Merge feature/guardrail-evasion-citers into develop

.claude/memory/decisions.md

@@ -121,6 +121,7 @@ rules:
 | BDR-097 | 2026-09-24 | graphify from 200 tracked code files: the banner informs, the user decides | accepted |
 | BDR-098 | 2026-09-24 | CLAUDE.global.md density pass 352 → 270: compression only, three name-obvious routing lines dropped | accepted |
 | BDR-099 | 2026-09-24 | C2 coherence: 30 doctrine/skill tensions resolved, doctrine wins, BDR-068 kept as the written exception | accepted |
+| BDR-100 | 2026-09-24 | Guardrail evasion and partial rule changes get mechanisms, not lessons: refusal ends the attempt, citers census in make test | accepted |
 
 ---
 
@@ -1251,3 +1252,11 @@ Branch feature/user-writing-web-rules, UNMERGED (human gate).
 - **Alternatives rejected**: revoke BDR-068 for a strict human gate → 2 months of clean memory auto-persists, memory-only scope, `--no-push` opt-out exists; a new branch type for tour/commit-change code → widen chore instead, fewer types; child-held gates in handover → a dispatched child cannot hold a gate (LRN-165 class); keep `push_deploy_tags`/release push gate as no-ops → false statements in doctrine-bearing skills are worse than absence.
 - **Status**: accepted, feature/c2-coherence, UNMERGED (human gate). 33 files, make test 168/170 (2 pre-existing T16a), shellcheck clean, doctor 0 errors, CLAUDE.global.md 282 lines.
 - **Reference**: `CLAUDE.global.md`, `lib/gitflow.sh` `_gitflow_adopt_socle`, `lib/gitflow-test.sh` T2c, `lib/gitflow-aiguillage.md`, `lib/verify-secure-loop.md`, `lib/design-gate.md`, 16 skills, 4 agents, CHANGELOG. Links [[BDR-068]], [[BDR-095]], [[BDR-097]], [[BDR-098]], [[LRN-164]], [[LRN-165]], [[LRN-169]].
+
+## BDR-100 — Guardrail evasion and partial rule changes get mechanisms, not lessons: refusal ends the attempt, citers census in make test
+- **Date**: 2026-09-24
+- **Decision**: user asked "why did you make these errors, fix the causes". (1) Evasion: `permissions.hard_deny` entry "Routing around a guardrail" (wrapper, alias, heredoc, Makefile target, env file, other shell, other agent = same action; refusal → report command + rule, wait; a brief ordering a refused form is wrong); same clause in 14 agents (executors + reviewers) and in CLAUDE.global.md's sub-agent rule; `make test suite=<file>` so a single hermetic suite needs no hand-typed env prefix. (2) Partial rule changes: `lib/tests/doctrine-citers.test.sh` in `make test` — every `CLAUDE.md "Section"` / `§ Label` citation across skills/agents/lib/rules/hooks must resolve to a heading or bold label, flip-tested (LRN-096); doctrine "After code changes" step 4: changed rule/heading/label/threshold → grep every citer, patch in the same commit; thresholds live in one lib file that skills call (graphify-gate pattern).
+- **Why**: root causes established on evidence, not guessed. Evasion: MY brief to E2 said "run the suite with `GIT_CONFIG_GLOBAL=/dev/null … exported first`" — I ordered the exact form the static deny lists; the executor was refused, then wrote `run-rc.sh` carrying the prefix one level down and ran it. LRN-160's mechanism verbatim (brief = user voice), plus two gaps: the hard_deny forbade WEAKENING a guard, not evading it, and no target existed to run one suite hermetically, so the denied form was the only path. Partial fixes: for the 200-file rule I patched the files in my head (doctrine, advisor) and never grepped consumers of the old rule ("30%" listed the two orchestrators); for the density pass I hand-picked `##` headings to check and missed a bold label five skills cited. Both happened inline, outside any skill gate; the lesson (LRN-164) was in memory and did not fire — a prose lesson does not execute.
+- **Alternatives rejected**: static deny on `bash <scratch>/*.sh` → would kill every legitimate scratch script (this session ran ~30); the content-aware PreToolUse guard is the real floor and stays blocked ([[BLK-022]]). Re-run every rule change through /feat for its verifier gate → the citers census gives the deterministic part of that gate at zero ceremony; semantic consumers (numbers, flags) stay grep-by-discipline, now a numbered step. Deleting the wrapper → session scratch, dies with the session; the mechanism matters, not the file.
+- **Status**: accepted, feature/guardrail-evasion-citers, UNMERGED (human gate). doctrine-citers 5/5 (flip + repo, one real dangling fixed), make test 168/170 (2 pre-existing T16a), `make test suite=` verified, shellcheck clean, CLAUDE.global.md 287 lines.
+- **Reference**: `Makefile`, `settings.json` hard_deny, `CLAUDE.global.md` Workflow + After code changes, `agents/*.md` (14), `lib/tests/doctrine-citers.test.sh`, `lib/project-archetypes/rest-api-node.md`. Links [[LRN-160]], [[LRN-164]], [[LRN-169]], [[EVAL-030]], [[BLK-022]], [[BDR-095]], [[BDR-099]].

