feat(hooks): add .claude/settings.json + 2 PostToolUse Bash hooks by dackclup · Pull Request #169 · dackclup/quantrank

dackclup · 2026-05-21T09:37:56Z

Summary

Wires the Claude Code harness on this repo with two project-local PostToolUse Bash hooks via a new .claude/settings.json. Both are read-only / side-effect-only — they cannot block the harness or modify code.

log-bash.sh — append every Bash invocation ([<ISO8601-UTC>] <command>) to gitignored .claude/session.log for per-session audit trail. Pure side-effect, no stdout, fail-open on missing jq / unwritable FS / empty stdin.
schema-reminder.sh — emit hookSpecificOutput.additionalContext with the exact python -m compute.output.schema_check command whenever Write/Edit touches any file in the Pydantic↔TS↔snapshot triple (compute/output/schemas.py, frontend/lib/types.ts, frontend/lib/schema-snapshot.json). Closes the local pre-commit gap left by the schema-drift CI guard (§Conventions).

Both hooks: bash + jq only, 5-second timeout, fail-open. No new deps, no env-var reads, no .github/workflows/ touches, no compute / schema / output change.

settings.json pinned to the published JSON schema (https://json.schemastore.org/claude-code-settings.json).

.gitignore appends .claude/session.log + .claude/settings.local.json under a dedicated Claude Code hooks header.

Doc lockstep (§Conventions)

CLAUDE.md — new row in §Layout for .claude/hooks/; new "Safe settings + hooks in flight (this PR)" entry in §Phase status.
AGENTS.md — project-tree rows for .claude/hooks/ + .claude/settings.json; new subsection under §Claude-Code-specific tooling documenting both hooks for Copilot / Cursor / Devin readers (who should ignore .claude/hooks/ and rely on git pre-commit hooks instead).

Subagent review (pre-push)

Spawned in parallel before push.

security-reviewer → SAFE-TO-PUSH. Validated: no command-injection (jq -r + printf '%s' formatter throughout), settings.json schema correct, 5s timeouts appropriate, no secrets / env-vars / workflow touches, gitignore actively ignoring .claude/session.log. One low-risk WARN: if a human types a literal secret into a Bash command, the literal lands in .claude/session.log — log is gitignored + machine-local, so exposure is local-only.
quantrank-reviewer → READY-TO-PUSH. Validated: CLAUDE.md+AGENTS.md §Conventions lockstep ✅; schema-triple paths fully enumerated (bare + */ forms) ✅; fail-open discipline (set +e, || true, 2>/dev/null, exit 0) ✅; scope adherence (no compute/, frontend/lib/, schemas, workflows, deps) ✅.

Test plan

Out of scope

No Python / npm dependency changes — Dependabot baseline (25 active CVEs, #41) unaffected.
No CI workflow changes.
No compute / scoring / valuation / frontend-UI changes.
No schema bump (still 0.9.4-phase4h.4).

Generated by Claude Code

Wire the Claude Code harness with two project-local PostToolUse hooks: - log-bash.sh — append every Bash invocation ([ISO8601-UTC] <command>) to gitignored .claude/session.log for per-session audit trail. Pure side-effect, no stdout, fail-open on missing jq / unwritable FS / empty stdin. - schema-reminder.sh — inject an additionalContext reminder + the exact `python -m compute.output.schema_check` command whenever Write/Edit touches any file in the Pydantic↔TS↔snapshot triple (compute/output/schemas.py, frontend/lib/types.ts, frontend/lib/schema-snapshot.json). Closes the local pre-commit gap left by the schema-drift CI guard. Both hooks: bash + jq only, 5-second timeout, fail-open. No new deps, no env-var reads, no workflow touches, no compute / schema / output change. settings.json pinned to the published JSON schema. .gitignore appends .claude/session.log + .claude/settings.local.json under a dedicated "Claude Code hooks" header. CLAUDE.md gains a §Layout row for .claude/hooks/ and a §Phase status "in flight (this PR)" entry. AGENTS.md gains project-tree rows for .claude/hooks/ + .claude/settings.json and a subsection under §Claude-Code-specific tooling documenting both hooks for Copilot / Cursor / Devin readers. Verified: - pipe-tested both hooks across realistic + edge-case stdin (empty, garbage, no command field, unrelated path) — exit 0 across the board, no spurious log lines, valid JSON on the schema reminder. - security-reviewer subagent: SAFE-TO-PUSH (no command-injection surface; jq -r + printf '%s' formatter; gitignore confirmed). - quantrank-reviewer subagent: READY-TO-PUSH (CLAUDE.md+AGENTS.md lockstep ✅; schema-triple paths enumerated ✅; fail-open ✅).

