docs: add source-first scope guard for RULES waves

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: DarKWinGTM

CLAUDE.md

@@ -16,3 +16,10 @@ For every RULES improvement wave, normal governed sync is not enough by itself.
 - The four closeout steps above are an additional maintainer completion gate, not a replacement for existing governed sync.
 - When install is in scope, verify source/runtime parity and body sufficiency rather than assuming copied files are correct.
 - Keep README current enough that the published repo front page matches the released runtime/install state.
+
+## Source-first scope guard
+- For RULES work, start from the checked source-controlled repository first.
+- Treat `/home/node/.claude/rules` as an installed runtime target, not as the source authority.
+- Do not start by editing the installed runtime copy unless the user explicitly chooses a runtime-only emergency or install-verification task.
+- If a clean clone/worktree is needed because a local checkout is dirty, complete the source update there first, then sync the local checkout from the released source state.
+- When install is in scope, install from the checked source repo and verify source/runtime parity plus body sufficiency afterward.

README.md

@@ -19,7 +19,7 @@
 <table>
 <tr>
 <td align="center" width="200">
-  <b>v10.52</b><br><sub>P144 Released</sub>
+  <b>v10.53</b><br><sub>P145 Released</sub>
 </td>
 <td align="center" width="200">
   <b>19</b><br><sub>Active Runtime Rules</sub>
@@ -28,12 +28,12 @@
   <b>Released</b><br><sub>Verified and published</sub>
 </td>
 <td align="center" width="200">
-  <b>Goal route owner</b><br><sub>Dedicated /goal contract</sub>
+  <b>Source-first scope</b><br><sub>Repo first, runtime second</sub>
 </td>
 </tr>
 </table>
 
-> **Current release note:** `v10.52 / P144` ships a dedicated `goal-authoring-and-route-support.md` runtime owner, keeps `execution-and-goal-frame.md` plus `phase-todo-artifact.md` focused on their execution/task bridges, and makes maintainer closeout require README sync, runtime install, source push, and repo release before a RULES wave is considered done.
+> **Current release note:** `v10.53 / P145` makes source-first scope explicit for RULES maintenance: start from the checked source repo, treat `/home/node/.claude/rules` as a downstream install target, and keep README sync, runtime install, source push, and repo release as mandatory closeout before a wave counts as done.
 
 <!-- CTA Buttons -->
 <p>
@@ -279,11 +279,11 @@ These capabilities summarize the current operating model at the front-page level
 **📊 Active Runtime Rules: 19**
 
 Current source state:
-- P137 / v10.45 hardens execution routing on top of the released `v10.44 / P136` baseline.
-- Selected, execution-ready, non-trivial plan-backed or goal-backed work now prefers Subagent-Driven execution first after a checked suitability gate.
-- Inline Execution remains valid only when checked suitability shows direct handling is more effective for the current slice.
-- `/goal` remains the objective owner while the plan file remains route-only support and not completion proof.
-- Runtime Context Discipline now stays front-page scoped: current runtime shape, authority boundaries, and install-discipline expectations are summarized without turning README into a phase summary.
+- Released `v10.53 / P145` makes source-first scope explicit for RULES maintenance.
+- Repo-root `CLAUDE.md` now says start from the checked source-controlled RULES repo first and treat `/home/node/.claude/rules` as a downstream install target.
+- Runtime-first edits are now outside the default path unless the task is explicitly runtime-only emergency or install-verification work.
+- Maintainer closeout still requires README sync, runtime install, source push, and repo release before a RULES wave is considered done.
+- Runtime Context Discipline stays front-page scoped: current runtime shape, authority boundaries, and install-discipline expectations are summarized without turning README into a phase summary.
 - The governed `playground/` family remains non-runtime and outside the installer payload.
 - The active runtime install set remains 19 root rules and `playground/` stays outside the installer payload.
 </div>
@@ -1065,7 +1065,7 @@ Result: ✅ Verified from actual files
 ### Runtime install boundary
 
