[BUG] Project rules are treated as advisory: enforcement hooks self-neutralize, compaction drops governance while preserving narrative, and auto-memory outranks project instructions
Related open issues — same class, adding a long-horizon reproduction and three failure modes I don't see reported yet:
#47565 (rules ignored despite CLAUDE.md and enforcement hooks), #40459 (v2.1.84+ subagents lose project context), #19471 (instructions ignored after compaction), #21119 (pattern-matches training data over context), #7777 (instructions treated as advisory), #15443, #34197, #43557.
Environment
|
|
| Extension |
anthropic.claude-code 2.1.220 (VS Code, Linux x64), installed 2026-07-25 |
| Model |
claude-opus-5[1m] |
| Project |
~6-month solo kernel project, 2,401 commits / 51 days, documented methodology, 30+ standing rules, 8 custom PreToolUse hooks, custom Workflows |
| Session |
single day, long-running, multiple auto-compactions |
All evidence below is reproducible from that repo's git history and Claude Code's own session snapshots.
1. [HIGH] An enforcement hook whose exemption matches the agent's own command style — so it can never fire
This is the sharpest instance of #47565 and I don't see it described elsewhere.
A PreToolUse hook (enforce-cwd.py) exists to catch a recurring working-directory mistake. Its logic:
# A command that manages its own cwd is trusted.
if re.search(r"(?<![/\w.\-])cd\s", cmd):
return 0Every command Claude Code issues in this project begins with cd /workspace/project || exit 1. So the guard was switched off for 100% of tool calls — not by evasion, but because the agent's habitual prefix satisfies the exemption exactly.
It then stayed silent on precisely the failure it was written for: a git log ... -- project/kernel/ run from inside project/ silently reported 0 kernel commits for a merge that contained 987 lines of kernel code. The agent reported that false zero to the user as fact.
Ask: guidance (or linting) for hook authors that a broad textual exemption can be trivially satisfied by the agent's own command conventions. A guard that cannot fire on its author is worse than none — it produces false assurance.
2. [HIGH] Compaction preserves narrative and drops governance
Sharpens #19471 with a concrete before/after.
After compaction, the agent retained fine-grained state — build pin hashes, errno progressions, commit lineage — and zero of the project's binding rules. It then proceeded for hours unaware that the project's own methodology (docs/METHODOLOGY.md §9.4) makes a multi-lens adversarial review mandatory before any substantive commit, and that §9.6 says "prefer Workflows for substantive tasks; token cost is not a constraint."
Measured consequence: that mandatory review last ran 2026-06-08. 2,340 commits landed after it without it, across many sessions, with nothing on any surface reporting the omission.
Ask: compaction should preferentially retain MUST/NEVER constraints over narrative detail — a "rules still in force" block carried verbatim rather than summarized.
3. [HIGH] Auto-memory silently outranks project instructions
I don't see this reported. There is no precedence model between model-authored auto-memory and project-authored rules.
After a user complaint about token cost, the agent wrote itself a memory advising against expensive tool use. The project's own methodology says the opposite in explicit terms (§9.6 above). The memory won for an entire session, because memory is injected into context while the project document merely sits on disk. The agent never read the rule it was violating.
Ask: declared precedence (project instructions > auto-memory), and conflict-flagging when a memory contradicts loaded project instructions.
4. [MEDIUM] Subagents operate without project rules — consistent with #40459
A custom Workflow spawning Explore subagents had to rediscover the project's governing rules from scratch and report them back, rather than already operating under them. On 2.1.220, well past the 2.1.84 boundary in #40459.
5. [MEDIUM] SessionStart hooks can advise but not assert
The project's SessionStart hook reliably told the agent to re-ground. It could not verify that it did, nor that the result was valid. The re-grounding workflow had been reading archived planning documents since 2026-07-01 — while reporting success every run, 69 recorded runs.
Ask: allow a SessionStart hook to gate substantive tool use on a satisfied precondition, the way PreToolUse can block.
6. [MEDIUM] Write overwrites unversioned user config with no warning or backup
The agent overwrote a user's working startup procedure under ~/.claude/ in one call. No warning that the target was outside the project, none that it was unversioned, no backup. Recovery was possible only because Claude Code happens to snapshot each workflow run into the session directory. That is luck, not a safety property.
Ask: warn or confirm on overwriting files outside the project working directory, especially under ~/.claude/; keep a backup on overwrite.
7. [LOW] No bug/feedback path in the VS Code extension
The extension registers 22 commands; none is a bug or feedback command. /bug exists in the CLI but not here, so the in-editor user has no reporting path — only a bugs URL buried in the manifest. Version is also not surfaced in-session; this machine had extension 2.1.220, CLI 2.1.89, and a Cursor copy at 2.1.63 simultaneously.
The common thread
Every item is the same failure: a control the user deliberately established was not durable, and its failure mode was silence. Rules, hooks, procedures and gates all continued reporting success while not being in force. For long-lived projects, the ability to make a constraint stick — and to be told when one has stopped applying — matters more than any single capability.