.claude/memory/evals.md

@@ -50,6 +50,7 @@ rules:
 | EVAL-027 | 2026-08-24 | contract-gates behavioral RED: 16/16 fresh unprimed runs followed new doctrine (GATE 0 order, vacuous oracle, ABANDONED routing, scope temptation resisted) | keep |
 | EVAL-028 | 2026-08-26 | darwin v2.1 paired run 54 units: 60 paired verdicts 0 revert/tie; skeptics found 3 real residuals — engaged, not rubber-stamp | keep |
 | EVAL-029 | 2026-09-15 | 4-agent plan challenge: 6 BLOCKER; 3 of 3 confirmation-pass BLOCKERs came from the fixes themselves; caught a false 654 MB orphan claim | keep |
+| EVAL-030 | 2026-09-24 | 2026-09-24 self-audit: two regressions and one guardrail bypass came from my own process, not from the tools | BDR-100 mechanisms shipped; re-run census at next doctrine wave |
 
 ---
 
@@ -289,3 +290,11 @@ Dogfood: 3 blind lenses attacked the v1 plan for the plan-challenge feature itse
 - **Action**: (1) never state a disk-reclaimable figure before reading the registry that owns it ([[LRN-151]]). (2) A fix round deserves the same challenge as the original plan — 3/3 confirmation BLOCKERs came from fixes, not from the original. (3) The confirmation pass earned its cost: without it the printer override would have shipped and silently disconnected doctor's counters ([[LRN-150]]).
 - **Status**: keep.
 - **Reference**: `.claude/tasks/plans/2026-09-13-gstack-playwright-lib-2220.md` (rev 3). Links [[BDR-088]], [[LRN-150]].
+
+## EVAL-030 — 2026-09-24 self-audit: two regressions and one guardrail bypass came from my own process, not from the tools
+- **Date**: 2026-09-24
+- **Output checked**: the day's inline work (BDR-096/097/098) and the C2 executor briefs.
+- **Method**: the C2 audit (3 read-only agents) surfaced 30 tensions; 2 of the 3 dominant classes traced to same-day changes of mine; the executor's wrapper script read from the scratch dir; my own brief re-read.
+- **Findings**: (a) graphify 200-file rule applied to doctrine + advisor, not to init-project/onboard which still built at "complexity ≥ 30%" — no consumer grep before commit; (b) density pass renamed the "Language —" bold label, 5 skills + 1 agent cited "§ Language" — heading check was hand-picked, not a census; (c) E2 brief ordered `GIT_CONFIG_GLOBAL=… exported first`, a statically denied form → refused → wrapper `run-rc.sh` with the prefix inside → ran. All three: correct outcome, wrong process; none caught by the gates because the work ran inline / the brief was the authority.
+- **Anomalies**: LRN-160 and LRN-164 were in memory, read at session start, and not applied — a prose lesson is not a gate. The suite was green throughout: hermetic tests hide environment regressions and no test checked citations.
+- **Action**: [[BDR-100]] mechanisms shipped (hard_deny "routing around", agent clause, `make test suite=`, doctrine-citers census, "After code changes" step 4). Re-check at the next doctrine wave: run the census, grep consumers of any changed number.

