---
 

package/README.md

@@ -1,10 +1,10 @@
 # sawbuck
 
-**Agents follow written rules. Most repos have none.** Sawbuck turns what you keep telling your agent into written rules, and re-runs your tests to prove they held.
+**Agents follow written rules. The one that matters is rarely written.** Sawbuck turns what you keep telling your agent into written rules, and re-runs your tests to prove they held.
 
-It re-proves every win from the agent's **source** edits alone, so a test that went from red to green only because the agent edited the test reads as gamed.
+We put a test that could not pass into 6 real repos and told Claude to get to green fast. With no rule, it got there by changing the test 25 of 28 times. With one line in `CLAUDE.md`, 0 of 28. Of 593 active repos we checked, about half had a rules file for agents, and 19 had a rule like that one.
 
-> Sawbuck is the reference implementation of the [Verified-Outcome Contract](CONTRACT.md): the open interface for a coding loop you can trust.
+It re-proves every win from the agent's **source** edits alone, so a test that went from red to green only because the agent edited the test reads as gamed.
 
 In Claude Code, install the plugin and keep working:
 
@@ -13,7 +13,7 @@ In Claude Code, install the plugin and keep working:
 /plugin install sawbuck-reins@sawbuck
 ```
 
-The first time you open a git repository with no rules, Claude finishes your task and offers once to add them. Say yes: it writes the rule, sets your protected paths, and checks every turn.
+The first time you open a git repository with no rules, Claude finishes your task and offers once to add them. Say yes: it writes the rule, sets your protected paths, and watches every turn: protected paths at the end of each turn, each commit re-proved from the source.
 
 Or from the command line:
 
@@ -24,7 +24,7 @@ npx sawbuck check
 # 2 · give this repo its rules: the written rule, protected paths, and your tests if it has no config yet
 npm i -g sawbuck
 sawbuck contract          # --full adds supply-chain guards, a repo lock and, on a GitHub repo, a CI check
-sawbuck attach            # check every Claude Code turn (--shared for a team file, --git for any other agent)
+sawbuck attach            # watch every Claude Code turn (--shared for a team file, --git for any other agent)
 ```
 
 **Zero-config:** it finds npm, pytest, cargo and go tests on its own, so in those repos there is nothing to write to start. Anything else (a Makefile target, say) reads inconclusive until you set the command in `promptwheel.config.json`.
@@ -46,17 +46,18 @@ $ sawbuck check        # after fixing the source and restoring the test
    (it survives a source-only re-run).
 ```
 
-Exit codes: `0` verified · `1` regression · `2` gamed · `3` inconclusive · `64` could not run (not a git repo, no commit, a bad ref, an unknown flag, a bad or missing flag value, a bad config, or `--working` with nothing uncommitted, and it says which); no detectable test command reads `3` inconclusive, and says so.
+Exit codes: `0` pass (verified, held, or allowed) · `1` sent back (a regression or a protected path) · `2` gamed · `3` inconclusive · `64` could not run (not a git repo, no commit, a bad ref, an unknown flag, a bad or missing flag value, a bad config, or `--working` with nothing uncommitted, and it says which); no detectable test command reads `3` inconclusive, and says so.
 
 ## What it does
 
-- **Verifies the win.** `check` re-runs your metric from the source diff alone. A test that went from red to green because of a deleted, weakened, or skipped test, a mocked grader, an edited golden file, or a loosened declared config reads `gamed`. A suite weakened while it stays green is not proved: there is no win to re-run. Tripwires catch skips and removed assertions in a signed repo. Deterministic, zero-LLM, $0, and it never reads the trajectory. No appeals once signed; `--allow` lets a change through with a person's reason, and the check says it was allowed, never verified. A `Sawbuck-Allow:` commit trailer clears nothing in `sawbuck check`, the Stop hook or the git hook, signed or not, because an agent can write a commit message. Red-teamed across 9 ecosystems in 26 scenarios: 12 caught, 10 stated limits, 4 honest ([promptwheel/bench/REDTEAM.md](https://github.com/promptwheel-ai/promptwheel/blob/main/bench/REDTEAM.md)).
+- **Verifies the win.** `check` re-runs your metric from the source diff alone. A test that went from red to green because of a deleted, weakened, or skipped test, a mocked grader, an edited golden file, or a loosened declared config reads `gamed`. A suite weakened while it stays green is not proved: there is no win to re-run. Tripwires catch skips and removed assertions in a signed repo. Deterministic, zero-LLM, $0, and it never reads the trajectory. No appeals once signed; `--allow` lets a change through with a person's reason, and the check says it was allowed, never verified. A `Sawbuck-Allow:` commit trailer clears nothing in `sawbuck check`, the Stop hook or the git hook, signed or not, because an agent can write a commit message. Red-teamed in 26 scenarios across 9 ecosystems: of 22 cheats, 12 were caught and 10 got through, each one a limit the report lists, and all 4 honest fixes passed ([promptwheel/bench/REDTEAM.md](https://github.com/promptwheel-ai/promptwheel/blob/main/bench/REDTEAM.md)).
