v1.18.0 — new-coverage notes, Astro support, recursive stack detection

Added

• Clawness tells you when an update brings rule coverage your project can use.
  When Clawness gains detection or rules for a stack you already work in, those rules
  start applying by themselves — but nothing used to say so, and a capability you were
  waiting for could sit unnoticed. On the first session after an update, Clawness now
  compares what your project matches against what it matched before and names anything
  new. It stays silent on a project's first ever session (everything is new then), on
  every session where the version hasn't changed, and once a domain has been announced.
  It rides the existing project scan, so it costs no extra work. Silence it with
  CLAW_NO_UPGRADE_NOTE=1.

• Astro projects are now recognised, with a rule set of their own. An astro.config.*
  file or an astro dependency detects the project as Astro (and TypeScript, and CSS —
  scoped <style> blocks in a component are invisible to a filename scan), the session
  note reads the version ("Astro 5.2"), and seven new rules cover island hydration
  directives, state across islands, content collections, static vs server output,
  astro:env secrets, scoped styles, and the server-only frontmatter fence.

Fixed

• Detection by file extension now sees your whole project, not just its top folder.
  Rules for a language were only triggered when a matching file sat in the project root,
  so a site with its stylesheets in src/styles/ got no CSS rules, and the same held for
  *.py, *.sh, *.sql, *.tex and *.jl. Clawness now walks the project (skipping
  node_modules, build output and other vendored trees, bounded so it stays a few
  milliseconds) and detects those files wherever they live. Expect some projects to start
  matching domains they never did before — that is the bug being fixed. A handful of
  weak signals stay root-only on purpose: a main.py at the top of a project suggests a
  web app, a main.py three folders down does not.

Changed

• Ranked rules must now match on a rule's curated fields, not just its prose. Rules
  are indexed twice: once over everything, and once over only the hand-written
  tags/triggers/when. A rule that matches your prompt purely through an ordinary
  word buried in its explanation is no longer injected — the case that put a Julia
  dispatch rule in front of someone editing an Astro site. Tune with CLAW_MIN_CURATED
  (default 0.03); CLAW_MIN_RELEVANCE=0 disables it along with the other floors.
• Rules for narrow stacks stay out of projects that show no sign of them. The higher
  relevance bar for cfd/julia/fortran/matlab/r previously applied only when Clawness had
  recognised your stack; a project it couldn't identify — one in a subdirectory, say — got
  no filtering at all. "Nothing detected" now means "not Fortran" rather than "no opinion".
  Asking about those languages directly still works, and their rules are unaffected in
  their own projects.

v1.17.0 — /clawness:audit renamed to /clawness:security-audit

Changed

• The security-audit command is renamed /clawness:audit → /clawness:security-audit.
  The bare audit sat next to /clawness:audit-rules (which audits the rule corpus, not
  security) and gave no hint it was the vulnerability scan; the new name matches the
  ecosystem convention (Claude's built-in /security-review, the Claude Security plugin's
  /security-scan) and the plugin's own security-red-team/security-blue-team agents.
  If you typed /clawness:audit, use /clawness:security-audit now — the old name is gone.
• The README now has a single Slash Commands section listing all 13 commands with
  one-line descriptions, grouped everyday / hygiene / maintainer, instead of scattering
  them across the doc.

v1.16.0 — scan covers six more languages, plus SARIF ingestion

Added

• clawness scan now enumerates Go, Java/Kotlin/Scala, Ruby, C# and PHP — not
  just Python and JavaScript/TypeScript. On-stack users of these ecosystems now get
  real sink/source candidates instead of silence: SQL and command injection, unsafe
  deserialization, code eval, XSS, path traversal, weak crypto, and SSRF, drawn from
  each language's own idioms (e.g. Go database/sql + exec.Command shell forms and
  math/rand; Java ProcessBuilder / ObjectInputStream / ScriptEngine /
  MessageDigest("MD5"); Ruby ActiveRecord interpolation, backticks, YAML.load;
  C# SqlCommand interpolation, BinaryFormatter, Process.Start; PHP query
  concatenation, include($_GET…), mt_rand). Reuses the existing 10 finding
  classes and CWE/severity metadata, so the ledger, coverage and /clawness:audit
  workflow are unchanged — there is simply more to find. Still a tripwire, not a SAST
  engine; the scan stays deterministic and zero-token.
• clawness scan ingests SARIF / SAST output. If your project already runs
  bandit, semgrep, CodeQL or any tool that emits SARIF, drop the *.sarif in the tree
  (auto-detected) or pass --sarif <path>, and those findings are folded into the same
  scan — re-keyed to Clawness's stable ids, mapped onto the native finding classes by
  CWE tag (falling to a generic sast-other bucket that carries the tool's own CWE and
  severity), and deduped against the regex enumerator's hits (native wins). No SAST tool
  need be installed — Clawness reads the output only, so PyYAML stays the sole
  dependency. So the scan is a tripwire on its own, and real SAST wherever you have it.