 - Current README meaning: the Quick Start block installs the compact 19-rule source-owned active runtime set and uses owner-aware cleanup instead of filename-only deletion.
-- Source state: this README reflects released `v10.52 / P144`, where `goal-authoring-and-route-support.md` now owns governed `/goal` route-support doctrine, the active runtime install set contains 19 root rules, and `playground/` stays outside the install payload.
+- Source state: this README reflects released `v10.53 / P145`, where repo-root `CLAUDE.md` now enforces source-first scope for RULES maintenance, the active runtime install set still contains 19 root rules, and `playground/` stays outside the install payload.
 - Ownership guard: manifest-owned files are removed only when they still match the last recorded install snapshot, and legacy pre-manifest files are quarantined only when their content exactly matches this repo's git history for that rule path.
 - Boundary: files already present in a shared runtime destination but outside this repo's recorded install ownership or repo-history proof are not cleanup targets by default.
 - Impact: protects install scope and other-owner runtime files while still allowing safe cleanup of this repo's old runtime leftovers, including legacy installs from before the merged-rule transition.
@@ -1146,7 +1146,8 @@ These rules evolve based on real-world usage:
 3. Add visual assets if applicable
 4. Update changelog
 5. After every RULES improvement wave, finish maintainer closeout: update README, install the active runtime rules, push the source update, and create the repo release
-6. Respect completion boundaries — do not add new mandatory capability blocks to a completed governance model unless the change is explicitly justified and intentionally approved
+6. Start from the checked source repo first; treat installed runtime copies as downstream targets unless the task is explicitly runtime-only
+7. Respect completion boundaries — do not add new mandatory capability blocks to a completed governance model unless the change is explicitly justified and intentionally approved
 
 **We value:** Quality over quantity, clarity over complexity, and bounded governance over endless expansion
 
@@ -1189,8 +1190,8 @@ Personal rule set and configuration framework for Claude Code CLI.
 ---
 
 <p>
-  <b>Version</b>: 10.52 |
-  <b>Last Updated</b>: 2026-06-13 |
+  <b>Version</b>: 10.53 |
+  <b>Last Updated</b>: 2026-06-14 |
   <b>Framework</b>: Sophisticated AI Framework with Constitutional Governance
 </p>
 

TODO.md

@@ -1,7 +1,7 @@
 # Claude Code Rules - TODO
 
-> **Last Updated:** 2026-06-11
-> **Current Release:** v10.51 / P143 hybrid progress-reporting surface alignment
+> **Last Updated:** 2026-06-14
+> **Current Release:** v10.53 / P145 source-first scope guard and repo-authority enforcement
 > **Active Wave:** none selected
 > **History:** [todo/history/2026-05-16.md](todo/history/2026-05-16.md); [todo/history/2026-05-08.md](todo/history/2026-05-08.md); [pre-rollover TODO snapshot](todo/history/2026-05-08-pre-rollover-TODO.md)
 > **Done Detail:** [todo/done/rules-release-closeouts.md](todo/done/rules-release-closeouts.md); [todo/done/](todo/done/)
@@ -10,6 +10,10 @@
 
 ## ✅ Completed
 
+- [x] P145 / v10.53 source-first scope guard and repo-authority enforcement was completed, installed, pushed to `master`, tagged, and released.
+  - Verified: repo-root `CLAUDE.md` now explicitly says RULES work starts from the checked source-controlled repository first; `/home/node/.claude/rules` is treated as a downstream install target rather than source authority; runtime-first edits are outside the default path unless the task is explicitly runtime-only emergency or install-verification work; README current-state/release-facing wording matches the new guard; `TODO.md`, `phase/SUMMARY.md`, this release wave's phase/patch/master-changelog/detail surfaces align to `v10.53 / P145`; runtime install/update verification was rerun from the checked source repo; selected runtime parity checks passed in checked scope; `git push` to `master`, tag `v10.53`, and GitHub release verification all passed.
+  - Release URL: https://github.com/DarKWinGTM/claude-code-rules/releases/tag/v10.53
+
 - [x] P143 / v10.51 hybrid progress-reporting surface alignment was completed, installed, pushed to `master`, tagged, and released.
   - Verified: the selected runtime owners now support a shared hybrid progress snapshot for non-trivial in-flight work using `Current`, `Done so far`, `In progress`, `Remaining`, `Blockers / Notes`, and `Next`; `Done so far` is explicitly bounded to checked scope; progress narration no longer reads like a stop gate or milestone-only pause when safe continuation exists; the P141 route-only `/goal` authoring boundary remains intact with no default execution-mode menu leakage; touched design/changelog/TODO/phase/patch/current-state surfaces are aligned to one `v10.51 / P143` baseline; touched runtime-owner install/update verification passed with source/runtime parity + body sufficiency in checked scope; `git diff --check` passed; and push to `master`, tag `v10.51`, and GitHub release verification passed.
   - Release URL: https://github.com/DarKWinGTM/claude-code-rules/releases/tag/v10.51