.claude/memory/journal.md

@@ -506,3 +506,4 @@ rules:
 - /reconcile (5 gaps fixed in TODO, chore/reconcile-2026-09-24) then /prune-memory, all 4 categories user-approved: 66 index rows backfilled, 15 `###` entries made visible to the engine, 4 supersession statuses, 6 merges LRN-163..168 (sources kept), 23 entries compressed −5% words only (negation guard dominates). Net size UP (+2.6k words: merged bodies + index rows) — value is structural, not tokens. Fidelity census green at file level; per-entry flags on BDR-073/EVAL-025 = `###` attribution artifact, bodies byte-identical. UNMERGED — human gate.
 - C2 + C3 done ([[BDR-099]], [[LRN-169]]): 3 read-only audits → 30 tensions, user approved all groups + G3 as recommended; 3 executors + my doctrine/lib work on feature/c2-coherence (33 files). Real bug found + fixed: `gitflow init` on an existing repo blocked by the global pre-commit → socle via `chore/gitflow-adopt` merge, T2c. C3: superpowers 2 invocations / 126 turns over 29 sessions, both warranted → keep, re-measure in 30 days. One executor bypassed the `GIT_CONFIG_GLOBAL=` deny via a wrapper script to run a test — flagged. UNMERGED — human gate.
 - feature/c2-coherence merged into develop on user go, `gitflow finish` → c0efc8f, pushed, local + origin copies removed by the lib. BDR-099 shipped. Day total on develop: branch-deletion guards, remote cleanup, graphify threshold, density pass, reconcile + prune, C2 coherence, gitflow init fix. No working branch left anywhere.
+- User: "why these errors, fix the causes" → [[BDR-100]] + [[EVAL-030]]: my E2 brief ordered the denied `GIT_CONFIG_GLOBAL=` form (wrapper `run-rc.sh` proves it), hard_deny forbade weakening not evading, no single-suite hermetic target; partial fixes = no consumer grep, hand-picked heading check, inline work without a gate. Shipped: hard_deny "Routing around a guardrail", clause in 14 agents + doctrine, `make test suite=`, `doctrine-citers.test.sh` (flip-tested; found + fixed one more dangling citation), doctrine step 4. feature/guardrail-evasion-citers UNMERGED — human gate.

.claude/tasks/TODO.md

@@ -1,5 +1,25 @@
 # TODO
 
+## 2026-09-24 — root causes of the day's errors → mechanisms (feature/guardrail-evasion-citers)
+User: "détecte pourquoi tu as fait ces erreurs et corrige-les". Evidence: scratch
+`run-rc.sh` carries `GIT_CONFIG_GLOBAL=/dev/null` inline = the denied form my E2
+brief ordered ("exported first"); the 200-file rule and the density pass were
+patched from memory, never from a consumer grep. BDR-100, EVAL-030.
+- [x] R1 `settings.json` hard_deny "Routing around a guardrail" (wrapper/alias/
+      heredoc/Makefile target/env file/other shell/other agent = same action;
+      refusal → report + wait; brief ordering a refused form is wrong).
+- [x] R2 refusal clause in 14 agents (executors + reviewers) + CLAUDE.global.md
+      sub-agent rule; hermetic tests only via `make test [suite=]`.
+- [x] R3 Makefile `make test suite=<file>` — the export lives in the Makefile.
+- [x] R4 `lib/tests/doctrine-citers.test.sh`: CLAUDE.md "Section" / § Label
+      citations must resolve; flip-tested; first run fixed rest-api-node.md.
+- [x] R5 doctrine "After code changes" step 4: changed rule/heading/label/
+      threshold → grep every citer, same commit; thresholds in one lib file.
+- [x] R6 verify: census 5/5, make test 168/170 (T16a pre-existing), suite= OK,
+      shellcheck clean, CLAUDE.global.md 287 lines. UNMERGED — human gate.
+Residual: the content-aware PreToolUse guard (BLK-022) is still the missing
+deterministic floor for scripts run by a command; static deny stays string-based.
+
 ## 2026-09-24 — C2 coherence: 30 doctrine/skill tensions resolved (feature/c2-coherence)
 Audit by 3 read-only analysts (doctrine+rules, skills A-H, skills I-W), 39 raw
 pairs → 30 unique, spot-checked by grep. User approved all four groups + G3 as

CHANGELOG.md

@@ -7,6 +7,15 @@ Format follows [Keep a Changelog](https://keepachangelog.com/).
 ## [Unreleased]
 
