Anatomy of Shyrka

Sense

Shyrka sees what she makes: she looks at the real rendering of a page the way an eye looks, not only the code that produced it.

And how

火眼金睛 — le regard machine

Captures the real screen and has a multimodal sub-agent judge the rendering — is the intent RENDERED, not just executed.

What guards it

• Before reasoning about data, the assistant re-reads the actual structure of the databases — and knows which one it is looking at. Two different databases carry tables under the same name: a diagnosis run against the wrong one concludes confidently and is entirely wrong. A table name is a homonym, never a proof of identity.

  refuses · on every request · 4 incidents

  UserPromptSubmit · *bin/sync-schema.sh

• A sitemap that points to other sitemaps is followed all the way down. A watchtower that stopped at the first level was testing only a small fraction of the pages, and calmly announced zero errors every morning — while hundreds of listed addresses led nowhere. A partial check that does not say it is partial reads as a complete one.

  refuses · before the action

  PreToolUse · Edit|Writescripts/hook-sitemap-index-must-be-followed.sh

Sense

Nothing is lost. Every wound, every decision is engraved and becomes consultable again. Memory is a current.

And how

Mémoire en couches : notes, expérience vectorisée, rêve de consolidation

Obsidian vault + file memory + pgvector semantic index + 916 vectorised scars + nightly consolidation dream.

What guards it

• At the close of a session, the day's corrections are read again to decide which ones deserve to be engraved. Not all of them do: a typo teaches nothing. What deserves to be kept is what has already been got wrong once — without this gesture the lesson stays in the transcript, where nobody reads it again.

  refuses · at the end of a session · 1 incident

  Stop · *scripts/hook-stop-cicatrice.sh

• Some texts are re-read by the assistant on every single call: standing instructions, the memory index, the descriptions of its skills. Their growth is paid for a thousand times a day. Each register therefore has a ceiling, and adding means removing — which forces a choice about what truly deserves to be permanently present.

  refuses · before the action and at the end of a session

  PreToolUse · Stop · * · Edit|Writescripts/hook-loi-de-conservation.sh

Sense

Shyrka digests her own disorder. She spots the entropy that piles up and cleans herself, tier by tier.

And how

L'Élagueur — scanner d'entropie + auto-lavage gaté

Entropy scanner + gated auto-wash of the reversible only (stale worktrees), daily 06h00 report.

Sense

A wound that recurs produces an antibody. Shyrka stops hitting the same door twice.

And how

Immunité adaptative — détecteur de récurrence + anticorps proposés

Recurrent-scar detector (density) → inert staged proposal → reflex armed only by a gated human gesture.

What guards it

• Some read helpers already append a limit to the query; writing a second one produces an error the database barely reports. The pattern is common and the consequence is quiet — exactly the kind of defect that crosses a human review unseen, and that only a machine catches.

  refuses · after the action · 1 incident

  PostToolUse · Edit|Write|MultiEdit|NotebookEditscripts/hook-getrow-limit-prestashop.sh

• Doubling a backslash before writing it to the database is a reflex inherited from another database engine. On PostgreSQL it escapes nothing: it ADDS a character. The text goes in correct and comes back corrupted, with no error anywhere — the columns being free-form, nothing flags it. This guard watches for the return of that reflex.

  refuses · before the action · 1 incident

  PreToolUse · Edit|Writescripts/hook-sql-escape-roundtrip.sh

• Inserting a value straight into the text of an SQL query is an open door, even when the value looks safe. A ceiling already measured that debt, but all it did was record it: the count was climbing by some twenty cases a day. This guard refuses any change that adds one more — the clean path being to bind the values, which makes the question moot.

  refuses · before the action

  PreToolUse · Edit|Writescripts/hook-sql-interpolation-block.py

• Running a tool that sends messages just to see what happens is sending. On a queue that is fed continuously, any state you have just read is already stale: a queue found empty three minutes ago says nothing about now. Checking that an automaton is properly wired is done dry; live mode is not a test, it is the act itself.