changelog/changelog.md

@@ -1,7 +1,7 @@
 # Master Changelog - Claude Code Rules
 
 > **Project:** Claude Code Rules System
-> **Current Version:** 10.52
+> **Current Version:** 10.53
 > **Session:** 8b04beb0-b5ef-4500-a3f5-558bcedd088a
 > **Version Shards:** [changelog/](changelog/)
 > **Legacy Archive:** [done/master-legacy-v6.3-v9.59.changelog.md](done/master-legacy-v6.3-v9.59.changelog.md)
@@ -12,6 +12,7 @@
 
 | Version | Date | Changes | Session ID |
 |---------|------|---------|------------|
+| 10.53 | 2026-06-14 | **[Released source-first scope guard and repo-authority enforcement](changelog/v10.53-released-source-first-scope-guard-and-repo-authority-enforcement.changelog.md#version-1053)** | 8b04beb0-b5ef-4500-a3f5-558bcedd088a |
 | 10.52 | 2026-06-13 | **[Released goal route-support owner and mandatory maintainer release flow](changelog/v10.52-released-goal-route-support-owner-and-mandatory-release-flow.changelog.md#version-1052)** | 8b04beb0-b5ef-4500-a3f5-558bcedd088a |
 | 10.51 | 2026-06-11 | **[Released hybrid progress-reporting surface alignment](changelog/v10.51-released-hybrid-progress-reporting-surface-alignment.changelog.md#version-1051)** | 1f1873d2-0feb-485f-a5ff-d383254590dd |
 | 10.50 | 2026-06-07 | **[Released phase authoring template relocation and runtime-boundary clarification](changelog/v10.50-released-phase-authoring-template-relocation-and-runtime-boundary.changelog.md#version-1050)** | 1f1873d2-0feb-485f-a5ff-d383254590dd |

changelog/changelog/v10.53-released-source-first-scope-guard-and-repo-authority-enforcement.changelog.md

@@ -0,0 +1,23 @@
+# Master Changelog Detail - v10.53
+
+> **Parent Document:** [../changelog.md](../changelog.md)
+> **Current Version:** 10.53
+> **Session:** 8b04beb0-b5ef-4500-a3f5-558bcedd088a
+
+---
+
+<a id="version-1053"></a>
+## Version 10.53: Released source-first scope guard and repo-authority enforcement
+
+**Date:** 2026-06-14
+**Session:** 8b04beb0-b5ef-4500-a3f5-558bcedd088a
+
+### Changes
+- Added an explicit source-first scope guard to repo-root `CLAUDE.md`.
+- Clarified that RULES work starts from the checked source-controlled repository first and treats `/home/node/.claude/rules` as a downstream install target.
+- Updated release-facing README wording to explain the new guard while preserving the 19-rule runtime payload truth.
+- Synced `TODO.md`, `phase/SUMMARY.md`, the new P145 phase file, and the new patch artifact to the same `v10.53 / P145` released baseline.
+- Reran runtime install/update verification from the checked source repo before closeout.
+
+### Summary
+This release keeps the maintainer closeout contract from `v10.52 / P144` and adds the missing scope boundary: source repo first, runtime install second.