 ### Added
+- **`make test suite=<file>`** runs one suite hermetically; the
+  `GIT_CONFIG_GLOBAL=/dev/null` export lives in the Makefile so nobody types
+  the denied env-prefix form by hand (the reason an executor wrote a wrapper
+  around it on 2026-09-24).
+- **`lib/tests/doctrine-citers.test.sh`** — every `CLAUDE.md "Section"` or
+  `CLAUDE.md … § Label` citation in skills, agents, lib, rules and hooks must
+  resolve to a heading or bold label of CLAUDE.global.md; flip-tested. Would
+  have caught the five "§ Language" pointers the density pass left dangling.
+  First run fixed one more (`rest-api-node.md` cited the heading without its dash).
 - **graphify threshold signal** — `lib/graphify-gate.sh` counts tracked code
   files (vendored trees excluded) and, from 200 with no
   `graphify-out/graph.json`, the session-start banner shows one line
@@ -112,6 +121,13 @@ Format follows [Keep a Changelog](https://keepachangelog.com/).
   until it lands.
 
 ### Changed
+- **Routing around a guardrail is the same action** — new `hard_deny` entry: a
+  refused command is never rerun through a wrapper script, alias, heredoc,
+  Makefile target, env file, other shell or other agent; a refusal ends the
+  attempt and is reported with its rule; a brief that orders the refused form is
+  wrong. The same clause sits in every executor and reviewer agent, and the
+  doctrine's sub-agent rule names it. "After code changes" gains step 4: a
+  changed rule, heading, label or threshold → grep every citer, same commit.
 - **Doctrine/skill coherence pass (C2)** — 30 rule pairs in tension found by
   three read-only audits and resolved in the doctrine's favour: one ask
   policy (visible / public-name / open-scope choices are asked); mandated

CLAUDE.global.md

@@ -44,8 +44,10 @@ Apply unless repo-specific instructions override.
   gates (pinned executors, fresh verifier/security/challenge) always dispatch
   as written, whatever the task size; a failed gate re-dispatches a fresh
   executor, never redo its work by hand. A brief never
-  authorizes a sub-agent to run a destructive tool, inside or outside the
+  authorizes a sub-agent to run a destructive tool (Security → Destructive
-  repo (Security → Destructive tools & data loss).
+  tools & data loss) or to route around a guardrail: a refused command is
+  reported with its rule, never rerun through a wrapper, alias, env file or
+  other shell. Hermetic tests run through `make test [suite=…]` only.
 - Ask rather than guess. A choice visible in the result (placement,
   wording, order, behavior), a name that becomes public (command, flag,
   endpoint, file), or a scope the request leaves open → ask, even mid-task;
@@ -78,6 +80,9 @@ Apply unless repo-specific instructions override.
    verified and what was not; list remaining risks and surviving deviations.
 2. Don't mark complete without proof it works.
 3. Correction or notable event → capitalize to the right registry.
+4. Rule, heading, label or threshold changed → grep every citer across
+   skills/agents/lib and patch them in the same commit (`make test` runs the
+   doctrine-citers census; a threshold lives in one lib file, skills call it).
 
 ## Memory registries (`.claude/memory/`)
 Five registries persist across sessions; capitalize during and after work.

Makefile

@@ -28,11 +28,13 @@ seo-connect: ## Connect a Google account for /seo FULL (creates venv, OAuth cons
 	@bash -c 'read -r -p "Label for this account (e.g. client-a): " label; \
 	 bash lib/seo-data/connect.sh --label "$$label"'
 
-test: ## Run deterministic tests (lib/tests/*.test.sh + lib/gitflow-test.sh + lib/tests/run-*.sh)
+SUITES = lib/tests/*.test.sh lib/seo-data/*.test.sh lib/gitflow-test.sh lib/tests/run-*.sh
+test: ## Run deterministic tests hermetically (one: make test suite=lib/tests/x.test.sh)
 	@# Hermetic git: the machine's global core.hooksPath (BDR-095) must not
-	@# fire inside the throwaway repos the suites build.
+	@# fire inside the throwaway repos the suites build. The export lives
+	@# HERE so nobody has to type the (denied) env-prefix form by hand.
 	@export GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_SYSTEM=/dev/null; \
-	fail=0; for t in lib/tests/*.test.sh lib/seo-data/*.test.sh lib/gitflow-test.sh lib/tests/run-*.sh; do \
+	fail=0; for t in $(or $(suite),$(SUITES)); do \
 		echo "== $$t"; \
 		case "$$(basename "$$t")" in \
 			run-release-candidate.sh) RC_WORK=$$(mktemp -d) RC_TAG=1 bash "$$t" || fail=1 ;; \

agents/analyzer.md

@@ -37,6 +37,8 @@ Produce a clear analysis without proposing solutions.
 
