gleanin

Rules from past failures. Apply every session.

<!-- Rules are auto-generated by sync.sh. Do not edit manually. -->

Credentialed Write Gate

Rule:

1. Before writing with ambient credentials, verify scope (<tool> whoami, config view).
2. Exact-match created resource name against intent.
3. On mismatch, roll back immediately.
4. Never mark done when acceptance probe failed.

Check: grep -c "inoffensif\|harmless\|can delete\|not needed" in session transcript — zero for any failed write.

Delegation Preflight

Rule:

1. Scan delegation payload against delegate's Known Limitations first.
2. Verify with git diff, not the delegate's [OK] lines.
3. On partial landing, name the limitation before hand-editing.
4. Structural integrity check every delegate-touched file.

Check: git diff --stat HEAD after delegation — changed file count must match expected.

Device First Check

Rule:

1. Search filesystem (find, grep, ls) before asking the user.
2. curl -sI before declaring anything "not deployed."
3. Syntax check + tail check before committing.

Check: grep -c "AskUserQuestion\|curl.*not.find\|edit.*then.*ask" in session transcript — near zero with this rule.

Reference First Porting

Rule:

1. Read the reference before editing any formula or algorithm.
2. Cite file:line per edit.
3. Apply supplied values verbatim before re-derivation.

Check: grep -rn "TODO\|FIXME\|guess\|maybe" <target-file> — zero after a port.

<!-- end gleanin rules -->