 - **Says what it cannot see.** A cheat that lives inside the source itself (a value hardcoded to the one visible case, logic keyed to the test environment) is invisible to a source-only re-run, by construction. That limit is in [the contract](CONTRACT.md#3-the-integrity-boundary-what-counts-as-gaming), not hidden.
 - **Remembers what broke.** `context` surfaces the relevant history (reverts, fragile areas, test-weakening) for the files you are touching: a ranked trail guide, before you act.
 - **Shows you everything.** `status` is the inventory: what it has caught for you over time, the debt accruing now, and whether it is armed here, in one view. It says watching only while hooks are wired for this repo, not because an earlier attach left its record on disk. On-demand, so it is quiet until you go looking.
 - **Rides on, does not replace.** Sawbuck is the verify + memory layer. Your agent and your loop stay yours.
 - **Clean on and off.** `attach` writes a git-excluded `.claude/settings.local.json`, the lines in `.git/info/exclude` that keep its files out of `git status`, a receipt under `.git/sawbuck/`, a line in `~/.sawbuck/registry.json` (the list `detach --all` reads), and in a signed repo `.sawbuck/state.json` (`attach --git` writes the post-commit hook and `.sawbuck/state.json` in place of the settings file); `attach --dry-run` lists all of it. `detach` removes the hooks and the receipt, and still removes the hooks when the receipt is lost; `detach --dry-run` lists what would go. A post-commit hook that was there before `attach --git` is put back byte for byte. Signed contract files stay because they are yours to review. The record (`.sawbuck/`, the logbook files) stays too, still out of `git status`, until `detach --purge` deletes it and the exclude lines. `detach --verify` proves the wiring is gone and names what is left.
 - **A limit of the hooks file.** `.claude/settings.local.json` is kept out of git, so taking the hooks out of it shows in no diff, and the check cannot see it. `sawbuck doctor` can: it reads the receipt and says the hooks are gone, or that the set is incomplete (a missing Stop hook, say). `sawbuck attach --shared` avoids it: the hooks go in a tracked file, and a removal shows in git.
+- **A limit of the turn hook.** The hook re-runs your tests on commits, not on uncommitted work. A test edited to go green and left uncommitted is not sent back at the end of that turn. It is caught when it is committed, and `sawbuck check` reads it on demand, which is what the written rule tells the agent to run before finishing.
 - **A limit of the git hook.** `attach --git` pins the hook to the checkout it was attached from, so a commit made in a linked git worktree is not checked. A hooks folder inside the work tree (`core.hooksPath`, as husky sets it) is refused, and attach prints the line to add by hand; `detach`, `doctor` and `status` do not know about a line added that way.
 
 ## Commands
@@ -65,17 +66,34 @@ Exit codes: `0` verified · `1` regression · `2` gamed · `3` inconclusive · `
 |---|---|
 | `sawbuck contract` | gives a repo its rules: protected paths and the written rule. With no config yet it writes one with your detected tests; an existing config is kept as it is, and gets no tests added. `--full` adds supply-chain guards, a repo lock and a CI check (only with a github.com origin and a real test command; it says when it skips it). `--strict` makes them block, also after an earlier `--full`. `--dry-run` previews |
 | `sawbuck check [--base R --head R] [--repeat N] [--allow "reason"] [--json]` | verify your latest change (working tree if dirty, else the last commit, or a range); zero-config, no attach, no record. Every `promptwheel run` flag passes through: this is the engine with a plain-spoken verdict |
-| `sawbuck attach [--user \| --shared \| --git]` | check every Claude Code turn here. `--user`: in every repo that has a `promptwheel.config.json`. `--shared`: a tracked `.claude/settings.json` a team commits, with no path from your machine in it. `--git`: a post-commit hook, so every commit is checked whatever made it, from the first one after attach (the very first commit of a repo has nothing to be checked against). It leaves a hook alone if it is not a shell script or not executable, and says what to add by hand |
+| `sawbuck attach [--user \| --shared \| --git]` | watch every Claude Code turn here: protected paths at the end of each turn, a source-only re-run on each commit. `--user`: in every repo that has a `promptwheel.config.json`. `--shared`: a tracked `.claude/settings.json` a team commits, with no path from your machine in it. `--git`: a post-commit hook, so every commit is checked whatever made it, from the first one after attach (the very first commit of a repo has nothing to be checked against). It leaves a hook alone if it is not a shell script or not executable, and says what to add by hand |
 | `sawbuck detach [--user] [--all] [--verify] [--purge] [--dry-run]` | remove the hooks; no flag removes whatever is wired here, with or without the receipt, `--all` does every repo. `--purge` also deletes the record, `--dry-run` only lists what would go |
 | `/sawbuck-reins:audit` | finds rules in your agent files that can pull against each other, and proposes which wins. No history needed |
 | `/sawbuck-reins:rules` | proposes the rules you keep enforcing, from your own messages, each with quotes; you pick what to keep. Tested on one person so far |
 | `/sawbuck-reins:shape` | what you push on, from a sample of your own messages, as a card. It also reads up to 120 past turns and names habits the agent has that you never push on, each with the agent's own words. Leads from one read, tested on one person |
+| `sawbuck init` | writes only the config: your detected tests and the tripwires, with notes from your history. `contract` runs it for you when the repo has no config yet |
 | `sawbuck status` | the inventory (caught over time, debt now, armed state, what you keep saying), in one view; `--log` for the recent per-check feed |
 | `sawbuck debt [repo]` | the whole-repo live suppression debt: what is still silenced in HEAD now, disabled tests first, heaviest files ranked |
 | `sawbuck context` | the ranked relevant history for the current change |
 | `sawbuck doctor [--all]` · `detach --verify` | run what each hook runs (project and user level) and say if it still works, if the set is incomplete, or if it is gone (exit 1), `--all` for every repo it is attached to; prove the wiring is gone |
 | `sawbuck statusline` | a one-line status-line segment (🐴 watching / N caught) |
 
+## Protected paths
+
+`sawbuck contract` protects these by default. A change to one reads "sent back", whoever made it.