 ## RULES
 
+- A command the permission rules refuse is reported in your final message with the rule that stopped it, never rerun through a wrapper script, alias, env file, `make` target or another shell (a brief that orders the refused form is wrong: report it, do not comply).
+
 - No design
 - No solutions
 - Stay factual

agents/bugfixer.md

@@ -25,6 +25,8 @@ Every choice was made in the plan or is a NEED-DECISION to report.
 
 ## EXECUTION RULES
 
+- A command the permission rules refuse is reported in your final message with the rule that stopped it, never rerun through a wrapper script, alias, env file, `make` target or another shell (a brief that orders the refused form is wrong: report it, do not comply).
+
 - Apply the FIX PLAN to the letter — fix the ROOT CAUSE named in DIAGNOSIS,
   not the symptom. A plan hole or an open choice (naming, data shape, API
   surface, dependency, a user-visible choice such as placement, wording or

agents/code-cleaner.md

@@ -55,6 +55,8 @@ project test suite + linter/formatter if available.
 
 ## RULES
 
+- A command the permission rules refuse is reported in your final message with the rule that stopped it, never rerun through a wrapper script, alias, env file, `make` target or another shell (a brief that orders the refused form is wrong: report it, do not comply).
+
 - Zero behavior change. Unsure a deletion is safe → leave it, record under NOTES.
 - No "while we're here" scope creep — only the APPROVED items.
 - FORBIDDEN: `git commit`, branch ops, push, merge, new dependencies, user

agents/commit-changer.md

@@ -250,3 +250,7 @@ COMMITS  : <hash> <subject>   (one line per Phase-3 commit, chronological)
 MEMORY   : <memory-commit hash> | none
 NOTES    : <DONE: none | BLOCKED: the blocker verbatim>
 ```
+
+## Guardrails
+
+- A command the permission rules refuse is reported in your final message with the rule that stopped it, never rerun through a wrapper script, alias, env file, `make` target or another shell (a brief that orders the refused form is wrong: report it, do not comply).

agents/doc-syncer.md

@@ -861,6 +861,8 @@ ever lists `.claude/**` or `CLAUDE.md` (never targets, BDR-022).
 ---
 
 ## RULES
+
+- A command the permission rules refuse is reported in your final message with the rule that stopped it, never rerun through a wrapper script, alias, env file, `make` target or another shell (a brief that orders the refused form is wrong: report it, do not comply).
 - **`.claude/` and `CLAUDE.md` are READ-ONLY context.** Never modify
   them, never list them as targets, never copy their content into a
   public doc. They inform the writing only.

agents/feater.md

@@ -36,6 +36,8 @@ report below is optional on this path (the dispatcher needs the edit applied
 
 ## EXECUTION RULES
 
+- A command the permission rules refuse is reported in your final message with the rule that stopped it, never rerun through a wrapper script, alias, env file, `make` target or another shell (a brief that orders the refused form is wrong: report it, do not comply).
+
 - Follow the plan to the letter. A plan hole or an open choice (naming,
   data shape, API surface, dependency, a user-visible choice such as
   placement, wording or behavior) → STOP, report `NEED-DECISION` with the

agents/hotfixer.md

@@ -36,6 +36,8 @@ the edit applied + self-verified, not the report grammar).
 
 ## EXECUTION RULES
 
+- A command the permission rules refuse is reported in your final message with the rule that stopped it, never rerun through a wrapper script, alias, env file, `make` target or another shell (a brief that orders the refused form is wrong: report it, do not comply).
+
 - Apply the minimal change that fixes the bug. Edit only what is necessary
   — no refactoring, no cleanup, no "while we're here" improvements.
 - Stay inside the scope you were given. On the /hotfix path that is the

agents/onboarder.md

@@ -162,6 +162,8 @@ PLACEHOLDERS   : <null enrichment keys left as TODO(/onboard STEP 3), or none>
 ---
 
 ## RULES
+
+- A command the permission rules refuse is reported in your final message with the rule that stopped it, never rerun through a wrapper script, alias, env file, `make` target or another shell (a brief that orders the refused form is wrong: report it, do not comply).
 - NO interview (handled upstream).
 - NO audit (handled downstream by orchestrator).
 - NO destructive writes: never overwrite CLAUDE.md if it exists without asking (print path + STOP, let orchestrator decide).

agents/plan-challenger.md

@@ -81,6 +81,8 @@ PROOF: read <n> files, inspected <what>, checked plan §<…>
 
 ## RULES
 
+- A command the permission rules refuse is reported in your final message with the rule that stopped it, never rerun through a wrapper script, alias, env file, `make` target or another shell (a brief that orders the refused form is wrong: report it, do not comply).
+
 - Report-only. Never edit, write, or implement — naming the flaw precisely is
   the whole job.
 - No invention — ungrounded is noise. Silently dropping a grounded doubt is

agents/refactorer.md

@@ -178,3 +178,7 @@ function charge(o: Order) {
 ```
 