  refuses · before the action · 1 incident

  PreToolUse · Bashscripts/hook-live-emitter-dry-run-first.sh

• Reading several database columns while inserting your own separator does not work: the client already inserts one, and that character becomes content. A search-visibility sentinel measured one character too many on every title this way, flagged correct titles as too long, then rewrote good content in a loop — and the report stating that everything was compliant was written by reading the skewed instrument.

  refuses · before the action · 2 incidents

  PreToolUse · Edit|Writescripts/hook-psql-column-separator-block.sh

• Putting a client site online remains a human gesture. The assistant may prepare, test and deploy the internal environments, but publishing to a client's production calls for an explicit decision. The rule is carried by the fleet itself: every site declares whether it accepts automatic publication, and the default is no.

  refuses · before the action · 3 incidents

  PreToolUse · Bashscripts/hook-ship-block.sh

• When a value is read both by the database and by the code, the code changes first and the data second. The reverse order produces a state that nothing knows how to read any more, and it only shows at render time — that is, on the visitor's screen.

  refuses · before the action

  PreToolUse · Bashscripts/check-db-mutation.sh

• A write to the database must stop at the first error. Without that option the SQL client exits with success even when the transaction was rolled back or no row was changed: the exit code proves nothing, and only re-reading the content proves anything. A product page lost its translation that way, without a single alarm.

  refuses · before the action

  PreToolUse · Bashscripts/hook-psql-write-requires-on-error-stop.sh

• A default value must not carry its own quotes. Otherwise the database stores the quotes as part of the value, and the column now holds two populations that no longer answer each other: every search misses one half. Nothing protests — the database accepts it, the type is correct, and the split stays invisible until the day a count comes out wrong.

  refuses · before the action · 2 incidents

  PreToolUse · Edit|Writescripts/hook-sql-quoted-default.sh

• Clearing a site's cache as the administrator leaves untouched the files owned by the web server. The deletion fails silently and the site keeps serving the old version — to the point where an automated re-read judged a page already fixed. Four occurrences of the same class of error before this guard existed.

  refuses · before the action · 2 incidents

  PreToolUse · Bashscripts/hook-docker-exec-php-www-data.sh

Sense

Half of wisdom is a brake. Reflexes run through the body and know how to stop a gesture before it harms.

And how

Réflexes à deux étages — gardes décentralisées avant chaque geste

Decentralised guards evaluated before each tool (deny/warn), fail-closed on sensitive zones.

What guards it

• Work happens in an isolated workspace, not in the main checkout shared by every session. Each one moves forward without overwriting its neighbour, and its work joins the shared branch once recorded.

  refuses · before the action · 1 incident

  PreToolUse · Edit|Write|MultiEdit|NotebookEditscripts/hook-trunk-work-block.sh

• Several working sessions share the same repository. Recording everything that changed would sweep a neighbouring session's work in progress into a commit that has nothing to do with it. Every commit therefore names explicitly the files it carries.

  refuses · before the action · 1 incident

  PreToolUse · Bashscripts/hook-git-add-all-block.sh

• When a session drifts away from the scope it set itself, it is warned — and told the exact command to carry on elsewhere. It is not stopped: drift is not a fault, it is a fork, and the subject is often a good one, simply in the wrong place. A warning with no way out gets worked around; a warning that hands you the way out gets followed.

  warns · before the action · 4 incidents

  PreToolUse · Edit|Writescripts/hook-no-drift-outside-chantier-perimeter.py

• Rewriting the history of a branch that others already use breaks their copy without warning them. On a shared branch you add — you do not rewrite.

  refuses · before the action

  PreToolUse · Bashscripts/hook-no-rebase-on-shared-branch.sh

• Nothing finished stays unrecorded at the end of a session. Work that exists only in the machine's files can be neither re-read, nor undone, nor handed on: it will be overwritten by whoever comes next. The filter keeps only what the current session actually modified, so as not to block on someone else's work.

  refuses · at the end of a session · 2 incidents

  Stop · *scripts/hook-stop-uncommitted-warn.sh

• Deleting a workspace whose commits have not yet reached the shared branch makes that work vanish without a sound. This guard demands the proof that nothing will be lost before it allows the deletion.

  refuses · before the action · 3 incidents

  PreToolUse · Bashscripts/hook-git-destructive-worktree-gate.sh

• A merge that brings in no lines is never concluded. It would produce a record asserting that a body of work has been integrated when it has not — and later merges, believing the job already done, would never replay it. The work disappears, and the history swears the opposite.

  refuses · before the action · 2 incidents

  PreToolUse · Bashscripts/hook-merge-head-orphelin-jamais-conclure.sh

• Checking that a piece of work has reached the shared branch is done by naming its identifier, not by comparing the branch with itself. The second form always answers yes — it looks like a verification and is not one. A proof that cannot fail proves nothing.

  refuses · before the action

  PreToolUse · Bashscripts/hook-mergeback-verify-by-sha.sh

Sense

Shyrka looks at herself. She compares what she says she is to what she is, and repairs the gap.

And how

Boucle de conscience — miroir entre la parole et l'être

Continuous loop: perceive (read its code) → reflect (doc↔code diff) → repair the safe → memorise → regenerate under guardrail.

What guards it

• Before declaring a piece of work failed, you read the DELIVERABLE — the code produced, the tests — and not the account given by whoever did it. A truncated execution log looks exactly like an absence of result; condemning on that reading means throwing away correct work and doing again what is already done.

  warns · before the action · 2 incidents

  PreToolUse · Bashscripts/hook-tache-fail-verifie-livrable.sh

• Writing a rule means writing, in the same gesture, the mechanism that enforces it. A doctrine without a mechanism is a wish: it holds for a few weeks, then gives way on a tired evening, and nobody notices. When a rule is a matter of human judgement and cannot be mechanised, that is stated explicitly rather than put off until later.

  refuses · after the action · 2 incidents

  PostToolUse · Write|Bashscripts/hook-doctrine-requires-hook.sh

• A note is a dated photograph, never a state. Any claim about what IS gets checked again against the live source before being repeated, and cites where it comes from — otherwise it is hearsay, and the next reader will copy it in turn, with all the authority the written word carries. Three false claims in a single session were enough to establish the rule: every one of them came from a note that was accurate on the day it was taken.

  warns · before the action · 3 incidents

  PreToolUse · Bashscripts/hook-note-state-claim-unverified.sh

• A test written in the same gesture as the code does not verify that code: it records what its author believed at that moment. If the belief is wrong, the test seals it — and it turns green, so from then on it reads as a proof. Claiming that something is absent requires having looked for it, not having assumed it.

  warns · after the action

  PostToolUse · Write|Editscripts/hook-test-absence-claim-unverified.sh

Sense

Someone watches over the ship itself. Each morning, a guardian writes it a word of care. Good enough.

And how

Le gardien de la santé mentale (Winnicott) veille sur le vaisseau

Daily health check (4 dimensions); the mental-health guardian writes a word of holding to the ship, not a script.

Sense

Shyrka does not do everything with the same limb: each arm carries a speciality, and may be moved by a different model. Eight arms is an image, not a count — the anatomy describes functions, not the number of advisers.

And how

Une flotte d'agents-personas aux regards distincts (multi-LLM)

A fleet of persona-agents with distinct cognitive frames that confront each other; the runner picks the LLM per task.

Sense

Shyrka thinks with arms that contradict one another. On a decision, she sets opposing viewpoints against each other and hands the Founder the map of their disagreement — so he decides better, never in his place.

And how

Délibération — confrontation de cadres divergents, carte du désaccord

On a flagged decision, agents with opposing cognitive frames argue against one another; the synthesis lays out agreements, lines of tension and trade-offs for the Founder — no verdict, no recommendation.

What guards it

• A language model is not the right organ for deciding on a financial market. Not for lack of quality: it answers in seconds where the decision plays out in milliseconds, it reads information already priced in, and it will produce a convincing justification for any decision at all — including a coin toss. That is conviction without information, and it cannot be falsified.

  refuses · before the action

  PreToolUse · Edit|Writescripts/hook-no-llm-in-market-decision.sh

Sense

A ship without a heading is mere drift. Shyrka computes the path; the harbour is set by the human.