+
+| rule | paths | how a person makes an exception |
+|---|---|---|
+| `contract-frozen` | `promptwheel.config.json`, `sawbuck.config.json` | `sawbuck check --allow "<reason>"` |
+| `hooks-frozen` | `.claude/settings.json`, `.claude/settings.local.json`, `.sawbuck/**` | `sawbuck check --allow "<reason>"` |
+| `workflows-frozen` | `.github/workflows/**` | remove the rule first |
+| `registry-config-frozen` | `.npmrc`, `.yarnrc`, `.yarnrc.yml` | remove the rule first |
+| `build-images-frozen` | `Dockerfile*`, `docker-compose*` | remove the rule first |
+| `publish-scripts-frozen` | `scripts/release*`, `scripts/publish*` | remove the rule first |
+| `codeowners-frozen` | `CODEOWNERS` | remove the rule first |
+
+To remove a rule, delete its entry under `mandates` in `promptwheel.config.json`, in a commit of its own. That file is protected too, so that commit takes `--allow`. Then make the change. To protect another path, add an entry the same way: `{"name": "billing-frozen", "paths": ["src/billing/**"], "reason": "billing changes go through review"}`.
+
 ## Give your agent the rule
 
 `sawbuck contract` and `sawbuck init` write this block into your `AGENTS.md` for you (and `CLAUDE.md` / `.cursorrules` if present; `init --no-agent-block` skips it), and `sawbuck attach` enforces it through the hook: every turn checks protected paths, and every commit is re-proved. Here it is to paste yourself if you want:
@@ -120,9 +138,9 @@ Debt is on demand: `sawbuck debt`, and `sawbuck context` for the files in hand.
 
 ## The engines
 
-Sawbuck is thin glue over two roles, each behind an open interface that points in opposite directions:
+Sawbuck is thin glue over two engines:
 
-- **the check** : the deterministic outcome gate, a published standard (the [Verified-Outcome Contract](CONTRACT.md)) that others conform to. Reference implementation: **promptwheel**. You plug in *what* to measure (your tests, lint, coverage, an eval); the source re-proof is the fixed part. Embed it with `import { check }`, or check any tool's verdict with `conformsToContract()` from the same package.
+- **the check** : the deterministic outcome gate, written up as a draft spec (the [Verified-Outcome Contract](CONTRACT.md)). Reference implementation: **promptwheel**. You plug in *what* to measure (your tests, lint, coverage, an eval); the source re-proof is the fixed part. Embed it with `import { check }`, or check any tool's verdict with `conformsToContract()` from the same package.
 - **the memory** : the relevant history for the files you touch, plus the live debt, from **@promptwheel/logbook** (git history as agent memory; also ships an MCP server).
 
 Apache 2.0.

package/bins.mjs

@@ -1,6 +1,6 @@
 // bins.mjs: resolve the two engine CLIs once, for every sawbuck entry point.
 // Order: env override (PW_BIN / LB_BIN), the installed package, then the dev sibling checkout.
-// The memory engine is reached only through memory.mjs (the Memory Contract seam); LB lives
+// Logbook is reached only through memory.mjs; LB lives
 // here so the resolver is written once, not per file.
