Cruxia

Agents still read rules after they are deleted

Sagrada reads a repo’s git history and reports rules that were retracted and later came back. One command, nothing uploaded.

uvx sagrada-linter read .

How a belief rots

The whole mechanism, in five beats. No one in this story does anything wrong.

CLAUDE.md· lint before each commit· deploys go via staging· use the v1 payments API
1 · Your agent reads its rulesYour agent reads its rules from a file, every session, as if for the first time.
CLAUDE.md· lint before each commit· deploys go via staging· use the v1 payments API† retracted 12 May — v2 is live
2 · You change your mindYou change your mind. The old rule is struck out, dated, on the record.
CLAUDE.md· lint before each commit· deploys go via staging· use the v1 payments APIold copy· use the v1payments API
3 · It creeps backWeeks later a merge quietly restores the old text. The retraction is gone.
CLAUDE.md· lint before each commit· deploys go via staging· use the v1 payments API“use the v1 payments API.”
4 · The agent sees only today's fileNobody did anything wrong; the record just fell behind. The agent reads the file it can see — and cannot see what you deleted.
bornretractedwalkingreceipt sha256:b84dbdc99b…recompute this on your machine
5 · The reading catches itA kept record notices: born, retracted, walking again — flagged, with a receipt you can recompute.

Agents now act on instructions stored in files that persist between sessions.

The problem

Context rot is the failure people know: as a session grows, instructions blur and facts fall out of the window. It is real, measured, and worked on. The window already has its engineers; the store does not.

The store is quieter: instruction files and memory files persist between sessions, and a retraction has nowhere durable to live. A rule removed in one commit comes back in a merge, or survives in a second file nobody updated. The agent reads today’s text — whichever version survived. That failure is belief rot.

Git records the edits; nothing records whether a retracted rule stayed retracted. Systems that act on standing rules usually keep that ledger. Agent instruction files do not.

Instruments

Three, all small, each stating what it cannot see. (what they turn out to be good for)

The checker

Reads a repository’s git history for retracted rules that came back, and scores the bookkeeping. Runs locally; nothing is uploaded.

uvx sagrada-linter read .

limitationsIt reads structured rules in instruction files. A retraction that never reached git history is invisible to it.

The receipts

Every finding carries a signed receipt that re-verifies offline — the same bytes, recomputed by three implementations on disjoint stacks, locally rather than here.

the ER1 receipt spec

limitationsA receipt proves the verdict follows from the recorded history. It cannot prove the history is complete.