What held, for contrast: everything wired into a per-commit gate. The build pin, the byte-identical boot goldens, the artifact-provenance check. Not one drifted. Everything that lived only in a document rotted, and nothing announced it.
[BUG] Project rules are treated as advisory: enforcement hooks self-neutralize, compaction drops governance while preserving narrative, and auto-memory outranks project instructions
Related open issues — same class, adding a long-horizon reproduction and three failure modes I don't see reported yet:
#47565 (rules ignored despite CLAUDE.md and enforcement hooks), #40459 (v2.1.84+ subagents lose project context), #19471 (instructions ignored after compaction), #21119 (pattern-matches training data over context), #7777 (instructions treated as advisory), #15443, #34197, #43557.
Environment
anthropic.claude-code2.1.220 (VS Code, Linux x64), installed 2026-07-25claude-opus-5[1m]All evidence below is reproducible from that repo's git history and Claude Code's own session snapshots.
1. [HIGH] An enforcement hook whose exemption matches the agent's own command style — so it can never fire
This is the sharpest instance of #47565 and I don't see it described elsewhere.
A PreToolUse hook (
enforce-cwd.py) exists to catch a recurring working-directory mistake. Its logic:Every command Claude Code issues in this project begins with
cd /workspace/project || exit 1. So the guard was switched off for 100% of tool calls — not by evasion, but because the agent's habitual prefix satisfies the exemption exactly.It then stayed silent on precisely the failure it was written for: a
git log ... -- project/kernel/run from insideproject/silently reported 0 kernel commits for a merge that contained 987 lines of kernel code. The agent reported that false zero to the user as fact.Ask: guidance (or linting) for hook authors that a broad textual exemption can be trivially satisfied by the agent's own command conventions. A guard that cannot fire on its author is worse than none — it produces false assurance.
2. [HIGH] Compaction preserves narrative and drops governance
Sharpens #19471 with a concrete before/after.
After compaction, the agent retained fine-grained state — build pin hashes, errno progressions, commit lineage — and zero of the project's binding rules. It then proceeded for hours unaware that the project's own methodology (
docs/METHODOLOGY.md§9.4) makes a multi-lens adversarial review mandatory before any substantive commit, and that §9.6 says "prefer Workflows for substantive tasks; token cost is not a constraint."Measured consequence: that mandatory review last ran 2026-06-08. 2,340 commits landed after it without it, across many sessions, with nothing on any surface reporting the omission.
Ask: compaction should preferentially retain MUST/NEVER constraints over narrative detail — a "rules still in force" block carried verbatim rather than summarized.
3. [HIGH] Auto-memory silently outranks project instructions
I don't see this reported. There is no precedence model between model-authored auto-memory and project-authored rules.
After a user complaint about token cost, the agent wrote itself a memory advising against expensive tool use. The project's own methodology says the opposite in explicit terms (§9.6 above). The memory won for an entire session, because memory is injected into context while the project document merely sits on disk. The agent never read the rule it was violating.
Ask: declared precedence (project instructions > auto-memory), and conflict-flagging when a memory contradicts loaded project instructions.
4. [MEDIUM] Subagents operate without project rules — consistent with #40459
A custom Workflow spawning
Exploresubagents had to rediscover the project's governing rules from scratch and report them back, rather than already operating under them. On 2.1.220, well past the 2.1.84 boundary in #40459.5. [MEDIUM] SessionStart hooks can advise but not assert
The project's SessionStart hook reliably told the agent to re-ground. It could not verify that it did, nor that the result was valid. The re-grounding workflow had been reading archived planning documents since 2026-07-01 — while reporting success every run, 69 recorded runs.
Ask: allow a SessionStart hook to gate substantive tool use on a satisfied precondition, the way PreToolUse can block.
6. [MEDIUM]
Writeoverwrites unversioned user config with no warning or backupThe agent overwrote a user's working startup procedure under
~/.claude/in one call. No warning that the target was outside the project, none that it was unversioned, no backup. Recovery was possible only because Claude Code happens to snapshot each workflow run into the session directory. That is luck, not a safety property.Ask: warn or confirm on overwriting files outside the project working directory, especially under
~/.claude/; keep a backup on overwrite.7. [LOW] No bug/feedback path in the VS Code extension
The extension registers 22 commands; none is a bug or feedback command.
/bugexists in the CLI but not here, so the in-editor user has no reporting path — only abugsURL buried in the manifest. Version is also not surfaced in-session; this machine had extension 2.1.220, CLI 2.1.89, and a Cursor copy at 2.1.63 simultaneously.The common thread
Every item is the same failure: a control the user deliberately established was not durable, and its failure mode was silence. Rules, hooks, procedures and gates all continued reporting success while not being in force. For long-lived projects, the ability to make a constraint stick — and to be told when one has stopped applying — matters more than any single capability.
What held, for contrast: everything wired into a per-commit gate. The build pin, the byte-identical boot goldens, the artifact-provenance check. Not one drifted. Everything that lived only in a document rotted, and nothing announced it.