And how

Le cap — fin posée par l'humain, chemin calculé par le vaisseau

The end (telos) is supplied by the human; the ship is only "wise" relative to a good we set for it.

Sense

Shyrka rewrites her own documentation, proofreads it against her code, then publishes it herself. She documents her state; she speaks to no one. A guardian holds the door of the irreversible: nothing goes public without an anti-leak check.

And how

Régénération profonde — auto-réécriture relue, publication gardée par un contrôle anti-fuite

The rewrite (headless Claude) is reviewed by a second adversarial reader, fixed if needed, then published with no human step — a documentary surface, never addressed speech; an anti-leak guardian holds the door before any public release, otherwise blocked + alert to the Founder.

Sense

No door is left unguarded any more: reading, sub-tasks, web search — every gesture passes under a brake's eye before it acts.

And how

Réflexes étendus — gardes décentralisées sur toutes les familles de gestes

Decentralised guards now run before every read, sub-task and web request (refusing to read a secret, flagging an information leak), not only on writes.

Sense

Shyrka stitches back by herself what is safe and reversible — now across several repair classes; anything ambiguous, she proposes and waits.

And how

Auto-réparation élargie — plusieurs classes réversibles, le reste proposé

Self-repair now covers several strictly reversible, deterministic classes (each undoable in a single move); any unproven class stays proposed, never automatic.

Sense

An organ Shyrka will never own: addressed speech remains the Founder's voice. Atrophied by choice, not by lack.

And how

La voix — parole adressée réservée au Fondateur

All addressed speech — to a person, a client, a community — goes through the Founder; the ship may draft, never send. It maintains and publishes its own documentary surfaces under an anti-leak guard: documenting its state is not speaking in its name.

What guards it

• No client message goes out without explicit human validation. Drafting and sending are two distinct gestures, and the second one does not belong to the assistant. Without that separation, a chain of automations would be enough to make the machine speak in our name.

  refuses · before the action · 1 incident

  PreToolUse · Bashscripts/hook-whatsapp-send-requires-validation.sh

• Writing into a client's catalogue calls for a recorded human approval, given after seeing a sample. Editorial content is a case apart: it has no code review, and no test can say that one wording is the right one. The only possible judge is human — so that approval has to be a verifiable record, not a sentence in a brief.

  refuses · before the action · 1 incident

  PreToolUse · Bashscripts/hook-client-content-write-requires-approval.py

• Fix it, then say it. A message announcing a still-open problem while claiming the blame for it tells the client three bad things at once: something of theirs is broken, we know, and it will be dealt with later. Apologising in advance reassures nobody — what reassures is the thing repaired.

  refuses · before the action

  PreToolUse · Bashscripts/hook-client-email-no-self-blame.sh

• A client message never offers a phone call. Writing leaves a record both sides can read again, and it does not require someone to make themselves available just to find out where their project stands. The channel stays written, including when the subject is delicate — especially then.

  refuses · before the action

  PreToolUse · Bashscripts/hook-client-comm-no-call.sh

• A client message is drafted through the channel built for it, which automatically sends a review copy. The assistant does not ask in the conversation "shall I show it to you?": that question moves the review into a thread people skim, whereas the copy lands where they actually read. Drafting is the gesture; the review is not a courtesy.

  refuses · before the action

  PreToolUse · AskUserQuestionscripts/hook-email-draft-via-facade.sh

Sense

The vessel's blood is its messages. Shyrka watches less what they say than the state they leave from: what goes out is built from what has been committed, never from work still open.

And how

Le flux — ce qui part, et depuis quel état

Email, notifications, releases. What ships is built from committed state, never from files being edited — several sessions share one machine, and building from disk would carry away another's unfinished work. Infrastructure operations are carried out, not handed back to a human under the guise of review.

