diff --git a/.claude/settings.json b/.claude/settings.json index 57ab54680..a669d329c 100644 --- a/.claude/settings.json +++ b/.claude/settings.json @@ -1,4 +1,5 @@ { + "plansDirectory": "docs/plans", "permissions": { "defaultMode": "plan", "allow": [ diff --git a/his-hand-levers.json b/his-hand-levers.json index da7f51947..a32d6e96a 100644 --- a/his-hand-levers.json +++ b/his-hand-levers.json @@ -925,6 +925,26 @@ "Build, deploy, migrate, restore-test, and close only on the plan's executable predicates" ], "issue": 1779 + }, + { + "id": "L-CLAUDE-SETTINGS-ESTATE-INSTALL", + "label": "Install the validated Claude settings-estate repair: swap the staged settings.json.tmpl candidate into domus-genoma, commit, chezmoi-apply, verify. The 2026-08-06 review proved all 19 inline PreToolUse guards dead (wrong hook interface); the repair layer (stdin-JSON dispatcher + 26-fixture liveness predicate + tracker fix) is already on disk and fixture-green, but the agent-session classifier hard-gates the settings/hook-arming mutation class, so the final swap+apply is a one-paste human action.", + "owner": "yours", + "cost": "~2 min, one paste, fully reversible (git revert + archive dir)", + "status": "pending", + "gate": "auto-mode classifier self-modification boundary: agent sessions cannot mutate user-level settings or arm hooks", + "unlocks": "live guard layer (force-push/branch-D/push-main/registry/IRF advisories restored; brew-zap-claude-code and LaunchAgents writes become real denies), fleetview Stop-digest un-silenced (root cause: empty stdin to async hook since ~Jul 24), PostCompact reorientation, PermissionDenied + protected-registry FileChanged audit logs, ConfigChange formatter-hazard warning, CLAUDE_CODE_MAX_TOOL_USE_CONCURRENCY=5 (16GB jetsam cap harness-enforced), cleanupPeriodDays=14, useAutoModeDuringPlan=true", + "source_task": "2026-08-06 settings-estate review + implementation (limen bg session 611a4757); domus-genoma commit 7df265ac (pre-repair snapshot); hook scripts + liturgy edits on disk uncommitted pending this lever", + "steps": [ + "cd /Users/4jp/Workspace/domus-genoma", + "cp /tmp/settings.json.tmpl.candidate-611a4757 private_dot_claude/settings.json.tmpl", + "mkdir -p ~/.claude/archive-20260806-settings-estate && mv ~/.claude/settings.proposed.json ~/.claude/settings.json.bak ~/.claude/settings.json.bak-20260625-160116 ~/.claude/settings.json.bak-20260625-164006 ~/.claude/hooks/allow-trusted-cd-git.sh.bak ~/.claude/hooks/allow-trusted-cd-git.sh.bak-20260701 ~/.claude/hooks/allow-trusted-cd-git.sh.bak-20260709-resume ~/.claude/archive-20260806-settings-estate/ 2>/dev/null; mv private_dot_claude/settings.json.tmpl.bak ~/.claude/archive-20260806-settings-estate/source-settings.json.tmpl.bak", + "git add private_dot_claude/settings.json.tmpl private_dot_claude/hooks/executable_pretooluse-guard-dispatch.sh private_dot_claude/hooks/executable_guard-liveness-check.sh private_dot_claude/hooks/executable_comment-cadence-tracker.sh private_dot_claude/CLAUDE.md.tmpl && git commit -m 'feat(claude): stdin-JSON guard dispatcher, settings adoptions, estate hygiene (2026-08-06 review)'", + "chezmoi add ~/.claude/hooks/allow-trusted-cd-git.sh", + "chezmoi diff; chezmoi apply && ~/.claude/hooks/guard-liveness-check.sh && git push origin master" + ], + "note": "Candidate template: /tmp/settings.json.tmpl.candidate-611a4757 (render-validated: chezmoi execute-template + jq green; 504->416 lines). If /tmp was cleared, regenerate deterministically: python3 /tmp/tmpl-candidate-611a4757.py against the committed tmpl, or re-derive from memory project-inline-settings-guards-dead.md (records the full fix pattern). After apply, guard-liveness-check.sh must print ALL PASS and the next session's gh-pr-comment probe should inject preflight context. Residual nuance: liturgy line 51 still says the hook blocks all *.plist; the dispatcher denies only LaunchAgents/LaunchDaemons paths and advises on other .plist (that line edit was itself classifier-gated).", + "issue": 1897 } ] }