fix(claude): exact check-script rules instead of a mid-command wildcard

[hyperpolymath]

Summary

Replaces the Claude Code allow rule Bash(bash scripts/check-*.sh:*) with four exact rules. Claude Code 2.1.285 warns at startup that a * before the end of a Bash rule is a permission wildcard, so it also approves any options inserted at that position without a prompt. The * here was meant as a filename glob.

Changes

• .claude/settings.json: the wildcard rule becomes one rule per existing script: check-no-md-in-docs.sh, check-no-project-identifiers.sh, check-root-shape.sh, check-state.sh. Every other rule and the SessionStart hook are unchanged.
• The file is rewritten in JCS canonical form with ijson-jcs fix (estate JSON standard D306). That is why the diff shows a 1-line file.

📌 New pins

Head SHA: 739b35b6853652bf5efcee52ecaa2efca703f54d. No action, lockfile or container pins are added or changed.

RSR Quality Checklist

Required

• Tests pass: not run; the change is config-only and no test covers .claude/settings.json
• Code is formatted: ijson-jcs check .claude/settings.json → OK
• Linter is clean: no source code changed
• No banned language patterns
• No unsafe blocks without // SAFETY: comments: no code changed
• No banned functions: no code changed
• SPDX license headers: not applicable; JSON cannot carry a comment header, and the file had none before
• No secrets, credentials, or .env files included

As Applicable

• Machine-readable state files: not applicable; no project state changed (and A2ML is retired, D308)
• Documentation: not applicable; no user-facing change
• TOPOLOGY.md: not applicable
• CHANGELOG: not applicable; agent config only
• New dependencies: none
• ABI/FFI: not applicable

Testing

• ijson-jcs check .claude/settings.json (hyperpolymath/ijson-jcs CLI at 0fdeea7) → OK, rc 0. The checker was first shown to reject a duplicate-key file and flag a non-canonical one.
• A wildcard scan (any * in a Bash(...) rule other than a trailing * or :*) → 0 of 16 rules flagged.
• git ls-tree origin/main scripts/ lists exactly the four check-*.sh scripts now named.

Screenshots

Not applicable.

Deferred red checks

These checks are not required, and all were already failing on main at 438d2b1c39 before this PR: Validate DEED manifests, Validate K9 contracts, governance / Actions lockfile verify, governance / Check Workflow Staleness and governance / Workflow security linter. Deferred to #96.

🤖 Generated with Claude Code

https://claude.ai/code/session_01GpUzjdhWFi26k6s7AWxYcf

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 4e6bc40f-b682-48b1-9709-613a2e1354c6

📥 Commits

Reviewing files that changed from the base of the PR and between 438d2b1 and 739b35b.

📒 Files selected for processing (1)

• .claude/settings.json

 ____________________________________________________________________________________________________________________________________________________
< There are no final decisions. No decision is cast in stone. Instead, consider each as being written in the sand at the beach, and plan for change. >
 ----------------------------------------------------------------------------------------------------------------------------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud