gleaninlisted

# gleanin Rules from past failures. Apply every session. <!-- Rules are auto-generated by sync.sh. Do not edit manually. --> ### Credentialed Write Gate **Rule:** 1. Before writing with ambient credentials, verify scope (`<tool> whoami`, `config view`). 2. Exact-match created resource name against intent. 3. On mismatch, roll back immediately. 4. Never mark done when acceptance probe failed. **Check:** `grep -c "inoffensif\|harmless\|can delete\|not needed"` in session transcript — zero for any failed write. ### Delegation Preflight **Rule:** 1. Scan delegation payload against delegate's Known Limitations first. 2. Verify with `git diff`, not the delegate's `[OK]` lines. 3. On partial landing, name the limitation before hand-editing. 4. Structural integrity check every delegate-touched file. **Check:** `git diff --stat HEAD` after delegation — changed file count must match expected. ### Device First Check **Rule:** 1. Search filesystem (`find`, `grep`, `ls`) before asking the user. 2. `curl -sI` before declaring anything "not deployed." 3. Syntax check + tail check before committing. **Check:** `grep -c "AskUserQuestion\|curl.*not.find\|edit.*then.*ask"` in session transcript — near zero with this rule. ### Reference First Porting **Rule:** 1. Read the reference before editing any formula or algorithm. 2. Cite `file:line` per edit. 3. Apply supplied values verbatim before re-derivation. **Check:** `grep -rn "TODO\|FIXME\|guess\|maybe" <target-file>` — zero after