v1.15.0 — deterministic security scan + findings ledger

Added

• clawness scan — deterministic attack-surface enumerator. A regex/lexical
  sink+source finder (SQL/command injection, unsafe deserialization, code eval,
  XSS, path traversal, broken object authz, hardcoded secrets, weak crypto, SSRF)
  that returns the same sorted candidate list every run, with zero LLM tokens.
  It exists to cut security scans from 5-10 stochastic frontier passes to 1-2: the
  variance in an LLM scan is almost all in discovery, so making discovery
  reproducible reduces the model to adjudicating a fixed short list. Report-only by
  default; --fail-on <severity> opts into a CI gate. A tripwire, not a SAST
  engine — it routes attention, it is not CodeQL/Semgrep. Opt out with
  CLAW_NO_SCAN.
• Accumulating findings ledger (.clawness/security/findings.json). Each scan
  merges into a per-candidate ledger keyed by a stable id, so runs accumulate
  instead of repeating: a candidate is new until adjudicated, a removed sink
  becomes gone (remembering its verdict so it isn't re-opened if it returns), and
  a coverage signal tells you when every candidate has been looked at — that
  convergence, not a fixed re-run count, is when to stop. clawness scan status
  shows it without re-scanning; clawness scan --set <id> <status> records a
  verdict. Gitignored by default (it records where the vulnerabilities are).
• /clawness:audit is now stateful and auto-invoking. It runs clawness scan
  first, then the red team adjudicates only the new candidates and writes
  verdicts back to the ledger (skipping anything already confirmed/false-positive/
  fixed), the blue team fixes and marks them, and the run reports coverage. Claude
  reaches for it on its own on security-audit / vulnerability-scan prompts — no
  need to type the command.

Changed

• WF-SECURITY-AUDIT-001 now steers to enumerate deterministically before
  adjudicating, persist findings to the ledger, adjudicate only new candidates, and
  names the /clawness:audit skill.
• The clawness CLI now pins UTF-8 on stdout/stderr, so em-dashes and arrows in
  its output no longer raise on a Windows cp1252 console.

v1.14.0 — user documentation skill

Added

• /clawness:user-docs skill — writes user documentation from the codebase. It
  scans the UI (screens, buttons, forms, i18n strings) and the public API/CLI to work
  out what the software does, then drafts brief, task-first docs to the Diátaxis
  standard (tutorial / how-to / reference / explanation) for either end-user or
  developer audiences. It proposes an outline and writes only after you approve it, and
  grounds every label and command in the source. Claude also reaches for it on its own
  when you ask it to document the app or say the docs are stale — no need to type the
  command.
• GEN-USERDOCS-001 rule — on documentation-writing prompts, steers toward
  Diátaxis structure, brevity, and UI labels that match the code, and points at the
  /clawness:user-docs skill.