vercel · 2026-05-21T09:38:01Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
quantrank	Ready	Preview, Comment	May 21, 2026 9:38am

Second deliverable from the 14-subagent full self-audit (2026-05-21). Doc drift surfaced by `docs-reviewer` + `methodology-scientist` against the actual production state on `a16c887` (2026-05-20 cron) + the schema version on `compute/config.py:30`. Five reconciles in lockstep: (a) PHASE_STATUS.md §Current state — schema `0.9.2-phase4h.2` → `0.9.4-phase4h.4`; defense layer headline 17 declared → 27 emitted flags (per PR #154 reconcile); skill inventory 38 → 42; subagent inventory added (14 in 4 tiers); active-vetoes list explicit (7 named); recently-merged block refreshed from PR #146-back to PRs #148-#169 (~20 PRs since `v1.2.0-phase4.5`); next-deliverables list updated to drop the PR-#148-closed Epic #125 Item 3 entry and add the `loss_avoidance_pattern` size-invariant follow-up. (b) SKILL.md schema-version table — 2 missing rows added: `0.9.3-phase4h.3` (PR #160, explicit `Metadata.tier2_enabled` field, closes #117/#155) and `0.9.4-phase4h.4` (PR #161, additive `valuation_methods_applicable` field on `StockDetail` and nested in `fair_price` dict, additive only — no consumer migration). (c) WORKFLOW.md Phase 4.5d `loss_avoidance_pattern` task — threshold description `$5M / $0.05` → `$50M / $0.50` (PR #163 Phase 2.4 10× rescale). Adds the Phase 4 size-invariant follow-up note (NI / TotalAssets) carried from CLAUDE.md §Gotchas since the rescale still fires 0% on production. (d) docs/METHODOLOGY.md — Active vetoes 4 → 7 rows: adds `beneish_manipulation_veto` (Beneish 1999 *FAJ*), `dechow_manipulation_veto` (Dechow 2011 *CAR* Model 1), and `data_quality_input_corruption` (with the dual-path rule — `risk_overlay.py` snapshot-level TBVPS guard + `ensemble.py` output-level guard). Known-calibration-drift block refreshed: `value_trap_risk` (Issue #11 closed via PR #166), `going_concern_disclosure` (FP rate now 1.0% within Mayew band — verified 5/502 on production cron), `loss_avoidance_pattern` (still 0% after Phase 2.4 rescale, follow-up to size-invariant), `restatement_history` (Phase 2.2 high-confidence complement via PR #165). (e) README.md §Honest Limitations — adds Phase 2.2 `restatement_high_confidence` and Issue #11 closure (PR #166) entries; mentions PR #163's 10× rescale on the `loss_avoidance_pattern` line. CLAUDE.md §Phase status + AGENTS.md §Phase + version state — matching "Phase 2 in flight" entries per §Conventions "ship with every PR" rule. Deferred to a follow-up Phase 2.x PR (too large for this scope): METHODOLOGY.md annotate-only section full refresh (7 → 14+ flags) + missing citation blocks (full Hennes-Leone-Miller 2008 *TAR*, Cohen-Malloy-Pomorski 2012, etc.) — needs `methodology-scientist` sign-off per the new-defense-flow rule. Pre-commit verification: - docs-reviewer NEEDS-CLARITY-PASS → fixed `data_quality_input_corruption` rule description in METHODOLOGY.md to cover both veto paths (snapshot-level `risk_overlay.py` + output-level `ensemble.py`). - methodology-scientist findings: data_quality veto classification CONFIRMED via dual-surface emission; value_trap / loss_avoidance / restatement_history all CLEAN. - phase-coordinator Mode A: COLLISION-RISK with PR #170 (Phase 1 ops hardening on `claude/enable-subagents-standby-7lMN4`) on CLAUDE.md + AGENTS.md §Phase status block — both PRs append to the tail. Strategy: PR #170 merges first, then this branch rebases onto updated main; conflict is mechanical 2-paragraph merge. No compute / schema / output / dep change. Lint passes (no Python / TypeScript edited). https://claude.ai/code/session_01HtcGy4F59TaawNQ7V1Eysc Co-authored-by: Claude <noreply@anthropic.com>