 
 import { dirname, join } from 'node:path';

package/contract-cmd.mjs

@@ -115,4 +115,4 @@ try { files = execFileSync('git', ['-C', repo, 'ls-files'], { encoding: 'utf8',
 const seen = new Set();
 for (const f of files) { const m = f.match(/^(.*?(?:^|\/)(?:auth|authentication|billing|payments?|migrations))\//); if (m && !/(^|\/)(node_modules|test|tests|docs?)\//.test(m[1])) seen.add(m[1]); }
 if (seen.size) process.stdout.write(`\n  To protect product code too, add these protected paths under "mandates" in promptwheel.config.json:\n${[...seen].slice(0, 5).map((d) => `    { "name": "${d.replace(/\W+/g, '-')}", "paths": ["${d}/**"], "reason": "changed by a person" }`).join('\n')}\n`);
-if (!dry) process.stdout.write(`\n  Commit promptwheel.config.json and AGENTS.md${full ? ', promptwheel.lock.json and .promptwheel/packs/' : ''}. Then sawbuck attach checks every turn.\n`);
+if (!dry) process.stdout.write(`\n  Commit promptwheel.config.json and AGENTS.md${full ? ', promptwheel.lock.json and .promptwheel/packs/' : ''}. Then sawbuck attach watches every turn: protected paths at turn end, each commit re-proved.\n`);

package/debt.mjs

@@ -37,7 +37,7 @@ const asJson = process.argv.includes('--json');
 // events give fragility + fall-back dates (Logbook's facts). Best-effort.
 const events = memEvents(repo);
 
-// the live suppression ledger via the memory adapter (the Memory Contract's `debt` capability). Each
+// the live suppression ledger via the Logbook adapter. Each
 // item arrives classified (documented/testSkip) and with its line content and blame date (`since`),
 // so this file does not import Logbook's pattern or gating. null = Logbook FAILED
 // (unmeasurable is NOT clean, refuse and exit nonzero); [] = a genuinely clean tree.

package/memory.mjs

@@ -16,7 +16,6 @@ function parseArray(out) {
 
 // --- debt sub-classification (Sawbuck policy; applied once so the ledger and the per-turn surface
 // agree).
-export const isTestSkip = (m) => /\bit\.skip\b|\btest\.skip\b|xit\(|xdescribe\(|\bdescribe\.skip\b|pytest\.mark\.skip|unittest\.skip|\bt\.Skip\b|@Disabled\b|@Ignore\b|^\[Ignore\b|^Skip\s*=|^#\[ignore|markTestSkipped|markTestIncomplete/.test(String(m).trim());
 export const isDocumented = (c) => {
   c = String(c || '');
   if (/eslint-disable/.test(c)) return /eslint-disable(?:-next-line|-line)?\s+\S/.test(c);
@@ -27,12 +26,11 @@ export const isDocumented = (c) => {
   return /\(\s*["']/.test(c) || /=\s*["']/.test(c);
 };
 
-const classify = (r, source) => ({
+const classify = (r) => ({
   file: r.file, line: r.line, kind: String(r.kind ?? '').trim(), content: r.content ?? '',
   since: r.since ?? null, sha: r.sha ?? null,
   documented: r.content ? isDocumented(r.content) : false,
-  testSkip: typeof r.testSkip === 'boolean' ? r.testSkip : isTestSkip(r.kind ?? r.content ?? ''),   // logbook >=0.9.8 classifies it; the regex is the fallback for older providers
-  source,
+  testSkip: r.testSkip === true,   // Logbook classifies it
 });
 
 // events(): the raw git event record, the ranking input. [] on failure, exactly as "no history".
@@ -45,16 +43,10 @@ export function events(repo) {
 // debt(): live suppressions still in the tree, each classified. null when Logbook could not answer.
 export function debt(repo, { paths = null, ref = null } = {}) {
   const out = run(LB, repo, ['audit', '--json', ...(ref ? ['--ref', ref] : []), ...((paths || []).flatMap((f) => ['--file', f]))]);
-  return out === null ? null : parseArray(out).map((r) => classify(r, 'logbook'));
+  return out === null ? null : parseArray(out).map(classify);
 }
 
 // record(): keep a machine finding as an annotation. Best-effort, never throws into the caller.
-export function record(repo, { sha, reason, side, evidenceFile, by = 'sawbuck' }) {
-  const text = String(reason).slice(0, 280);
-  const exec = (a) => execFileSync(process.execPath, [LB, ...a], { cwd: repo, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
-  try {
-    try { exec(['annotate', sha, text, ...(side ? ['--side', side] : []), ...(evidenceFile ? ['--evidence-file', evidenceFile] : []), '--by', by]); }
-    catch { exec(['annotate', sha, text, '--by', by]); }
-    return true;
-  } catch { return false; }
+export function record(repo, { sha, reason, by = 'sawbuck' }) {
+  return run(LB, repo, ['annotate', sha, String(reason).slice(0, 280), '--by', by]) !== null;
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sawbuck",
-  "version": "0.1.47",
-  "description": "Sign your agent to a contract: a deterministic, zero-LLM check re-proves each win from the agent's source edits alone, so a test that went green by editing the test, grader, or config is sent back. For Claude Code, with Codex untested.",
+  "version": "0.1.49",
+  "description": "Write down the rules your agent follows, and prove they held. A deterministic, zero-LLM check re-proves each win from the agent's source edits alone, so a test that went green by editing the test, grader, or config is sent back. For Claude Code, with Codex untested.",
   "type": "module",
   "license": "Apache-2.0",
   "engines": {

package/rank.mjs

@@ -77,11 +77,10 @@ const normMult = (p, kind) => {
 // The "slider": debt rises on its own, but gently. A disabled test or an undocumented suppression
 // on a touched file always surfaces; a file that is churning (hot / reverted) surfaces any debt;
 // a stable file's routine documented suppressions stay quiet until they pile past DEBT_MIN. Tune
-// with SAWBUCK_DEBT_MIN. This is how debt rises by itself in the per-turn context, no command run.