v1.13.0 — OpenClaw native commands, install-time vetting, memory corpus

Added

• Three OpenClaw-native commands. OpenClaw plugins can't contribute Claude Code
  skills or sub-agents, so the /clawness:* skills don't surface there. Instead the
  adapter now registers three read-only OpenClaw commands over the same Python CLI:
  /clawness-status (loaded rule counts + token cost), /clawness-query (surface the
  ranked rules for a prompt), and /clawness-audit-rules (maintainer corpus check).
  They bypass the LLM and reply directly. The remaining skills stay Claude-Code-only:
  add and refresh need the model driving its own file tools across a multi-step
  workflow, which the plugin-command surface can't provide (a handler gets a copy of the
  command body and no handle to rewrite the agent's turn), and the agent-spawning skills
  (audit, review, perf, test) orchestrate Claude Code sub-agents. See
  openclaw/COMMANDS-PLAN.md.
• OpenClaw: install-time trust vetting. Clawness now vets a skill/plugin/agent for
  prompt-injection and exfil tells the moment OpenClaw installs it (the before_install
  hook), reusing the same scanner as clawness audit-skills. Findings surface on the
  install; a clearly hostile artifact (agent-hijack phrasing, webhook/metadata exfil,
  decode-and-execute) is blocked, with an escape hatch (CLAW_NO_INSTALL_BLOCK=1) for a
  trusted security tool that legitimately mentions those. Opt out entirely with
  CLAW_NO_INSTALL_SCAN=1. OpenClaw-only — Claude Code has no install-time hook.
• OpenClaw: context re-orientation after compaction. When OpenClaw compacts a session
  (squashing older detail out of context), Clawness re-injects the orientation that
  compaction drops — a short notice plus the handoff and stack-detection notes — so a
  mid-task session recovers its footing. Rules and ranked memory already self-heal on the
  next turn, so those aren't repeated. This is the native counterpart to Claude Code's
  context-pressure watch, which can only estimate when the window is filling. Opt out with
  CLAW_NO_STACK_NOTE/CLAW_NO_HANDOFF (the underlying notes) — the re-orientation adds
  nothing beyond them.
• OpenClaw: .clawness/memory.md as a searchable memory corpus. Project lessons are
  now discoverable through OpenClaw's native memory search, ranked by the same engine that
  injects them each turn — additive, not a replacement for the per-turn block. Opt out with
  CLAW_NO_MEMORY_CORPUS=1.
• We evaluated exposing rules retrieval as a native OpenClaw context engine and chose not
  to: that surface is an exclusive, whole-transcript store-and-assemble engine, and the
  existing per-prompt injection already delivers the rules cheaply without taking over the
  host's context handling. See openclaw/EXTENSIONS-PLAN.md.

v1.12.0 — OpenClaw support (live-verified)

Added

• New rule GEN-CONCISE-001. Enforces terse, to-the-point prose in READMEs,
  docs, changelog entries, and comments — lead with the point, cut restatement and
  hedging, one idea per sentence. Complements the comment-specific GEN-COMMENT-001.
• New rule GEN-DOCSYNC-001. Keep a subtree's own docs current: when you change
  code in an area with a nested CLAUDE.md (or module README), correct or prune that
  doc in the same change, rather than letting it drift into describing the old behaviour.
• Experimental OpenClaw support. Clawness now runs inside
  OpenClaw as well as Claude Code, via a thin TypeScript
  adapter in openclaw/ that shells out to the same Python engine, rules corpus,
  and access guard — one source of truth, no second corpus to maintain. The
  adapter maps OpenClaw's before_prompt_build, session_start, and
  before_tool_call/after_tool_call hooks onto the existing Python hook scripts.
  This first cut covers rule + memory injection, the SessionStart notes, and the
  access guard (block/ask); the Claude-specific subsystems (context watch, plan
  gate, model advisor) stay dormant for now. Installs from GitHub with
  openclaw plugins install git:github.com/fullymiddleaged/Clawness (OpenClaw
  ≥2026.3.24-beta.2 — the first release whose plugin SDK ships the plugin-entry
  API the adapter targets, declared as the manifest's compat.pluginApi floor so
  older hosts are rejected at install; Node ≥22.22.3,
  Python 3.10+): the repo root carries the OpenClaw plugin manifest pointing at the
  prebuilt adapter, and the clone brings the Python engine along, so there's no
  second copy to maintain and nothing to compile. See openclaw/README.md.
  Live-verified on OpenClaw 2026.7.1: rule + memory injection reaches the model, and
  the access guard's before_tool_call block/ask plus after_tool_call ledger are
  honored by the host (a returned block stops the tool and surfaces its reason). The
  SessionStart-note path is verified against the SDK types but not yet on a live
  interactive channel — the one-shot agent CLI doesn't surface next-turn injection.
• New /clawness:openclaw-audit skill. Trims an OpenClaw workspace's base
  system prompt — the files injected into every turn (SOUL.md, AGENTS.md,
  IDENTITY.md, USER.md, MEMORY.md). Measures their per-turn cost, then works
  through them section by section: cutting what the tools or codebase already say,
  moving durable conventions to .clawness/rules/ and one-line traps to
  .clawness/memory.md, and leaving load-bearing persona and identity in place.
  The OpenClaw sibling of /clawness:claude-md. (Workspace filenames and limits are
  docs-derived; confirm against a live OpenClaw before acting.)
• New /clawness:eval-set skill. Author and run a project-specific retrieval
  eval so rule or base-prompt changes are scored, not eyeballed. Mirrors
  tests/ground_truth.json + clawness eval: you write prompt→expected-rule cases
  in .clawness/eval/cases.json (a template ships with the skill) and measure
  MRR@k + hit-rate before and after an edit. Harness-agnostic; it is the
  verification step openclaw-audit/claude-md point at when moving content into
  ranked retrieval.