…ion (#171) Second deliverable from the 14-subagent full self-audit (2026-05-21). Doc drift surfaced by `docs-reviewer` + `methodology-scientist` against the actual production state on `a16c887` (2026-05-20 cron) + the schema version on `compute/config.py:30`. Five reconciles in lockstep: (a) PHASE_STATUS.md §Current state — schema `0.9.2-phase4h.2` → `0.9.4-phase4h.4`; defense layer headline 17 declared → 27 emitted flags (per PR #154 reconcile); skill inventory 38 → 42; subagent inventory added (14 in 4 tiers); active-vetoes list explicit (7 named); recently-merged block refreshed from PR #146-back to PRs #148-#169 (~20 PRs since `v1.2.0-phase4.5`); next-deliverables list updated to drop the PR-#148-closed Epic #125 Item 3 entry and add the `loss_avoidance_pattern` size-invariant follow-up. (b) SKILL.md schema-version table — 2 missing rows added: `0.9.3-phase4h.3` (PR #160, explicit `Metadata.tier2_enabled` field, closes #117/#155) and `0.9.4-phase4h.4` (PR #161, additive `valuation_methods_applicable` field on `StockDetail` and nested in `fair_price` dict, additive only — no consumer migration). (c) WORKFLOW.md Phase 4.5d `loss_avoidance_pattern` task — threshold description `$5M / $0.05` → `$50M / $0.50` (PR #163 Phase 2.4 10× rescale). Adds the Phase 4 size-invariant follow-up note (NI / TotalAssets) carried from CLAUDE.md §Gotchas since the rescale still fires 0% on production. (d) docs/METHODOLOGY.md — Active vetoes 4 → 7 rows: adds `beneish_manipulation_veto` (Beneish 1999 *FAJ*), `dechow_manipulation_veto` (Dechow 2011 *CAR* Model 1), and `data_quality_input_corruption` (with the dual-path rule — `risk_overlay.py` snapshot-level TBVPS guard + `ensemble.py` output-level guard). Known-calibration-drift block refreshed: `value_trap_risk` (Issue #11 closed via PR #166), `going_concern_disclosure` (FP rate now 1.0% within Mayew band — verified 5/502 on production cron), `loss_avoidance_pattern` (still 0% after Phase 2.4 rescale, follow-up to size-invariant), `restatement_history` (Phase 2.2 high-confidence complement via PR #165). (e) README.md §Honest Limitations — adds Phase 2.2 `restatement_high_confidence` and Issue #11 closure (PR #166) entries; mentions PR #163's 10× rescale on the `loss_avoidance_pattern` line. CLAUDE.md §Phase status + AGENTS.md §Phase + version state — matching "Phase 2 in flight" entries per §Conventions "ship with every PR" rule. Deferred to a follow-up Phase 2.x PR (too large for this scope): METHODOLOGY.md annotate-only section full refresh (7 → 14+ flags) + missing citation blocks (full Hennes-Leone-Miller 2008 *TAR*, Cohen-Malloy-Pomorski 2012, etc.) — needs `methodology-scientist` sign-off per the new-defense-flow rule. Pre-commit verification: - docs-reviewer NEEDS-CLARITY-PASS → fixed `data_quality_input_corruption` rule description in METHODOLOGY.md to cover both veto paths (snapshot-level `risk_overlay.py` + output-level `ensemble.py`). - methodology-scientist findings: data_quality veto classification CONFIRMED via dual-surface emission; value_trap / loss_avoidance / restatement_history all CLEAN. - phase-coordinator Mode A: COLLISION-RISK with PR #170 (Phase 1 ops hardening on `claude/enable-subagents-standby-7lMN4`) on CLAUDE.md + AGENTS.md §Phase status block — both PRs append to the tail. Strategy: PR #170 merges first, then this branch rebases onto updated main; conflict is mechanical 2-paragraph merge. No compute / schema / output / dep change. Lint passes (no Python / TypeScript edited). https://claude.ai/code/session_01HtcGy4F59TaawNQ7V1Eysc Co-authored-by: Claude <noreply@anthropic.com>