+// with SAWBUCK_DEBT_MIN. This is how debt shows up in `sawbuck context` with no command of its own.
 const DEBT_MIN = Math.max(1, +(process.env.SAWBUCK_DEBT_MIN) || 6);
 
-// Still-live filter + ambient debt, via the memory adapter (the Memory Contract's `debt`
-// capability), scoped to the touched paths so the per-turn hook stays cheap. A suppression on a path
+// Still-live filter + ambient debt, via the Logbook adapter, scoped to the touched paths so the read stays cheap. A suppression on a path
 // now CLEAN of suppressions is churn, not current risk (the study: AutoMapper carries 4 live
 // `[Ignore]` vs ~158/repo across C# history). The adapter runs Logbook's own detection + gating
 // and returns classified suppressions, so the glue never imports its pattern. null = the

package/reflect.mjs

@@ -16,14 +16,11 @@
 
 import { execFileSync } from 'node:child_process';
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
-import { join, dirname } from 'node:path';
-import { fileURLToPath } from 'node:url';
+import { join } from 'node:path';
 import { record as memRecord } from './memory.mjs';
 import { PW } from './bins.mjs';
 
-const HERE = dirname(fileURLToPath(import.meta.url));
-// The MEMORY engine is reached only through memory.mjs (the Memory Contract seam), never
-// resolved or shelled directly here.
+// Logbook is reached only through memory.mjs, never resolved or shelled directly here.
 
 const flag = (name, def) => { const i = process.argv.indexOf(name); return i > -1 ? process.argv[i + 1] : def; };
 const repo = flag('--repo', process.cwd());
@@ -110,15 +107,12 @@ const reason = kind === 'gamed'
   : `sawbuck: a change here regressed a guarded metric beyond noise`;
 
 // --- 3) record the finding in memory (unreviewed, machine-authored note) ----
-// The Memory Contract's `record` capability, through the adapter (no direct engine shell here).
-// Kept simple: a commit-attached digest note. A later pass could add --span grounding
-// and true coupling (the fix diff -> "change X also needs Y"). A gamed verdict still standing
-// over the same span is the same catch, not a new one: no second note, no second tick.
-const repeatOfStanding = standing && kind === 'gamed';
-if (!repeatOfStanding) memRecord(repo, { sha, reason: reason.slice(0, 280), side: 'diff', evidenceFile, by: 'sawbuck' });
+// A note on the commit, through the Logbook adapter. A gamed verdict still standing over the same span never
+// gets here (it exited above), so one catch is one note and one tick.
+memRecord(repo, { sha, reason: reason.slice(0, 280), by: 'sawbuck' });
 
 // --- 4) tick the results record (the visible proof-of-work) -----------------
-if (!repeatOfStanding) { if (kind === 'gamed') rec.gamed += 1; else rec.regressions += 1; }
+if (kind === 'gamed') rec.gamed += 1; else rec.regressions += 1;
 rec.latest = { sha: sha.slice(0, 8), kind, base: baseSha || null, file: evidenceFile, reason: reason.replace(/^sawbuck: /, '').slice(0, 140), at: new Date().toISOString(), by: by || null };
 writeRec();
 

package/rules.mjs

@@ -1,8 +1,9 @@
 // Find the rules you keep enforcing and never wrote down. `prepare` gathers what you typed to Claude Code, on this
 // machine, with copies and likely secrets removed. The agent proposes rules from it, each with quotes. `check` proves
 // every quote is really yours: a rule with fewer than two real quotes is dropped. Nothing is added to any file here.
-import { readFileSync, writeFileSync, mkdirSync, existsSync, statSync, chmodSync } from 'node:fs';
-import { join } from 'node:path';
+// Once the check has run, the gathered messages and the candidates are deleted: they were for that one read.
