[prathikcannotcode]

Carries Vigil's 11 November guardrail review (prathikcannotcode/Vigil#10) over to Aranya, and answers the calls the Morvali Creek run had to make on its own (examples/morvali-creek.run-1/SCORE.md, "Where a skill was confusing").

What was wrong

Each of these was reproduced against main at 3240241 before the fix.

• The write-guard exited 0, which allows, for not json, {} and a Write with no path. NotebookEdit wasn't in the matcher at all, so it could write to catalog/provisions.json.
• validate-on-write exited 0 on an event it couldn't read.
• A finding citing Water Act "s.999" with catalog_id: water-1974 validated clean. This is bug 3 in the Morvali score.
• AGENTS.md had no fallbacks. The Morvali run logged 15 calls it had to make without guidance.

What changes

• Fails closed. Malformed events, a file tool with no path, and NotebookEdit outside the layout all exit 2. TodoWrite still passes, because it writes no file.
• Instrument ids vouch for the whole Act only. A finding on an instruments entry fails if its provision names a numbered section, para, rule, schedule or appendix. "The Act as a whole", "Hazardous Waste Rules 2016" and "the Act's 2010 amendment" still pass. All 18 Morvali findings still validate.
• AGENTS.md gains Vigil's five fallbacks and two new sections that settle the run's open calls:
  • an uncatalogued section gets a flag
  • alternative calculator inputs go in matters/{id}/inputs/
  • a filing date never forces expert validation
  • risks are named without a view on the outcome
  • AGENTS.md wins over conflicting instructions
• Schemas.
  • matter.json gains other_forums, model and aranya_version.
  • Flags accept target.kind: "case".
  • matters/*/inputs/*.json is checked against injury-params.schema.json.
• Docs. SECURITY.md, the changelog (it also covers Close four write-guard bypasses #8), three skill lines, and the README test count.

Read by eye

Aranya's write-guard blocked agent edits to .claude/scripts, .claude/schemas and .claude/settings.json, as it should. Those edits were applied through the shell under maintainer direction, so no hook checked them.

Known limits

• A part named without a number, such as "General Condition", still passes on an instrument id.
• A finding on a section's own entry that also names a different section is not checked.

SECURITY.md states both.

Checks

• npm run validate -- --strict: 43 data files, 5 skills, 0 errors
• npm test: 30 tests, 28 pass, 2 skipped on Windows (symlink and bash hook), 0 fail
• The Morvali run's 18 findings, 2 alternative input files, matter.json and flags.jsonl validate under the new rules
• New tests shown to fail on the old code (the same inputs were confirmed by hand to pass before the fix)
• Linux CI

🤖 Generated with Claude Code