Addresses release-captain BLOCKED-ON-PRE-FLIGHT blocker #3 from the v1.3.0 tag attempt — PHASE_STATUS.md / SKILL.md / WORKFLOW.md were 3 days + ~32 PRs stale (last touched PR #171, 2026-05-21). Brings all three docs current to main HEAD 1ff6c11 so the release-captain ladder can re-attempt cleanly. PHASE_STATUS.md - Header date 2026-05-21 → 2026-05-24 - Current state table: schema 0.9.4-phase4h.4 → 0.10.2-phase4.5e; defense layer 27 → 32 emitted flags; subagent inventory 14 → 18 (named tier roster — 4 opus / 14 sonnet); skill inventory 42 → 43; production run a16c887 → 9015748 (cron #3 2026-05-23); release- tag line annotated with v1.3.0 target pending - Recently-merged block: refreshed to PR #170 → PR #237 (~36 entries with commit shas, chronological), drops the stale PR #147-#169 block - Next-deliverables list: 5 items updated — Phase 4.5e PR 5 cluster weight promotion / Issue #67 sector-CoE flip / v1.3.0 release tag gate / Phase 4i.1-4j.1-4k.1 factor integrations / Phase 5 ML meta-learner - Open issues line: drops resolved #155 (closed via PR #160), refreshes #41 (15 open advisories, zero exploitability on static-export), refreshes #67 (data-collection merged PR #204) SKILL.md - Schema-version table: 7 new rows added in reverse-chronological order (matches existing 0.9.x convention) for `0.9.5` → `0.9.6` → `0.9.7` → `0.9.8` → `0.10.0` → `0.10.1` → `0.10.2` covering PRs #180/#181/#183/#204/#205/#222/#224. Each row carries PR # + 1-line scope + backward-compat note + literature anchor. WORKFLOW.md - Phase Overview table 4.5 row marked ✅ DONE 2026-05-23 + 10b5-1 filter scope note - SEC Filing Roadmap Form 4 row flipped "planned" → "active" with 4-PR ladder reference (#167/#205/#222/#224 + 100% coverage on cron #3) - Phase 4.5e task list — 5 items flipped `[ ]` → `[x]` with per-PR commits + methodology-scientist Mode B verdicts inline + Aboody et al. 2010 §3.2 weight-promotion gate noted - Phase 4.5 Acceptance Criteria — all 9 items flipped to `[x]` with completion evidence (cron #3 / methodology verdicts / PR refs) - Phase 4.5f tag item — flipped `[ ]` → `[x]` (`v1.2.0-phase4.5` cut 2026-05-17 at 6d414a9) PHASE_STATUS_INFLIGHT.md - Append new "(this PR)" entry under In-flight section per the PR #237 side-file convention. Documents the doc-refresh scope + cross-refs to release-captain blockers 1/2/4/5 still pending. Lockstep - PR #237's PHASE_STATUS_INFLIGHT.md side-file pattern handles the §Conventions "ship with every PR" rule for this doc-only PR - No CLAUDE.md / AGENTS.md substantive change required — the in-flight entry lives in the side-file per the new convention - No compute / schema / scoring / valuation / frontend / Python / TypeScript code change - Unblocks v1.3.0 tag blocker #3; blockers 1 (wrong-branch), 2 (pyproject.toml 0.3.0 → 1.3.0), 4 (production output 1 cron cycle behind code), and 5 (release notes draft scope) still need resolution before tag cut