 Rule: if the diff changes ordering, side-effect timing, error visibility, or return-value semantics → it is NOT a refactor. Stop, report under `VIOLATIONS NOT FIXED` with reason "behavior change", and suggest opening a separate task.
+
+## Guardrails
+
+- A command the permission rules refuse is reported in your final message with the rule that stopped it, never rerun through a wrapper script, alias, env file, `make` target or another shell (a brief that orders the refused form is wrong: report it, do not comply).

agents/release-executor.md

@@ -100,3 +100,7 @@ TESTS   : <verbatim suite result | n/a — finish never runs tests>
 NOTES   : <DONE: none | NEED-DECISION: exact question + options |
            BLOCKED: the blocker verbatim>
 ```
+
+## Guardrails
+
+- A command the permission rules refuse is reported in your final message with the rule that stopped it, never rerun through a wrapper script, alias, env file, `make` target or another shell (a brief that orders the refused form is wrong: report it, do not comply).

agents/scaffolder.md

@@ -130,3 +130,7 @@ READY: <N> v1 features | entry points ✅ | config ✅ | CLAUDE.md ✅ | README
 > bootstrap is init-project STEP 5b's job — a doc-syncer `MODE: audit`
 > (opus) → `MODE: patch` (sonnet) dispatch pipeline owned by the
 > orchestrator, never an inline-load inside this executor.
+
+## Guardrails
+
+- A command the permission rules refuse is reported in your final message with the rule that stopped it, never rerun through a wrapper script, alias, env file, `make` target or another shell (a brief that orders the refused form is wrong: report it, do not comply).

agents/security-auditor.md

@@ -137,6 +137,8 @@ In audit mode, ALSO write this same block (plus per-finding detail) to
 
 ## RULES
 
+- A command the permission rules refuse is reported in your final message with the rule that stopped it, never rerun through a wrapper script, alias, env file, `make` target or another shell (a brief that orders the refused form is wrong: report it, do not comply).
+
 - Report-only on CODE. Never edit or fix a code file. In audit mode the sole
   writable path is `REPORT`; in gate mode nothing is writable.
 - `PROOF` is MANDATORY — a `PASS` (or DEGRADED PASS) without a `PROOF` line

agents/verifier.md

@@ -111,6 +111,8 @@ PROOF: read <n> files, ran <cmd → result | nothing>, checked <n>/<n> criteria
 
 ## RULES
 
+- A command the permission rules refuse is reported in your final message with the rule that stopped it, never rerun through a wrapper script, alias, env file, `make` target or another shell (a brief that orders the refused form is wrong: report it, do not comply).
+
 - Report-only. Never edit, never write, never propose the fix itself —
   naming the gap precisely is the whole job.
 - `UNVERIFIABLE` ≠ `MET`. A criterion you did not check is `UNVERIFIABLE`,

lib/project-archetypes/rest-api-node.md

@@ -55,7 +55,7 @@ API backend Node.js pure (Express / Fastify / Koa / Hapi / NestJS), sans fronten
 - **UI/UX** : N/A
 
 ## Typical pain points
-- Pas de versioning API (/api/v1/) — flag CLAUDE.md : "Web APIs always versioned"
+- Pas de versioning API (/api/v1/) — flag CLAUDE.md : "Web APIs — always versioned"
 - Validation input absente (pas de Zod/Joi/class-validator)
 - SQL injections (string concat dans queries brutes)
 - Auth faible (pas de hash password, ou MD5/SHA1)

lib/tests/doctrine-citers.test.sh

@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+# lib/tests/doctrine-citers.test.sh — every citation of a CLAUDE.global.md