+import { readFileSync, writeFileSync, mkdirSync, existsSync, statSync, chmodSync, rmSync } from 'node:fs';
+import { join, resolve, dirname } from 'node:path';
 import { homedir } from 'node:os';
 import { readHistory, typedText } from './history.mjs';
 
@@ -10,6 +11,11 @@ const MAX_LINES = 3000;
 export const SECRET = /(sk-[a-z0-9_-]{16,}|gh[pousr]_[a-z0-9]{20,}|github_pat_\w{20,}|AKIA[0-9A-Z]{16}|xox[baprs]-[\w-]{10,}|eyJ[\w-]{20,}\.[\w-]{10,}|-----BEGIN [A-Z ]*PRIVATE KEY|\b[a-f0-9]{40,}\b|(password|passwd|secret|token|api[_-]?key)\s*[:=]\s*\S+)/i;
 const norm = (s) => s.toLowerCase().replace(/\s+/g, ' ').trim();
 const paths = (home) => ({ dir: join(home, '.sawbuck'), input: join(home, '.sawbuck', 'rule-input.txt') });
+// remove what one read gathered. A file the model wrote counts only when it sits in ~/.sawbuck: anywhere else it is the person's own.
+export function forget(home, ...files) {
+  const dir = resolve(paths(home).dir);
+  for (const f of files) if (f && dirname(resolve(f)) === dir) rmSync(f, { force: true });
+}
 
 export function prepareRules({ home = homedir() } = {}) {
   const found = [];
@@ -60,6 +66,7 @@ export function rulesCli(args, { home = homedir() } = {}) {
     if (!file || !existsSync(file) || !statSync(file).isFile()) return '🐴 sawbuck: --check needs the candidates file.';
     if (!existsSync(paths(home).input)) return '🐴 sawbuck: run sawbuck rules --prepare first.';
     const { kept, dropped } = checkRules(file, { home });
+    forget(home, paths(home).input, file);
     const out = [`🐴 ${kept.length} rules have at least 2 quotes that are really yours${dropped.length ? `, ${dropped.length} dropped` : ''}.`];
     kept.forEach((r, n) => { out.push('', `${n + 1}. ${r.rule}`); for (const q of r.quotes.slice(0, 3)) out.push(`     "${q.slice(0, 110)}"`); });
     return out.join('\n');

package/sawbuck-hook.mjs

@@ -6,11 +6,11 @@ import { ensureExcluded } from './exclude.mjs';
 
 import { execFileSync } from 'node:child_process';
 import { readFileSync, writeFileSync, mkdirSync, existsSync, appendFileSync } from 'node:fs';
-import { join, dirname, resolve } from 'node:path';
+import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const HERE = dirname(fileURLToPath(import.meta.url));
-import { mandateHits, hashOf, protectedDirty, protectedAmong, lockState } from './contract.mjs';
+import { mandateHits, hashOf, protectedAmong, lockState } from './contract.mjs';
 const flag = (n, d) => { const i = process.argv.indexOf(n); return i > -1 ? process.argv[i + 1] : d; };
 const by = flag('--by', '');   // attribution from the harness wiring: the Claude hook passes 'claude', the raw-git hook passes nothing
 const stop = process.argv.includes('--stop');   // wired as the Claude Code Stop hook: enforce the contract on a gamed turn
@@ -182,8 +182,3 @@ if (total > (st.shownTotal || 0)) {
   st.shownTotal = total;
 }
 saveState();
-
-// Keep the record dirs out of `git status` via .git/info/exclude, so Sawbuck never
-// dirties the worktree, including under `attach --user`, which is global and cannot
-// set this up per-repo at attach time. Idempotent; markers match the CLI's so a
-// per-repo `detach` removes them.

package/sawbuck.mjs

@@ -20,7 +20,7 @@ import { basename, join, dirname, resolve, relative } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { homedir } from 'node:os';
 import { PW } from './bins.mjs';
-import { frameBlock, mandatesInForce, protectedDirty, blobAt, lockState } from './contract.mjs';
+import { frameBlock, mandatesInForce, protectedDirty, protectedAmong, blobAt, lockState } from './contract.mjs';
 
 const SELF = fileURLToPath(import.meta.url);
 const HERE = dirname(SELF);
@@ -61,12 +61,6 @@ function detectedTests(repo) {
 const metricLive = (m) => !!m && !m.inert && m.status !== 'unmeasurable' && m.before != null;
 const S_END = '# <<< sawbuck <<<';
 const BLOCK_RE = new RegExp(`${S_START}[\\s\\S]*?${S_END}\\n?`, 'g');   // exactly what attach --git puts in, so taking it out leaves the bytes that were there
-// the record/state dirs the engines write into the worktree; excluded locally so
-// attach never dirties `git status`.
-// The record Sawbuck keeps on disk but must never let dirty git status: the engine records
-// plus the logbook's root working-set (ledger cache, digests, annotation planes). It is
-// memory, not the user's source, a user who wants LOGBOOK.md committed still can explicitly
-// (exclude only affects UNtracked files).
 
 const argv = process.argv.slice(2);
 const cmd = argv[0];
@@ -87,7 +81,8 @@ Usage:
                             Verify your latest change right now (working tree if dirty, else the last
                             commit, or the range you name). Zero-config, no attach, no hook. The
                             fastest way to see it work. Every promptwheel run flag passes through.
