100%

Goal

Hand-edits to the regenerated views (impl-hygiene.md generated region + impl-hygiene-authoring.md) are mechanically rejected; rule additions/changes must go to impl-hygiene-rules.json.

Implementation Sketch

Add a pre-commit guard that rejects a staged hand-edit to the generated region of impl-hygiene.md / impl-hygiene-authoring.md (the change must originate from a impl-hygiene-rules.json edit + regeneration). Document the ‘edit the JSON SSOT, never the regenerated .md’ discipline where rule-authors will see it.

Spec References

scripts/impl_hygiene_rules_runtime/staleness_lint.py (sibling guard surface); .claude/rules/impl-hygiene.md (the consuming rule); pre-commit gate.

Work Items

  • Pre-commit guard: reject a staged hand-edit to the generated region of impl-hygiene.md / impl-hygiene-authoring.md (must come from a JSON edit + regenerate).
  • Document the ‘rule additions/changes go to impl-hygiene-rules.json, not the regenerated .md’ discipline at the rule-author-facing surface.
  • pytest: the guard fires on a hand-edit to the generated region + passes on a JSON-sourced regeneration.

Items

  • Pre-commit/PreToolUse guard: reject a staged or in-tool hand-edit to the generated region of impl-hygiene.md / impl-hygiene-authoring.md (must come from a impl-hygiene-rules.json edit + regenerate). The guard’s banner detection MUST CONSUME the single banner SSOT scripts/impl_hygiene_rules_runtime/api.py:content_is_generated (the §04 shared predicate) — NEVER hardcode the ‘READ-ONLY GENERATED’ literal independently (a re-derivation is LEAK:algorithmic-duplication across the §04/§05 twins). Replace the inline "READ-ONLY GENERATED" in content check in .claude/hooks/block-generated-view-edits.sh with a call into the impl_hygiene_rules_runtime api (content_is_generated), so one banner change in generated_view.py propagates to both /condensate (§04) and the guard (§05).
  • Extend the guard test to pin the SSOT-consumption + redirect-message contract: (a) the deny test asserts the permissionDecisionReason NAMES impl-hygiene-rules.json (the JSON SSOT redirect target), and (b) a test that fails if the hook re-derives the banner instead of consuming scripts/impl_hygiene_rules_runtime/api.py:content_is_generated (e.g. assert the hook sources the marker from the shared predicate / api surface). This closes the §04/§05 one-banner-SSOT coordination loop with a regression pin, mirroring the §04 single-source guarantee.

Fresh intel (regenerated)

{ “schema_version”: 1, “target”: { “kind”: “plan-section”, “ref”: “impl-hygiene-review-run-lifecycle/s-4d8b586e” }, “generated_at”: “2026-06-21T17:56:54.657479+00:00”, “graph_state”: { “head_sha”: “45796766”, “last_code_import_at”: “2026-06-21T17:51:55.453Z”, “embedding_stale”: false, “insights_stale”: false, “cpg_stale”: false }, “surfaces”: {}, “summary”: “intel-package[plan-section:impl-hygiene-review-run-lifecycle/s-4d8b586e] agent-authored dossier”, “degraded”: false, “dossier”: { “objective_symbols”: [], “tiers”: {}, “agent_authored”: true, “difficulty”: { “class”: “routine”, “research_online”: false, “research_mode”: “auto”, “signals”: [], “plan_dir”: “/home/eric/projects/ori_lang/plans/impl-hygiene-review-run-lifecycle” } } }

(full dossier: rule-edit-guard—s-4d8b586e.intel.json)