Changed

• README now leads with dual-host support (Claude Code and OpenClaw) and the
  OpenClaw section reflects the live-verified status; trimmed the most verbose intro
  passages.

v1.11.0 — uncovered-stack note and /clawness:bootstrap

Added

• Clawness now tells you when it has no rules for your stack. Open a session in
  a project built on a stack Clawness ships no corpus for — Ruby, PHP, Elixir,
  Haskell, C#, Swift, Dart, Scala, Clojure, and others — and it now says so once,
  instead of silently adding little beyond the always-on mandatory rules. The note
  points at the new /clawness:bootstrap skill and starts nothing itself. Raised
  once per stack per project; silence with CLAW_NO_COVERAGE_NOTE=1.
• New /clawness:bootstrap skill. Drafts a small starter set of project rules
  for an uncovered stack: it reads what the project actually is, grounds each rule
  in current official documentation (not model memory), writes them into
  .clawness/rules/, and lint-validates them — stopping for your approval before
  writing anything.

Changed

• The handoff pickup note no longer suggests renaming the session by default.
  The /rename hint that appeared on every handoff pickup was more interruption than
  it was worth; it is now opt-in via CLAW_HANDOFF_SUGGEST_NAME=1 for anyone who
  wants it back.
• Security red-team and blue-team agents refreshed to the OWASP Top 10 (2025).
  The red team now maps trust boundaries first, works from the 2025 category list
  (SSRF folded into Broken Access Control, a dedicated Software Supply Chain
  category, the new Mishandling of Exceptional Conditions), adds an LLM/AI-app
  checklist drawn from the OWASP Top 10 for LLM Applications, checks lockfiles and
  git history for secrets, and reasons about exploit chains and reachability
  rather than isolated findings. The blue team now fixes root causes at the choke
  point rather than one instance at a time, prefers fail-closed defaults, and adds
  a regression test that reproduces the attack so a hole can't silently reopen.

Fixed

• Corrected the plugin's advertised corpus size in the marketplace/plugin
  description — it read "195 rules across 28 domains" and now reads the actual "212
  rules across 29 domains".

v1.10.0 — science, ML & research deep pass

A deep pass on scientific and research work: a new machine-learning domain, and
broader coverage of numerical computing, research method, and reporting standards —
17 new rules across three domains, grounded in current primary sources.

Added

• New ml domain — discipline for training and evaluating models. Detected from
  modelling libraries (scikit-learn, XGBoost, LightGBM, statsmodels, PyTorch,
  TensorFlow, Keras, JAX), not from "is this science", so it fires for any codebase
  that trains a model — a fraud model in a web service as readily as a physics
  classifier — and stays silent in a plain app that trains none. It sits beside llm
  (building on hosted models) and the cross-cutting science domain. Eight rules:
  data leakage (MLD-LEAKAGE-001), cross-validation and split discipline
  (MLD-CV-001), metrics and baselines (MLD-METRICS-001), class imbalance
  (MLD-IMBALANCE-001), probability calibration (MLD-CALIBRATION-001), run
  reproducibility (MLD-REPRO-001), overfitting and regularisation
  (MLD-OVERFIT-001), and the REFORMS reporting checklist for ML-based science
  (MLD-REFORMS-001). The MLD- prefix (not ML-) is deliberate: ML- is the
  MATLAB domain.
• Five new numerical / scientific-computing rules. Modern NumPy random generators
  and safe parallel seeding (SCI-RNG-001), matrix conditioning and stable solves
  (SCI-LINALG-001), checking solver/optimizer convergence flags (SCI-SCIPY-001),
  and workflow managers for multi-step analyses (SCI-PIPELINE-001). SCI-REPRO-001
  now names lockfiles (uv / pixi) as the way to pin an environment.
• Five new research-method and integrity rules, grounded in recognised standards.
  Verifying that every citation exists and supports its claim — never trusting
  AI-generated references (RES-CITECHECK-001, per COPE/ICMJE); matching the right
  reporting checklist to the study type — PRISMA 2020, CONSORT 2025, STROBE, ARRIVE
  2.0 (RES-REPORTING-001); data and code availability statements with a repository
  DOI, made FAIR (RES-AVAILABILITY-001); pre-registration and honest
  confirmatory-vs-exploratory reporting (RES-PREREG-001); and point-by-point
  responses to peer review (RES-REVIEW-001).