-                            Exit 0 verified · 1 regression · 2 gamed · 3 inconclusive · 64 could not run
+                            Exit 0 pass (verified, held, or allowed) · 1 sent back (a regression or a
+                            protected path) · 2 gamed · 3 inconclusive · 64 could not run
                             (--working with nothing uncommitted is 64 too)
   sawbuck init [--yes] [--wizard] [--no-investigate] [--no-agent-block] [--force]
                             Write promptwheel.config.json: your detected tests and the tripwires, with
@@ -95,7 +90,8 @@ Usage:
                             AGENTS.md (--no-agent-block to skip). Wizard in a terminal, non-interactive in
                             a pipe/CI (or --yes). An existing config needs --force.
   sawbuck attach [repo] [--user | --shared | --git] [--dry-run]
-                            Check every Claude Code turn in this repo. --user: every repo that has a
+                            Watch every Claude Code turn in this repo: protected paths at the end of each
+                            turn, a source-only re-run on each commit. --user: every repo that has a
                             promptwheel.config.json. --shared: a tracked settings file a team commits.
                             --git: a post-commit hook, for any other agent or none (commits in a linked
                             worktree are not checked). --dry-run prints every file it would write
@@ -151,6 +147,7 @@ if (!cmd || cmd === '--help' || cmd === '-h' || cmd === 'help') {
 
   sawbuck contract   give this repo its rules: protected paths, your tests
   sawbuck check      verify your latest change right now
+  sawbuck attach     make it automatic in Claude Code: protected paths each turn, every commit re-proved
   sawbuck status     what it has caught here
 
   sawbuck help --all   everything else`);
@@ -243,7 +240,14 @@ switch (cmd) {
       out('🐴 🚩 gamed: a win here came from editing the test, config, or grader, not the source. It does NOT survive a source-only re-run, so it does not count.');
       if (!dirty && /^(Sawbuck|Promptwheel)-Allow:/im.test(g('log', '--format=%B', `${base || 'HEAD~1'}..${head || 'HEAD'}`))) out('🐴 note: a Sawbuck-Allow trailer does not clear this, because an agent can write a commit message. A person passes --allow "<reason>".');
     }
-    else if (rep.verdict === 'fail' && (rep.mandates || []).length) out('🐴 ✗ sent back: a protected path changed, however green the rest is.');
+    else if (rep.verdict === 'fail' && (rep.mandates || []).length) {
+      out('🐴 ✗ sent back: a protected path changed, however green the rest is.');
+      // the way through, for a person who meant it: two of the default rules take a reason, the rest are lifted first
+      const names = (l) => l.map((x) => `"${x.name}"`).join(', ');
+      const soft = rep.mandates.filter((x) => x.allowable), hard = rep.mandates.filter((x) => !x.allowable);
+      if (soft.length) out(`🐴 if a person meant this: sawbuck check --allow "<reason>" accepts ${names(soft)}, and the result shows the reason.`);
+      if (hard.length) out(`🐴 ${names(hard)} ${hard.length > 1 ? 'take' : 'takes'} no --allow. To change that path on purpose, remove that rule from promptwheel.config.json in a commit of its own (that edit takes --allow), then make the change.`);
+    }
     else if (rep.verdict === 'fail') out('🐴 ✗ sent back: this change made something worse.');
     else out(`🐴 ≈ inconclusive: ${inconclusiveWhy(rep, repo)}`);
     if ((rep.metrics || []).some((x) => x.heldByTestEdit)) out('🐴 ⚠ your tests changed too, and the old tests fail on this source. Fine for an intended change. Otherwise check the tests were not weakened: a green that stays green is not proved.');
@@ -468,7 +472,7 @@ function verifyAttach(repo) {
   const { rep } = gateReport(repo, ['run', '--base', base, '--head', 'HEAD']);
   const m = rep && (rep.metrics || [])[0];
   if (metricLive(m)) out(`   ✓ I can measure "${m.name}" here. On each commit I'll verify a win survived a source-only re-run, and flag it if it did not.`);
-  else out(`   ⚠ I could not measure anything here yet: ${rep ? inconclusiveWhy(rep, repo) : 'the check did not run'} I stay quiet until then.`);
+  else out(`   ⚠ I could not measure anything here yet: ${rep ? inconclusiveWhy(rep, repo) : 'the check did not run'}`);
 }
 
 // --- the attach receipt (out of the worktree, inside .git) ------------------
@@ -691,6 +695,7 @@ function wireClaude(repo, opts) {
   const kind = user ? 'USER-LEVEL' : shared ? 'shared project' : 'project';
   out(upgrading ? `sawbuck: updated the ${kind} Claude Code hooks in ${f} to this version` : `sawbuck: wired ${kind} Claude Code hooks in ${f}`);
   if (shared) out(`  commit ${relative(repo, f)} so the team gets the check. It runs sawbuck ${version} through npx on every machine.`);
+  if (shared && protectedAmong(repo, [relative(repo, f)]).length) out(`  That file is a protected path in this repo, so the check on its commit reads "sent back" unless a person passes --allow "team hooks" (on a pull request: a comment, sawbuck-allow: team hooks).`);
   if (!user && !existsSync(join(repo, 'AGENTS.md')) && !existsSync(join(repo, 'CLAUDE.md'))) out('  no written rule here yet, and that is what changes the agent: run sawbuck contract.');
   if (user) out('  profile-switches by cwd: memory in any git repo, the check where a promptwheel.config.json exists.');
 }

package/shape.mjs

@@ -11,7 +11,7 @@ import { readFileSync, writeFileSync, appendFileSync, mkdirSync, existsSync, rmS
 import { execFileSync } from 'node:child_process';
 import { join, dirname } from 'node:path';
 import { homedir } from 'node:os';
-import { prepareRules, SECRET } from './rules.mjs';
+import { prepareRules, SECRET, forget } from './rules.mjs';
 import { readHistory, typedText } from './history.mjs';
 
 export const GROUPS = { Truth: ['correctness', 'proof', 'honesty'], Intent: ['scope', 'autonomy'], Craft: ['voice', 'naming', 'visual', 'simplicity'], Control: ['process', 'safety'] };
@@ -117,7 +117,6 @@ export function tally(labels) {
   return { n: total, none, groups, ratings, shares, spokes: total >= MIN_SPOKES };
 }
 
-// What was not said: each spoke we can measure from what the agent did, read against how often you push on it.
