overview / incident rules
A rule marked authoredBy: incident was written because something really happened. A dead one means that thing can happen again.
| rule | the incident |
|---|---|
no-exit-code-after-pipe | echo exit=$? |
no-gnu-timeout-on-macos | macOS has no timeout binary; the command dies before the real work runs — use gtimeout or drop it. |
no-reverse-patch-onto-head | Reverse-applying an old commit onto HEAD silently no-ops when the file has drifted, making a regression test look passing; use a worktree at the parent commit instead. |
no-inplace-perl-rewrite-of-source | In-place perl/sed rewrites of tracked .rs files silently mutate logic outside the editor's tracking and produce phantom test failures. |
no-cp-over-rust-sources | Copying a scratch .rs over a tracked source file bypasses Edit/Write and the cargo fmt step, which is what broke the fmt gate here. |
no-blind-inplace-source-rewrite | In-place scripted rewrites of engine source and its test expectations edit both sides blind and let the two drift into contradicting each other. |
no-silenced-ctest-stderr | Discarding stderr from the test runner turns a diagnosable failure into a bare test name and forces a second full run. |
no-shell-rewrite-of-guard-or-promise | guard-weaken and promise-tamper are sealed in the binary but they judge Edit/Write TOOL calls only (gate.cpp:1860 gates on isEditTool) — a shell redirect, an in-place editor or an rm reaches the same two files without ever passing that law. |
no-shell-write-to-frozen-file | CLAUDE.md freezes the landing (index.html is damla-approved) and HANDOFF §9 makes (withheld) an anti-path. |
no-delete-native-binaries | .claude/settings.json points every hook at native/rabadon-gate, so deleting the built binaries disarms this repo's own supervision while the session keeps running. |
no-publish-without-dry-run | package.json is a publishable package (rabadon@0.2.0 plus four optional platform packages) and CLAUDE.md leaves Faz 5 — npm org, NPM_TOKEN, release — to Damla. |
no-release-tag-push | .github/workflows/release.yml fires on a version tag, so pushing a tag IS the publish; CLAUDE.md leaves tag v0.2.0 push to Damla. |
release-workflow-needs-test-gate | Any edit to the publish pipeline must be re-checked for a test job and a post-publish smoke install before it can ship an unverified artifact. |
anti-path-frozen-abs | the twin of anti-path-frozen that can actually fire: gate.cpp:1811 matches protectedPaths against the RAW file_path and Claude Code always sends an absolute path, so the ^-anchored form above matches nothing. |
release-workflow-abs | the same defect as anti-path-frozen-abs: the ^-anchored release rule never sees an absolute file_path. |
A rule marked authoredBy: incident was written because something really happened. A dead one means that thing can happen again.
The census measured 20 incident rules, 18 of which can fire; 16 records are published here. The rest sit in repositories whose names are withheld, and the census says how many records it withheld rather than shrinking quietly.
Re-run of the census at the repaired gate. Every rule was judged by the real gate binary, standing in its own project, with the SAME probe the first census used — the probe is stored beside the rule so the measurement can be repeated. Each probe was driven through TWO binaries back to back in the same pass: the commit the published census was measured at (b384d6a) and HEAD, so the difference is the code and not the clock. A rule that did not answer in its own name got a second pass, alone in a scratch guard, to separate a dead rule from one a neighbour catches first. Nothing was executed: every probe is a PreToolUse event on stdin, asserted with a canary file the gate was asked to delete and did not. The generator is site/rule_census.py.
From rule_census.json, generated 2026-08-03T17:25:24Z at gate commit 74404c19431f.