bmottin/claude_mac
1
0
Fork 0
forked from bchanot/claude
Code Pull Requests Activity

feat(guardrails): refusal ends the attempt; doctrine-citers census; make test suite=

Browse Source 
Root causes of the 2026-09-24 errors turned into mechanisms (BDR-100). hard_deny 'Routing around a guardrail': a refused command is never rerun through a wrapper, alias, heredoc, Makefile target, env file, other shell or other agent; the same clause in 14 agents and in the doctrine's sub-agent rule. make test suite=<file> runs one suite hermetically so the denied env-prefix form is never needed by hand. lib/tests/doctrine-citers.test.sh: every CLAUDE.md "Section" / § Label citation across skills, agents, lib, rules and hooks must resolve to a heading or bold label (flip-tested); its first run fixed rest-api-node.md. Doctrine 'After code changes' step 4: a changed rule, heading, label or threshold → grep every citer in the same commit.
This commit is contained in:
bastien
2026-09-24 20:58:25 +02:00
parent 8f10047ac4
commit 27f201d4aa
20 changed files with 129 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Makefile
+5 -3
View File
@@ -28,11 +28,13 @@ seo-connect: ## Connect a Google account for /seo FULL (creates venv, OAuth cons
@bash -c 'read -r -p "Label for this account (e.g. client-a): " label; \
bash lib/seo-data/connect.sh --label "$$label"'
test: ## Run deterministic tests (lib/tests/*.test.sh + lib/gitflow-test.sh + lib/tests/run-*.sh)
SUITES = lib/tests/*.test.sh lib/seo-data/*.test.sh lib/gitflow-test.sh lib/tests/run-*.sh
test: ## Run deterministic tests hermetically (one: make test suite=lib/tests/x.test.sh)
@# Hermetic git: the machine's global core.hooksPath (BDR-095) must not
@# fire inside the throwaway repos the suites build.
@# fire inside the throwaway repos the suites build. The export lives
@# HERE so nobody has to type the (denied) env-prefix form by hand.
@export GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_SYSTEM=/dev/null; \
fail=0; for t in lib/tests/*.test.sh lib/seo-data/*.test.sh lib/gitflow-test.sh lib/tests/run-*.sh; do \
fail=0; for t in $(or $(suite),$(SUITES)); do \
echo "== $$t"; \
case "$$(basename "$$t")" in \
run-release-candidate.sh) RC_WORK=$$(mktemp -d) RC_TAG=1 bash "$$t" || fail=1 ;; \