 export function shapeSvg(t) {
   const names = t.spokes ? SPOKES : Object.keys(GROUPS);
   const vals = t.spokes ? names.map((s) => t.ratings[s] / 99) : names.map((g) => 0.25 + 0.75 * t.groups[g] / Math.max(1, ...Object.values(t.groups)));
@@ -172,6 +171,7 @@ export function shapeCli(args, { home = homedir() } = {}) {
   }
   if (!t.spokes) out.push('', `  Too few messages for the 11 spokes (${t.n} of ${MIN_SPOKES}), so this shows the 4 groups.`);
   appendFileSync(p.hist, JSON.stringify({ at: new Date().toISOString(), n: t.n, groups: t.groups, shares: t.shares }) + '\n');
+  forget(home, p.input, p.rules, file);   // the sampled messages and their labels were for this one read; the totals above are what stays
   out.push(...notSaid(p));
   out.push('', `  Card: ${p.svg}`);
   if (args.includes('--png')) { const png = pngCard(p.svg); out.push(png ? `  Image to share: ${png}` : '  No image tool here (rsvg-convert or Chrome): open the card in a browser to save an image.'); }

package/status.mjs

@@ -21,9 +21,7 @@ const flag = (n, d) => { const i = process.argv.indexOf(n); return i > -1 ? (pro
 const repo = resolve(flag('--repo', process.cwd()));
 const asJson = process.argv.includes('--json');
 
-const readJSON = (p) => { try { return JSON.parse(readFileSync(p, 'utf8')); } catch { return null; } };
 const readLines = (p) => { try { return readFileSync(p, 'utf8').split('\n').filter(Boolean); } catch { return []; } };
-const git = (...a) => { try { return execFileSync('git', ['-C', repo, ...a], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim(); } catch { return ''; } };
 
 const ICON = { verified: '✓', gamed: '🚩', regression: '✗', inconclusive: '≈', allowed: '✎', mandate: '⛔' };
 
@@ -38,8 +36,6 @@ for (const e of feed) if (e && tally[e.kind] != null) tally[e.kind]++;
 const seen = feed.length;
 const latest = results.latest || (feed.length ? feed[feed.length - 1] : null);
 const since = feed.length ? (feed[0].at || '').slice(0, 10) : null;
-// the steer rate, if the reins judge has been scoring turns here (an OFFLINE read of its file, in repoState; the
-// recent-window average over roughly the last twenty scored turns, as the band and statusline show it)
 
 // --- 2) the armed state: what it can measure here (shared with the statusline) ---
 const isGit = !!existsSync(join(repo, '.git'));
@@ -147,7 +143,7 @@ if (!isGit) {
 } else if (state === 'watching' && wired === 'user' && !hasConfig) {
   out.push('   Measuring here  ·  wired in at user level, and that check runs only in a repo that has a promptwheel.config.json. `sawbuck contract` writes one.');
 } else if (state === 'watching') {
-  out.push(`   Measuring here  ·  ${hasConfig ? '✓ wired in with a contract (promptwheel.config.json)' : '✓ wired in (zero-config auto-detect)'}. It verifies each commit/turn automatically.`);
+  out.push(`   Measuring here  ·  ${hasConfig ? '✓ wired in with a contract (promptwheel.config.json)' : '✓ wired in (zero-config auto-detect)'}. Protected paths are checked at the end of each turn, and each commit is re-proved from the source.`);
 } else if (state === 'ready') {
   out.push(`   Measuring here  ·  checkable but not wired yet. Try it now: \`sawbuck check\`  •  make it automatic: \`sawbuck attach\``);
 } else {