Skip to content

chore(config): read-only Claude Code settings allowlist + STATE.a2ml metadata refresh#480

Merged
hyperpolymath merged 1 commit into
mainfrom
claude/inspiring-allen-QCIqi
May 30, 2026
Merged

chore(config): read-only Claude Code settings allowlist + STATE.a2ml metadata refresh#480
hyperpolymath merged 1 commit into
mainfrom
claude/inspiring-allen-QCIqi

Conversation

@hyperpolymath
Copy link
Copy Markdown
Owner

What

A small, toolchain-free config update (the part of the "document / clean up / config / merge" request that was genuinely mine to do — see "Context" below).

1. .claude/settings.json (new)

Project-scoped Claude Code permission allowlist of strictly read-only operations, to cut permission prompts in this repo's sessions. Modelled on what these sessions actually run:

  • Read tools: Read, Glob, Grep
  • Read-only git: status, log, diff, branch, fetch, show, rev-parse, ls-files, ls-tree, merge-base, remote -v
  • Read-only shell: ls, cat, grep, wc, find, head, tail
  • The repo's own read-only guard scripts: tools/check-no-extension-ts.sh, tools/check-doc-truthing.sh
  • Read-only GitHub MCP: issue_read, pull_request_read, all list_* / get_* / search_*

Deliberately excluded (keep prompting): git push/commit/merge, Write/Edit, deletes, and any arbitrary-exec pattern (python3 -c, bash -n were dropped after the auto-mode classifier correctly flagged them as not actually read-only).

2. STATE.a2ml metadata refresh

The mirror's [metadata] header was stale: version 0.1.0 → 0.1.1 (matches dune-project), last-updated 2026-05-23 → 2026-05-30. Content was already current (the DOC-16/17 session-note landed via #475/#479); the DOC-05 mirror keys (authoritative-status-doc, drift-flag) are preserved, so the doc-truthing guard stays green.

Verification (at source)

Context (why this PR is small)

The original request had four parts; here's what each resolved to:

Refs #176.

https://claude.ai/code/session_01E3R1oZhGUKfTYeTSVJVTcn


Generated by Claude Code

… STATE.a2ml metadata

Config update (no compiler/behaviour impact).

.claude/settings.json (new): project-scoped permission allowlist of strictly
read-only operations to cut permission prompts in repo sessions — Read/Glob/
Grep, read-only git (status/log/diff/branch/fetch/show/rev-parse/ls-files/
ls-tree/merge-base/remote -v), read-only shell (ls/cat/grep/wc/find/head/tail),
the three read-only tools/check-*.sh guard scripts, and read-only GitHub MCP
tools (issue_read/pull_request_read/list_*/get_*/search_*). Mutating operations
(git push/commit/merge, Write/Edit, deletes) deliberately omitted — they keep
prompting. No arbitrary-exec patterns (python3 -c / bash -n excluded).

STATE.a2ml: refresh stale [metadata] header — version 0.1.0 → 0.1.1 (matches
dune-project), last-updated 2026-05-23 → 2026-05-30. Content already current
(DOC-16/17 session-note landed via #475); DOC-05 mirror keys preserved so the
doc-truthing guard stays green.

https://claude.ai/code/session_01E3R1oZhGUKfTYeTSVJVTcn
@hyperpolymath hyperpolymath marked this pull request as ready for review May 30, 2026 22:49
@hyperpolymath hyperpolymath merged commit b440819 into main May 30, 2026
0 of 24 checks passed
@hyperpolymath hyperpolymath deleted the claude/inspiring-allen-QCIqi branch May 30, 2026 22:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants