docs(rules): split PR/merge hazards out; add claude-perms-sweep

[laurigates]

Distilled from a session that traced why Claude Code web prompted constantly for scheduling/notification tools, then swept the fix across the portfolio.

1. rules/claude-code-auto-mode.md — the always-classify tool set

A hardcoded set — Agent, CronCreate, RemoteTrigger, ScheduleWakeup, SendFile — is excluded from auto mode's "would this be allowed in acceptEdits?" fast path and reaches the classifier on every call. No autoMode prose changes that; only a whole-tool allow rule, which resolves ahead of the classifier.

Traps recorded alongside it:

• These tools declare no ruleContentField, so a scoped rule like RemoteTrigger(create) silently never matches — bare names only.
• The arbitrary-code-execution strip doesn't touch non-exec grants, so these carry over into auto mode.
• Monitor is deliberately excluded — it runs shell.

2. rules/pr-merge-hazards.md (new) — a split, not a cap raise

git-hazards.md had grown to cover two distinct surfaces, and the finding below pushed it past the 10 KB per-rule cap the context-budget gate enforces. Rather than raise the cap, split by surface:

File	Traps	Size
git-hazards.md	5 local-git (post-squash orphans, unpushed main, duplicate merge additions, git add atomicity, vanished staged file)	4.0 KB
pr-merge-hazards.md	4 GitHub/PR-merge (--merged misses squash, stacked-base auto-close, push-by-SHA, UNSTABLE≠BLOCKED)	6.5 KB

Cross-references and the marker-allowlist entry follow the traps to the new file. Verified against a clean origin/main worktree — the always-loaded total is 112,307 / 114,000, so the split costs only the second header.

The new trap: UNSTABLE is not BLOCKED. Failing checks that aren't branch-protection-required merge with a plain gh pr merge, so reaching for --admin takes a privilege you didn't need. Adds the two-check test for merging over red (files-touched and main-already-failing — either alone is a guess) and the stale-green-main case that hides breakage.

3. scripts/claude-perms-sweep.py + just -g claude-perms-sweep

Generalises this session's one-off sweep into a reusable pass. Design notes:

• Discovers repos from GitHub, not local clones. This is not cosmetic: enumerating ~/repos missed six repos that had committed .claude/settings.json but were never cloned locally.
• Patches via the API, so dirty working trees and feature-branch checkouts are untouched, and it reads true remote state rather than possibly-drifted local files.
• Surgical string insertion, not a json.load/dump round-trip — the diff is the change, not a whole-file reformat.
• Dry-run by default; json.loads gates every write. Never creates a missing settings.json, since an absent project config is a deliberate state.

Verification

• pre-commit run green, including the context-budget gate that originally caught the overage.
• Budget re-verified on an isolated origin/main worktree to rule out unrelated working-tree edits.
• Script smoke-tested dry-run across 81 repos (CHANGED=6 SKIPPED=75 FAILED=0); the six it surfaced were swept and merged.

🤖 Generated with Claude Code

https://claude.ai/code/session_017AF6S4A2q5ha5Yhk8duyMp

[github-actions]

⚠️ Broken Links Detected

Summary

Status	Count
🔍 Total	170
✅ Successful	159
⏳ Timeouts	0
🔀 Redirected	0
👻 Excluded	9
❓ Unknown	0
🚫 Errors	2

Errors per input

Errors in exact_dot_claude/docs/prds/daily-catchup.PRD.md

• [404] https://docs.anthropic.com/claude-code/commands | Failed: Network error: Not Found

Errors in docs/adrs/0011-claude-rules-migration.md

• [ERROR] https://www.anthropic.com/engineering/claude-code-best-practices | Failed: Network error: error sending request for url (https://www.anthropic.com/engineering/claude-code-best-practices)
  Full Github Actions output

---

Please fix the broken links before merging.