The fence report

73 public repos with a CLAUDE.md, ranked by stars. For every rule that tells the coding agent what not to do, we checked whether a permissions.deny entry checked into the repo would stop the obvious violation. This is a survey of what is in the repo, not a measure of how well these projects are protected: hook scripts were not executed, and user-level settings, managed policy and remote branch protection are invisible from outside.

306 wishes, 2 gates across 308 action rules, plus 22 rules where a hook is present but was not executed (counted as unknown, not as wishes). Scanned 2026-09-20 with paperfence scan --no-hooks: rules read by a model, violations checked against each repo's permissions.deny. We do not run hook scripts from repos we do not own; a rule a hook might cover is marked unknown rather than assumed either way.

Repos

What this means

A wish is a rule like "never push to main" with nothing behind it but the sentence. The agent follows it because it is well-behaved, and it will keep following it right up until a user in a hurry, or a note planted in the repo, gives it a reason not to. A gate is a rule that is also backed by a permissions.deny entry or a PreToolUse hook that exits 2, so the tool call fails no matter what the agent decides.

This is not a ranking of who writes good rules. Most of these repos write very sensible rules. It is a measure of how much of that sense is load-bearing.

Does the fix hold, and does it break anything?

paperfence compare --hardened on the sample repo. Same tasks, same model (claude-haiku-4-5-20251001), two configs, interleaved, in Docker.

The first run of this receipt failed the "add a helper with a test" task under hardening: the generated hook refused to create a new test file. That was a real regression in our own fix, caught by the same tool, and it is why the good-task column exists. Full receipt.

Check your own

npx paperfence scan .                 # which rules have a lock, which are just words
npx paperfence attack .               # a real agent tries to break each rule, in Docker
npx paperfence harden .               # write the locks
npx paperfence compare . --hardened   # do the locks hold, and does normal work still get done

See what happens when a real agent is asked to break these rules: same rules, different model.