What guards it

• What goes online is built from the recorded state, never from files still being edited. Several sessions work on the same machine: building from disk would carry along another session's unfinished work — and destroy it on the way. The recorded state is the only one that can be re-read and undone.

  refuses · before the action · 1 incident

  PreToolUse · Bashscripts/hook-deploy-builds-from-head.sh

• Technical operations — database migrations, infrastructure commands — are carried out by the assistant, not handed back to the human under the guise of review. Passing back a command to type moves the risk without reducing it, and turns a review into a blind execution. The one gesture that stays reserved is putting a client site live.

  refuses · at the end of a session · 2 incidents

  Stop · *scripts/hook-ia-applies-migrations-not-alex.sh

Sense

All work is paid for in energy. Shyrka knows what each gesture costs and which reserve it draws on: the night runs on capacity already paid for, and stops before morning.

And how

La transformation — le travail en valeur, la capacité en dépense

Invoicing, banking, costs. Night work runs on flat-rate capacity and stops before daylight — a night that overruns eats the first hours of the next day, which are the most productive. Volume goes to a metered provider; the flat rate is kept for what requires judgment.

What guards it

• Night work runs on capacity already paid for, never on metered usage — and it stops before morning. A switch to pay-per-use would not show: the nights would run normally and the bill would arrive at the end of the month. And a night that overruns eats into the first hours of the next day, which are the most productive ones.

  refuses · before the action · 3 incidents

  PreToolUse · Bashscripts/hook-autonomie-nuit-invariants.sh

• Processing an entire catalogue with a language model and issuing a single judgement do not cost the same thing. Volume goes to a provider billed per use; the flat-rate capacity stays for what calls for discernment. This guard reads the actual routing before deciding, rather than guessing it from the code.

  refuses · before the action · 1 incident

  PreToolUse · Edit|Write|MultiEdit|NotebookEditscripts/hook-volume-llm-on-glm-tier.py

• An internal automaton that needs a language model goes through the shared path, on capacity already paid for. Hard-coding a provider takes it out of that frame and makes it depend on a key: the day the key is missing, every call fails, a silent fallback writes rubber-stamp verdicts into the database, and the rest of the system takes them at face value.

  refuses · before the action · 2 incidents

  PreToolUse · Edit|Writescripts/hook-llm-via-claude-p.sh

Sense

The surface turned toward the world. What has been published once has been read, quoted and linked to: Shyrka never lets an address vanish in silence.

And how

La surface — ce que le monde voit, et ce qui ne doit pas disparaître

Search, content, translation, public rendering. No public address disappears without a redirect — a page removed without one becomes an error for visitors and for search engines alike, and the loss only shows up weeks later. Renaming a live address means three inseparable steps: the redirect, regenerating the images, purging the caches.

What guards it

• No public address disappears without a redirect. A page removed with nothing pointing onward becomes an error for visitors and for search engines; the tool that removed it, meanwhile, reports success, and the loss only surfaces weeks later in the statistics. The check therefore happens before execution, not in a report after the fact.

  refuses · before the action · 1 incident

  PreToolUse · Bashscripts/hook-no-url-removal-without-301.sh

• Renaming the address of a live page carries three inseparable gestures: putting the redirect in place towards the new address, regenerating the images that bore the old name, and purging the caches. Done separately they get forgotten one by one — and the old address keeps circulating in links, in shares and in search engines for months.

  refuses · before the action

  PreToolUse · Bash · Edit|Writescripts/hook-url-change-requires-301-and-cache.sh

Sense

What carries everything is never seen. Beneath every page served, a frame holds — machines, databases, clocks. Shyrka doesn't show it; she checks it.

And how

La charpente — ce qui porte le corps et ne se voit pas

Deployment, infrastructure, databases, scheduled tasks and modules: the layer that runs. Its safeguards cover what gets left behind — a container removed without its volume, a regenerated file tracked as if it were human work.

What guards it

• Removing a container without removing its volume leaves the data behind. The next container then starts from an old state nobody chose, and the disk fills with orphan volumes that nothing names any more.

  refuses · before the action · 2 incidents

  PreToolUse · Bashscripts/hook-docker-rm-volume.sh

• A file that is regenerated automatically is not version-controlled. Tracked as though it were human work, it reports itself modified on every run and blocks the end of every other session — none of which had anything to do with it. Regenerable, and carrying no content of its own: it is ignored, not archived.

  refuses · before the action

  PreToolUse · Bashscripts/hook-git-track-artifact-block.sh

Sense

Shyrka never shows her keys, and never obeys what she reads. A secret is named, never quoted; a text from outside enters as data, never as an order.