Notes

• No new version stamps: the machine-learning and numerical guidance is stable across
  library majors (scikit-learn/scipy/statsmodels have never had a claim-inverting
  major), so stamping would only buy future false alarms. VERSION_WATCH_* is
  unchanged.

v1.9.0 — version stamps and version-gap detection

Rules can now say which framework versions they were checked against, and Clawness
tells you when your project has moved past them. Plus the fix that makes
.clawness/rules/ the override layer it was always documented to be.

Added

• Rules can carry a version stamp, and a session-start note when your project
  outruns it. A rule may record applies_to (the framework versions it was
  established against), verified (when) and sources (what justified it). If your
  project declares a version past that range, Clawness says so once — one sentence,
  naming how many rules and which versions. The relevance floor could never catch
  this: a major bump keeps the words ("route", "cache", "app router") and changes
  their meaning, so a rule written for Next.js 14 scores like an ordinary match on a
  Next.js 17 prompt and gets served confidently. The note starts no work; it orients
  and stops. Silence it with CLAW_NO_STALENESS_NOTE=1.
• Only a verified stamp raises a warning. A rule carrying applies_to without
  verified and sources is asserted, not established, and stays silent. So the
  feature ships doing nothing until real review has happened — a wrong "this was
  checked" badge is worse than no badge at all.
• /clawness:refresh <domain> — bring a project's rules up to its actual version.
  Reads the lockfile (not the manifest range), greps for the constructs each candidate
  rule would govern, looks up the framework's own migration guide for what changed,
  then shows you the list and stops. On approval it writes version-corrected overrides
  into .clawness/rules/, stamped with the major it actually checked — so when you
  later upgrade again, its own rules go stale and get flagged by the same check. It is
  the only path allowed to author rule files, and nothing automatic can invoke it.
• clawness audit-rules — corpus health for maintainers and fork maintainers.
  Four checks: --stale (rules with no version stamp, an aged one, or a range wider
  than the sources cited for it), --coverage (ranked rules appearing in no eval
  query — currently 48 of 186, so retrieval regressions on them are invisible),
  --overlap (rule pairs competing for the same top-k slot — top pair is
  FA-ASYNC-001 ↔ PY-ASYNC-001 at 0.637; both correct, but in a FastAPI project
  one slot restates the other), and --reachability (rules their own when can't
  retrieve — 0 of 186 today, so this locks in a healthy state rather than finding
  anything). Report-only: these are judgment calls, so nothing fails unless you pass
  --strict. --max-age has no default on purpose — there is no review-cadence data
  to derive one from.
• /clawness:audit-rules — the correctness pass audit-rules can't automate.
  One domain at a time, against current official docs: still true / now wrong / now
  the framework default / unsettled, then it writes the stamp on each rule
  individually. It reports verdicts and never rewrites rule text — a rule silently
  flipped by a hallucination governs every later prompt, which is worse than a stale
  one because it looks reviewed.
• The ten nextjs rules are the first carrying a real stamp, reviewed against the
  Next.js 16.3 docs in August 2026. Seven are confirmed current and stamped through 16;
  three are capped at 15 because 16 genuinely moved under them — NX-IMAGE-001
  (priority deprecated in favour of preload), NX-CACHE-001 (the whole model is now
  Cache Components / use cache) and NX-ACTION-001 (revalidateTag needs a
  cacheLife argument; updateTag is the read-your-writes path). So a Next.js 16
  project gets the note about exactly those three, a 15 project hears nothing, and the
  stale rules keep serving — 80% right beats silence, provided you know to check.
• react and two fastapi rules stamped as well. The four React rules are
  confirmed against the React 19.2 docs (the Compiler note on useCallback does not
  displace the "used as a Hook dependency" case RCT-HOOKS-001 names).
  FA-PYDANTIC-001 is stamped to Pydantic 2 and FA-DBSESSION-001 to SQLAlchemy 2.0,
  the two version-sensitive claims in that domain.