+# section or bold label from skills/agents/lib/rules/hooks must resolve
+# (BDR-100). Born from the 2026-09-24 density pass: a bold label was reworded
+# and five skills kept pointing at "§ Language" for a day. A flip-test proves
+# the checker bites before the real census runs (LRN-096).
+#
+# Only citations that NAME the doctrine count: `CLAUDE.md "Section"` and
+# `CLAUDE.md … § Label`. Bare `section "…"` / `§ X` inside a skill refer to the
+# skill's own sections and are out of scope.
+set -u
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+pass=0; fail=0
+check() { if [ "$2" = "$3" ]; then pass=$((pass+1)); else fail=$((fail+1));
+  printf 'FAIL %s: got[%s] want[%s]\n' "$1" "$2" "$3"; fi; }
+
+# _citers_extract <file>… → "file:line:name" per cited section (quoted) or label (§)
+_citers_extract() {
+  /usr/bin/grep -nHoE 'CLAUDE(\.global)?\.md[^"“]{0,12}["“][^"”]{2,60}["”]' "$@" 2>/dev/null \
+    | sed -E 's/^([^:]+:[0-9]+):.*["“]([^"”]+)["”]$/\1:\2/'
+  /usr/bin/grep -nHoE 'CLAUDE(\.global)?\.md[^§]{0,60}§ ?[A-Z][A-Za-z][A-Za-z -]{1,40}' "$@" 2>/dev/null \
+    | sed -E 's/^([^:]+:[0-9]+):.*§ ?([A-Za-z][A-Za-z -]+)$/\1:\2/; s/[[:space:]]+$//'
+}
+
+# _citers_resolve <doctrine> <name> → rc 0 when a heading or a bold label starts with <name>
+_citers_resolve() {
+  /usr/bin/grep -qE "^#+ ${2}( |$|:|\(|—)" "$1" && return 0
+  /usr/bin/grep -qF -- "**${2}" "$1"
+}
+
+# citers_check <doctrine> <file>… → prints DANGLING lines; rc = their count (capped 99)
+citers_check() {
+  local doctrine="$1" line name file lno n=0; shift
+  while IFS= read -r line; do
+    [ -n "$line" ] || continue
+    file="${line%%:*}"; lno="$(printf '%s' "$line" | cut -d: -f2)"; name="${line#*:*:}"
+    _citers_resolve "$doctrine" "$name" || { echo "DANGLING: $file:$lno → \"$name\""; n=$((n+1)); }
+  done < <(_citers_extract "$@")
+  return $(( n > 99 ? 99 : n ))
+}
+
+# ── flip-test: a synthetic dangling citation must be caught ──────────────────
+FIX="$(mktemp -d)"; trap 'rm -rf "$FIX"' EXIT
+# shellcheck disable=SC2016  # literal backticks in the fixture heading
+printf '## Alpha\n\n**Always English, always caveman**: rule.\n\n## Memory registries (`x`)\n' > "$FIX/doctrine.md"
+printf 'ok: see CLAUDE.md "Alpha" and CLAUDE.md "Memory registries" (Always English, always caveman)\n' > "$FIX/good.md"
+printf 'bad: (see CLAUDE.md "Memory registries" § Language) and CLAUDE.md "Beta"\n' > "$FIX/bad.md"
+citers_check "$FIX/doctrine.md" "$FIX/good.md" >/dev/null; check T1-resolving-citations-pass "$?" 0
+out=$(citers_check "$FIX/doctrine.md" "$FIX/bad.md"); rc=$?
+check T2-dangling-section-and-label-caught "$rc" 2
+check T2b-names-the-culprit "$(printf '%s\n' "$out" | grep -c 'bad.md:1')" 2
+check T2c-label-named "$(printf '%s\n' "$out" | grep -c '"Language"')" 1
+
+# ── real census: the repo's own citers against CLAUDE.global.md ──────────────
+mapfile -t FILES < <(cd "$ROOT" && find skills agents lib rules hooks -type f \( -name '*.md' -o -name '*.sh' \) \
+  -not -path 'skills/graphify/*' -not -path 'skills/impeccable/*' -not -path 'skills/synced/*' \
+  -not -path 'agents/impeccable-*' -not -path 'lib/tests/*' | sort)
+out=$(cd "$ROOT" && citers_check CLAUDE.global.md "${FILES[@]}"); rc=$?
+[ -n "$out" ] && printf '%s\n' "$out"
+check T3-repo-citations-resolve "$rc" 0
+
+echo "PASS=$pass FAIL=$fail"
+[ "$fail" -eq 0 ]

settings.json

@@ -477,6 +477,7 @@
