[NSchatz]

Adds this repo's first CLAUDE.md: a 59-line card (wc -l < CLAUDE.md prints 59) that an agent session reads first. It has four parts, in this order:

1. What the repo is, in two sentences.
2. The gate: the verify job's steps in ci.yml order, plus actionlint, with three notes for running them outside CI.
3. The hazard: a change to the PHI-scan engine or the parser template can turn PHI detection off wherever they run, and no other repo's CI goes red.
4. Rules: only rules a past failure proved, each with the PR behind it.

Nothing else changes. No other file linked to a section of a root CLAUDE.md, because there was none. No changeset: CLAUDE.md is in no package's files.

Every command the card names, and how it was checked (checked, not run)

Command or path in the card	Kind	Check
node scripts/changeset-guard.mjs	file	git ls-files scripts/changeset-guard.mjs: 1 file
node scripts/release-notes.mjs prepare --repo . --out "$RUNNER_TEMP/release-notes"	file	git ls-files scripts/release-notes.mjs: 1 file
node scripts/credential-surface.mjs	file	git ls-files: 1 file
node scripts/install-hardening.mjs	file	git ls-files: 1 file
node scripts/readme-check.mjs	file	git ls-files: 1 file
node scripts/drift-check.js	file	git ls-files: 1 file
node	binary	command -v node: /usr/local/bin/node. CI installs it with actions/setup-node
pnpm install --frozen-lockfile	pnpm built-in	command -v pnpm. CI installs pnpm with pnpm/action-setup
pnpm check:no-emdash, pnpm format:check, pnpm typecheck, pnpm lint, pnpm test, pnpm build, pnpm attw	package.json scripts	each one is in jq -r '.scripts | keys[]' package.json
actionlint	binary	command -v actionlint finds it on PATH. CI installs it through reviewdog/action-actionlint
git add, git ls-files	binary	command -v git
drift-manifest.json, packages/script-utils/phi-scan.js, packages/script-utils/CHANGELOG.md, documentation/decisions/0003-the-phi-scan-engine-gap-settlements.md, .github/workflows/no-emdash.yml	files	git ls-files <path>: 1 file each
scripts/parser-template/	directory	git ls-files scripts/parser-template: 36 files
test/*scaffold*.test.ts	files	git ls-files 'test/*scaffold*.test.ts': 4 files
the release-dry-run job, fetch-depth: 0, persist-credentials: false	workflow keys	present in .github/workflows/ci.yml and in all three jobs of release.yml

Where each rule comes from

• Changesets: (An empty changeset silently withholds the publish #41). An empty changeset withheld a release on a green run.
• prepublishOnly: (Stop prepublishOnly running a tool that packs #40). attw there broke every version bump.
• npm_config_* inheritance: (fix(attw): the gate's nested npm pack no longer inherits a dry run (CONFIG-PREPUBLISH-ATTW-ENOENT) #47). A dry run reached a nested npm pack.
• Exit 2 when a gate cannot read its input, and testing through the CLI exit code: (fix(attw): the publish gate exits 0 on an untyped pack, in both manifests #42) and (fix(scripts): compare entry points as paths, not strings (ENTRYPOINT-STRING-COMPARE) #48). Gates exited 0 on a defect, and also without having run.
• Template coverage in the root suites: (fix(template): close both re-minted gate holes at the source (TEMPLATE-REMINTS-BOTH-GATES) #43) and (fix(scaffold): format the tree the generator emits, so a new parser is not born red (CONFIG-SCAFFOLD-BORN-UNFORMATTED) #57). The template's own test/ never runs here, and new parsers were born red.
• fetch-depth: 0 and persist-credentials: false: (fix(release): close the three ways this repo's releases lied about themselves #45).
• Run the gate after git add: (fix(format): point format:check at .mjs, which it had never once read (CONFIG-FORMAT-CHECK-SKIPS-MJS) #56). The em-dash gate read a new file it had never been handed.
• Hazard bullets: (S0359-config-phi-scan-per-root-walk-only: answer the per-root observation rule from the walk's reads only #114), the per-root rule printing OK: no hits. ADR 0003, for recording a change that narrows refusals. The 0.1.0 entry in packages/script-utils/CHANGELOG.md, "a finding names a position".

Some rules found in the CHANGELOG were left out: ones a gate already enforces mechanically (install hardening, the em-dash file gate), and the hand-promotion of package [Unreleased] sections, which today's package changelogs do not show being followed.

Gate

The full verify sequence plus actionlint was run locally on this branch with the card staged. Every step exits 0, and the tests pass: 1076 at the root, 50 in script-utils, 225 in process and 195 in test-utils. Two local quirks are written into the card's gate notes:

• pnpm on PATH: a bare pnpm newer than 10.34.5 fails pnpm typecheck (ERR_PNPM_BAD_PM_VERSION) and one pax case in packages/test-utils/test/attw-gate.test.ts. That happens even on unchanged main. With pnpm 10.34.5 first on PATH, both pass.
• drift-check.js: from a checkout whose directory is not named config, it exits 2, "nothing was graded". Run from a copy at <dir>/config/, it exits 0.

Follow-up, not in this PR

drift-manifest.json's configSubject.exemptions entry for agentDoc.agentDoc gives as its reason that config "carries no CLAUDE.md or AGENTS.md today". That stops being true once this merges. Deleting the entry would grade this card against the package baseline's five required headings, which a short card does not carry. Whether to drop the exemption or reword its reason is a separate change.

Harness-Task: 67

🤖 Generated with Claude Code