…239) Addresses release-captain BLOCKED-ON-PRE-FLIGHT blocker #3 from the v1.3.0 tag attempt — PHASE_STATUS.md / SKILL.md / WORKFLOW.md were 3 days + ~32 PRs stale (last touched PR #171, 2026-05-21). Brings all three docs current to main HEAD 1ff6c11 so the release-captain ladder can re-attempt cleanly. PHASE_STATUS.md - Header date 2026-05-21 → 2026-05-24 - Current state table: schema 0.9.4-phase4h.4 → 0.10.2-phase4.5e; defense layer 27 → 32 emitted flags; subagent inventory 14 → 18 (named tier roster — 4 opus / 14 sonnet); skill inventory 42 → 43; production run a16c887 → 9015748 (cron #3 2026-05-23); release- tag line annotated with v1.3.0 target pending - Recently-merged block: refreshed to PR #170 → PR #237 (~36 entries with commit shas, chronological), drops the stale PR #147-#169 block - Next-deliverables list: 5 items updated — Phase 4.5e PR 5 cluster weight promotion / Issue #67 sector-CoE flip / v1.3.0 release tag gate / Phase 4i.1-4j.1-4k.1 factor integrations / Phase 5 ML meta-learner - Open issues line: drops resolved #155 (closed via PR #160), refreshes #41 (15 open advisories, zero exploitability on static-export), refreshes #67 (data-collection merged PR #204) SKILL.md - Schema-version table: 7 new rows added in reverse-chronological order (matches existing 0.9.x convention) for `0.9.5` → `0.9.6` → `0.9.7` → `0.9.8` → `0.10.0` → `0.10.1` → `0.10.2` covering PRs #180/#181/#183/#204/#205/#222/#224. Each row carries PR # + 1-line scope + backward-compat note + literature anchor. WORKFLOW.md - Phase Overview table 4.5 row marked ✅ DONE 2026-05-23 + 10b5-1 filter scope note - SEC Filing Roadmap Form 4 row flipped "planned" → "active" with 4-PR ladder reference (#167/#205/#222/#224 + 100% coverage on cron #3) - Phase 4.5e task list — 5 items flipped `[ ]` → `[x]` with per-PR commits + methodology-scientist Mode B verdicts inline + Aboody et al. 2010 §3.2 weight-promotion gate noted - Phase 4.5 Acceptance Criteria — all 9 items flipped to `[x]` with completion evidence (cron #3 / methodology verdicts / PR refs) - Phase 4.5f tag item — flipped `[ ]` → `[x]` (`v1.2.0-phase4.5` cut 2026-05-17 at 6d414a9) PHASE_STATUS_INFLIGHT.md - Append new "(this PR)" entry under In-flight section per the PR #237 side-file convention. Documents the doc-refresh scope + cross-refs to release-captain blockers 1/2/4/5 still pending. Lockstep - PR #237's PHASE_STATUS_INFLIGHT.md side-file pattern handles the §Conventions "ship with every PR" rule for this doc-only PR - No CLAUDE.md / AGENTS.md substantive change required — the in-flight entry lives in the side-file per the new convention - No compute / schema / scoring / valuation / frontend / Python / TypeScript code change - Unblocks v1.3.0 tag blocker #3; blockers 1 (wrong-branch), 2 (pyproject.toml 0.3.0 → 1.3.0), 4 (production output 1 cron cycle behind code), and 5 (release notes draft scope) still need resolution before tag cut Co-authored-by: Claude <noreply@anthropic.com>

vercel Bot deployed to Preview May 21, 2026 09:38 View deployment

dackclup marked this pull request as ready for review May 21, 2026 09:49

dackclup merged commit 54b29b2 into main May 21, 2026
4 checks passed

dackclup deleted the claude/safe-settings-hooks branch May 21, 2026 09:49

dackclup mentioned this pull request May 21, 2026

docs: Phase 2 doc-drift reconcile — 5 files match current implementation #171

Merged

5 tasks

dackclup mentioned this pull request May 21, 2026

feat(claude-tooling): lean baseline — 1 hook + 2 sonnet subagents + gate-only auto-routing #173

Closed

11 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(hooks): add .claude/settings.json + 2 PostToolUse Bash hooks#169

feat(hooks): add .claude/settings.json + 2 PostToolUse Bash hooks#169
dackclup merged 1 commit into
mainfrom
claude/safe-settings-hooks

dackclup commented May 21, 2026

Uh oh!

vercel Bot commented May 21, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

dackclup commented May 21, 2026

Summary

Doc lockstep (§Conventions)

Subagent review (pre-push)

Test plan

Out of scope

Uh oh!

vercel Bot commented May 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

vercel Bot commented May 21, 2026 •

edited

Loading