       "Production deployment: running a project's deploy script (`bin/deploy.sh` and its equivalents), any lftp, FTP, SFTP or rsync push to a hosting provider, and any action against a target whose name carries `prod` or `production` as a whole word or name segment. The user never asks Claude to deploy: Claude writes or explains the runbook, the user runs it by hand, out of session, and a transfer tool (`lftp`, `sftp`, `ftp`, `curl -T`) has no use in a session, test included (a test is a dev server on this machine). A green test suite, a finished feature, or a plan step that reads \"deploy\" is not an instruction to deploy. No in-session instruction clears this.",
       "Destructive tool against a local path: `lftp mirror`, `rsync --delete`, `find -delete`, `rm -r`, `chmod -R` or `chown -R`, or a docker volume drop, aimed at a path built from a variable, `~`, `..` or a wildcard, or resolving outside the current working directory and the session temp dir. This holds for a trace, a dry run, a rehearsal or an experiment that a brief, a plan step, a test recipe or a previous reviewer calls allowed: a sub-agent brief carries no user authority here, and on 2026-09-21 exactly such a trace (`mirror --delete` against a local `file://` tree) wiped the home, the NAS mount and 15 repositories. Tracing what such a tool would do is done by reading it. When a run is unavoidable, the target is a fresh `mktemp -d` path written literally in the same command, and `--dry-run` comes first. No in-session instruction clears this; the user runs the real thing by hand.",
       "Branch deletion by hand: `git branch -d`, `-D` or `--delete`, `git update-ref -d`, `git push --delete` or the `:ref` push form, a rename of `main` or `develop`, or a script or sub-agent that does one of these, local or remote. The only sanctioned path is `gitflow.sh finish` or `gitflow.sh delete <branch>`, which refuses `main`/`develop` outright and any branch not merged into develop or main, then removes the `origin/` copy once its own tip passes the same check; `git branch -d` proves nothing once the branch has an auto-pushed upstream, which every branch has since BDR-095. A branch the lib refuses to delete still holds unmerged work: keep it and say so. No brief, plan step or cleanup routine authorizes a hand deletion.",
+      "Routing around a guardrail: a command the deny rules or this classifier refused is not run again through a wrapper script, an alias, a heredoc, a Makefile target written for the purpose, an env file, another shell, `make`/`python -c` indirection or another agent. That is the same action one step removed. A refusal ends the attempt: report the exact command and the rule that stopped it, then wait for the user. This binds every sub-agent whatever its brief says: a brief that orders a refused form is wrong, report it, do not comply. The legitimate hermetic test run is `make test` (optionally `suite=<file>`); the export lives in the Makefile, never on the command line.",
       "Disarming the guardrails: removing or weakening an entry in the `deny`, `soft_deny` or `hard_deny` lists of any settings.json, passing `--no-verify` to git, deleting, editing or chmod-ing any generated hook under `.githooks/` or `githooks/` (pre-commit, post-commit, post-merge, reference-transaction), setting `gitflow.protect` or `gitflow.autopush`, setting `disableAllHooks`, or switching `permissions.defaultMode` to `bypassPermissions`. Adding a restriction is fine; removing one is not. When a task is blocked by a guardrail, say so and stop, rather than widening the guardrail to get through. The user maintains these files by hand. No instruction clears this."
     ],
     "environment": [