From 2a606053ddc6d120f52f6b685aa522c608e9a6e7 Mon Sep 17 00:00:00 2001
From: warren <typebasedio@pm.me>
Date: Mon, 6 Apr 2026 16:09:29 -0400
Subject: [PATCH] docs: anti-guessing guardrails in project CLAUDE.md and
 seeded workspace template

Add "Repository and Package Identity" rule to both the project-level CLAUDE.md
and the seeded CLAUDE.md template (internal/seed/templates.go). Every new ctask
workspace now inherits guidance against fabricating repo URLs, module paths,
GitHub identities, or remote install commands.

Also adds local-only build/install instructions and data safety invariant
documentation to the project-level CLAUDE.md.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 CLAUDE.md                  | 51 ++++++++++++++++++++++++++++++++++++++
 internal/seed/templates.go |  4 +++
 2 files changed, 55 insertions(+)
 create mode 100644 CLAUDE.md

diff --git a/CLAUDE.md b/CLAUDE.md
new file mode 100644
index 0000000..8c11292
--- /dev/null
+++ b/CLAUDE.md
@@ -0,0 +1,51 @@
+# ctask Project Guidelines
+
+## Build and Install
+
+This project is a local-only Go CLI. It is not published to any package registry or remote repository.
+
+### Local build
+
+```
+cd C:\Users\Warren\claude_tasks\ctask_v0.1
+go build -o ctask.exe .
+```
+
+### Local install (copies to GOPATH/bin)
+
+```
+cd C:\Users\Warren\claude_tasks\ctask_v0.1
+go install .
+```
+
+Binary output: `C:\Users\Warren\go\bin\ctask.exe`
+
+### Remote install
+
+Not available. There is no git remote configured and the module path in `go.mod` is a local placeholder. Do not provide `go install <module>@latest` commands or any remote install instructions.
+
+## Repository and Package Identity
+
+Never invent remote repository, package, or module identities. Do not guess GitHub usernames/orgs, repo URLs, Go module paths, release install commands, or package manager coordinates. Only provide remote clone/install/publish commands if they are verified from the actual repo config (e.g. `go.mod`, `git remote -v`) or explicitly provided by the user. If publishing/release details are not configured, say so plainly and provide local-only build/install commands instead.
+
+### Bad vs Good
+
+Bad: `go install github.com/someone/ctask@latest`
+Bad: `git clone https://github.com/someone/ctask.git`
+
+Good: `cd C:\Users\Warren\claude_tasks\ctask_v0.1 && go install .`
+Good: "This project is not published remotely. Build locally with `go install .`"
+
+## Testing
+
+```
+go test ./... -v -count=1
+```
+
+## Data Safety
+
+The `ctask delete` command has active-workspace protection:
+1. Checks `CTASK_WORKSPACE` env var (catches same-session attempts)
+2. Checks for `.ctask/manifest-start.json` (catches cross-terminal attempts)
+
+Both checks run before any mutation. Any changes to the delete path must preserve this "refuse before mutate" invariant.
diff --git a/internal/seed/templates.go b/internal/seed/templates.go
index 0faa8a5..609e678 100644
--- a/internal/seed/templates.go
+++ b/internal/seed/templates.go
@@ -33,6 +33,10 @@ Before ending a session, append a brief summary to notes.md with:
 - How to continue from here
 
 Keep it concise -- a few bullet points is enough. This helps the developer (or a future session) resume without losing context.
+
+## Repository and Package Identity
+
+Never invent remote repository, package, or module identities. Do not guess GitHub usernames/orgs, repo URLs, Go module paths, release install commands, or package manager coordinates. Only provide remote clone/install/publish commands if they are verified from the actual repo config (e.g. go.mod, git remote -v) or explicitly provided by the user. If publishing/release details are not configured, say so plainly and provide local-only build/install commands instead.
 `, slug, category, workspacePath)
 }