docs(agent): activate the agent operating contract (.claude/CLAUDE.md)

[itcmsgr]

Docs-only. 2 files, zero product/packaging/CI/test change.

Why now

.claude/CLAUDE.md declared Current Version: v1.195.0 while the project ships v1.228.0. It governs every agent session before contributors or deputies touch the repository, so a stale authority file is itself an authority defect — and agents acted on it.

What changed

Version is now DERIVED, not hard-coded — VERSION, VERSION_DATE, gh release list, origin/main, register baseline — with a STOP condition when those five disagree. The one dated figure is explicitly labelled a snapshot.

Restructured from a hallucination checklist into a 24-rule execution contract, each stating RULE / WHY / AUTHORITY / STOP. 401 lines.

Encodes what the v1.228.0 campaign established: authority hierarchy (runtime > code at an exact SHA > artifact > falsifiable test > register > comment) · a guard must measure the authority it claims to measure, with the nine observed instances · PASS != INJECTION PROVEN · derive sets, never pin names or counts · one file set one owner, with CROSS_LANE_DEPENDENCY instead of reaching across · parallel authoring, serial merging · the two-register rule and "planning docs are evidence, never status authority" · preserve chronology · handles are identities, not assignments · approval economy · CI truth including the measured non-determinism of local ci-bash · release gates (labs required; fleet skippable only by owner decision) · exit codes are a shipped contract · a component that cannot do its work must not report success.

Preserved: the [VERIFIED] protocol, NOT-SUPPORTED list, key paths, claim limits (no GPG signing, SLSA covers the standalone Go binary only, PAM detection-only, no competitor comparison), documentation-style authorities.

Replaced: the hard-coded CLI command list, with a derivation from commands.registry.yml — since that registry total_commands field was itself wrong by five.

.gitignore correction

.claude/ excluded the whole directory while CLAUDE.md was the single tracked file inside it, so staging required git add -f and a future git add would silently stage nothing.

Uses .claude/* + !.claude/CLAUDE.md, not !.claude/. Measured: a directory exclusion stops git descending, so a negation for a child never matches — the !.claude/ form un-ignores the entire directory and turns docs/, BRAND_GUIDE.md and WIKI_STYLE_GUIDE.md into untracked noise. The contents form re-includes exactly CLAUDE.md.

Two dangling references caught by pre-merge validation

1. V1_139_FHS_AUTHORITY_GRAPH.md is in NFTBAN_ROADMAP/COMPLETED/, not the roadmap root. The wrong path was inherited verbatim from the file this rewrite replaces — a stale citation copied forward while rewriting the document whose purpose is to stop stale authority claims.
2. The seven .claude/docs and .claude/*.md style authorities are local-only; .gitignore tracks exactly one file under .claude/, so a fresh clone has none of them. Now labelled as such, with instructions to fall back to the inline rules rather than assume the guidance does not exist.

Verification

• TRACKED_REFERENCES_DANGLING = 0 after the fixes
• fresh worktree contains the full 401-line contract
• git add .claude/CLAUDE.md works with no -f
• .claude/docs/, BRAND_GUIDE.md, WIKI_STYLE_GUIDE.md remain ignored — 0 untracked noise

Note: direct push to main was attempted per instruction and rejected by branch protection, so this goes through a PR.

🤖 Generated with Claude Code

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None