• capacitor and science reviewed too — and two rules were teaching a hazard that
  had reversed. SCI-ARRAY-001 warned that pandas selections are views, so writing
  through one mutates the original. pandas 3.0 (January 2026) made Copy-on-Write the
  only mode: selections always behave as copies, and chained assignment
  (df[df.a > 1]['b'] = 0) now silently does nothing — no error, and the
  SettingWithCopyWarning that used to flag it is gone. The rule now carries both
  eras, plus the 3.0 str dtype change that stops == object catching text columns,
  and is stamped pandas 2-3 / NumPy 2. CAP-WEBVIEW-001 told you to configure the
  Status Bar plugin; on Capacitor 8 Android is edge-to-edge unconditionally,
  setOverlaysWebView(false) and setBackgroundColor() are inert against API 36, and
  the SystemBars API bundled with @capacitor/core is the replacement — stamped to
  8. The other five Capacitor rules are confirmed unchanged across the 7 and 8
  migrations and stamped 7-8.
• Four domains turn out not to be stampable, which is worth knowing. python has no
  join label — WATCHED_LABELS covers frameworks, not the interpreter, so there is
  nothing for a PY-* rule to key on. And FastAPI's own rules are left unstamped
  because it ships 0.x: the effective major is the second component, which moves
  every few weeks, so any ceiling would fire a false alarm almost immediately — the
  precise way users learn to ignore a warning. typescript and css are the other
  two, for the opposite reason: their claims don't have versions. "Enable strict,
  use unknown over any", "?? not ||", "Flexbox for one dimension, Grid for
  two" survived TypeScript 7 and will survive 8, so a ceiling on them buys one
  guaranteed false alarm per major and nothing else. A stamp is only worth writing
  where the major changes the claim.
• Picking up a handoff can now name the session. Until a session has a name,
  Claude Code titles the conversation from your first message — so every handoff
  pickup lands in your history as "carry on", the one phrase they all share and
  therefore the one title that tells none of them apart. The session-start note now
  derives a kebab-case name from the handoff's own heading, and if you pick the
  handoff up Claude offers you the one-liner once (/rename v1.9.0-ready-to-release).
  It's a suggestion you type: a slash command can only come from you, so neither the
  hook nor Claude can retitle a session on your behalf. A heading that names nothing
  — the template's bare # Handoff — <date> — offers nothing rather than a guess,
  and the offer is made only if you actually picked the handoff up, since its heading
  is the wrong name for a session you opened on something else.
• clawness lint validates version stamps. Unknown framework label, unparseable
  range, a future verified date, an applies_to that isn't a mapping, or evidence
  with no range to establish. Every one of these fails silently at runtime — a
  typo'd label like NextJS simply never matches, so the rule looks reviewed and
  behaves exactly like an unreviewed one.

Fixed

• Installing without Python now tells you so, instead of failing quietly. Python
  3.10+ has always been a prerequisite, but if it wasn't on your PATH the hooks exited
  1 with nothing on stderr — Claude Code reported a hook error with no reason, on
  every session start, every prompt and every gated tool call. Meanwhile the plan gate
  and access guard were inert, the dependency bootstrap never ran so there was no
  bootstrap.log to check, and the skills and agents kept working, so the plugin
  looked half-alive. Hook commands now exit 0 when no interpreter is found, and one
  session-start hook explains what's missing and points at the README. Note this
  can't help if a Windows Store python.exe stub is on your PATH — uninstall the
  stub or install real Python from python.org.
• .clawness/rules/ actually overrides global rules now. A project rule sharing
  an id with a global one used to be appended: both copies entered the corpus and
  competed on lexical score, so the rule you wrote to override a stale one could
  simply lose to it — no error, no warning, no effect. An incoming ranked rule now
  replaces the existing one with that id. Mandatory rules are still appended rather
  than replaced, deliberately: .clawness/rules/ is project-local content, so a
  cloned repo must not be able to silently remove an always-on security rule.