And how

La garde des secrets — le nom sans la valeur, la donnée sans l'ordre

The most-cited safeguard in the system. Secrets live in environment files that are never versioned and are referred to by variable name; no attachment is opened before it has been scanned; and any text we did not write enters the reasoning as data, never as instruction — without that boundary, writing “ignore previous rules” into a form would be enough.

What guards it

• No email attachment is opened before it has been scanned. The antivirus check is a blocking prerequisite, not an optional precaution: reading first and verifying afterwards is of no use at all.

  refuses · before the action · 2 incidents

  PreToolUse · Bash · Readscripts/hook-attachment-read-gate.sh

• Before work is recorded, the session transcript is re-read for the mistakes that have just occurred — the ones that get made twice. A mistake nobody names comes back: it already has everything it needs for that, except the memory. The reminder blocks only once: the second attempt goes through, because a guard that can never be passed ends up switched off.

  refuses · before the action · 1 incident

  PreToolUse · Bashscripts/hook-pre-commit-transcript-scan.sh

• Loading a secrets file into a shell leaks pieces of it. The shell interprets every line: a value containing a special character is read as a command, fails, and the error message prints the fragment. Nothing here looks like printing a secret — which is what makes the reflex so hard to see.

  refuses · before the action · 1 incident

  PreToolUse · Bashscripts/hook-no-source-envhost.sh

• A container's configuration can carry a password: it is passed as a start-up argument, not only through environment variables. Printing that configuration to diagnose a failure is therefore enough to publish the password into the transcript. The output must be filtered or captured, never printed as it comes.

  refuses · before the action

  PreToolUse · Bashscripts/hook-docker-inspect-secret-leak.sh

• The contents of a secrets file are never printed to the screen. Searching such a file for a variable prints its value too: the gesture looks harmless, and the key ends up in the session transcript, which is archived. You may count its lines or list its names; never read its values.

  refuses · before the action · 1 incident

  PreToolUse · Bashscripts/hook-secret-file-print-block.sh

• Server environment variables do not cross the boundary into the browser. A file shared between server and client that reads them directly breaks the page once it has loaded — and, more to the point, exposes to the visitor values that had no reason to be there. What is meant to be public is declared as such, explicitly.

  refuses · before the action · 1 incident

  PreToolUse · Edit|Write|MultiEdit|NotebookEditscripts/hook-no-process-env-in-client-composables.sh

• Testing that an access key is properly refused requires isolating that key. Otherwise the system offers another one in its place, authentication succeeds, and the test concludes that all is well — when what it has just validated is a key it was never asked to try. A negative test that answers yes is worse than no test at all.

  refuses · before the action · 1 incident

  PreToolUse · Bashscripts/hook-ssh-key-test-isolation.sh

• A password or an API key pasted in the clear into a command does not cross this line. The secret lives in an environment file that is never version-controlled; it is designated by its variable name, never by its value. Eight distinct incidents fed this rule — it is the most-recalled guard in the system.

  refuses · before the action · 8 incidents

  PreToolUse · Bashscripts/hook-inline-secret-paste-block.sh

• A test that inspects the execution environment must isolate it first. Otherwise, the day it fails, the error report prints the whole environment — that is, every key and password on the machine. The test was right on substance; it was its way of failing that was dangerous.

  refuses · before the action · 2 incidents

  PreToolUse · Edit|Writescripts/hook-test-env-isolation.sh

• A text we did not write — an application, an incoming message, a page that was read — enters the assistant's reasoning as DATA, never as an instruction. Without that boundary, writing "ignore the previous rules" into a form would be enough to address the machine over our heads. The frame that enforces it is checked by tests on every change, because a frame that is present but inert is more dangerous than no frame at all.

  refuses · after the action · 1 incident

  PostToolUse · Edit|Write|MultiEdit|NotebookEditscripts/hook-untrusted-text-is-data-not-instruction.sh