patch/source-first-scope-guard-and-repo-authority-enforcement.patch.md

@@ -0,0 +1,93 @@
+# Source-First Scope Guard and Repo-Authority Enforcement Patch
+
+> **Current Version:** 1.0
+> **Session:** 8b04beb0-b5ef-4500-a3f5-558bcedd088a
+> **Status:** Complete / Released
+> **Target Design:** none
+> **Full history:** [../changelog/changelog.md](../changelog/changelog.md)
+
+---
+
+## Context
+
+This is the governed patch record for the P145 wave.
+
+It packages one bounded repository-maintenance refinement: future RULES work should start from the checked source-controlled repository first, while `/home/node/.claude/rules` stays a downstream install target rather than a source-authority workspace.
+
+---
+
+## Analysis
+
+Before this wave:
+- the repo-root maintainer contract already required README update, runtime install, source push, and repo release before a RULES wave counted as done
+- but it did not yet say explicitly that work must begin from the checked source repo instead of the installed runtime copy
+- that gap made it easier for runtime-first diagnosis work to look like source-authority editing, even when the work later converged back into the repo correctly
+
+The better posture is:
+- make source-first scope explicit in repo-root `CLAUDE.md`
+- reflect that guard in release-facing README wording
+- keep the active runtime payload unchanged
+- rerun install/update verification from the checked source repo so maintainer closeout remains real rather than only declarative
+
+---
+
+## Change Items
+
+### 1) Repo-root maintainer contract hardening
+
+- **Target artifacts:** `CLAUDE.md`
+- **Change type:** bounded project-contract refinement
+- **Current state:** closeout is explicit, but source-first authority is still implicit.
+- **Target state:** repo-root `CLAUDE.md` says RULES work starts from the checked source-controlled repository first and treats `/home/node/.claude/rules` as a downstream install target.
+- **Review point:** the guard should prevent scope drift without turning runtime-only emergency or install-verification tasks into forbidden actions.
+
+### 2) Release-facing README sync
+
+- **Target artifacts:** `README.md`
+- **Change type:** current-state / maintainer-guidance synchronization
+- **Current state:** release-facing README explains v10.52 goal-route-support changes but not the new source-first scope guard.
+- **Target state:** current release note and current-source-state block explain the source-first guard while preserving the maintainer closeout contract and the 19-rule runtime payload truth.
+- **Review point:** README should stay current-state focused rather than drifting into a long retrospective narrative.
+
+### 3) Current execution-surface sync
+
+- **Target artifacts:** `TODO.md`, `phase/SUMMARY.md`, `phase/phase-145-source-first-scope-guard-and-repo-authority-enforcement.md`, and this patch file
+- **Change type:** active phase/TODO synchronization
+- **Current state:** active current-state surfaces still point to `v10.51 / P143` as the latest released baseline.
+- **Target state:** active current-state surfaces reflect `v10.53 / P145` as the latest released baseline and record the new source-first guard wave.
+- **Review point:** touched surfaces must not outrun the real push/tag/release evidence.
+
+### 4) Release-history synchronization
+
+- **Target artifacts:** `changelog/changelog.md` and `changelog/changelog/v10.53-released-source-first-scope-guard-and-repo-authority-enforcement.changelog.md`
+- **Change type:** release-history synchronization
+- **Current state:** latest released baseline is `v10.52 / P144`.
+- **Target state:** master release-history surfaces advance to `v10.53 / P145` only because push/tag/release verification is completed in this wave.
+- **Review point:** release wording must match the checked evidence held at closeout.
+
+---
+
+## Verification
+
+Required checks before strong closeout wording:
+- repo-root `CLAUDE.md` explicitly states the source-first scope guard
+- README current-state/release wording reflects the new guard and still describes the 19-rule runtime payload correctly
+- TODO/phase/patch/master-changelog/detail surfaces align to `v10.53 / P145`
+- runtime install/update verification is rerun from the checked source repo
+- selected runtime parity checks pass in checked scope
+- push to `master`, tag `v10.53`, and GitHub release verification all pass
+- post-release local RULES checkout sync matches the released source files in checked scope
+
+---
+
+## Rollback Approach
+
+If the new guard proves too rigid, soften only the source-first wording while keeping the maintainer closeout contract and downstream runtime-install boundary intact; do not roll back into a posture where installed runtime copies can silently become the default editing authority for RULES source work.
+
+---
+
+## Implementation Status
+
+P145 is completed.
+
+The source-first guard is now explicit in repo-root `CLAUDE.md`, release-facing README wording is aligned, active current-state surfaces align to `v10.53 / P145`, runtime install/update verification was rerun from the checked source repo, selected runtime parity checks passed, push to `master` passed, tag `v10.53` passed, GitHub release verification passed, and the local RULES checkout was resynced to the released files. Release URL: https://github.com/DarKWinGTM/claude-code-rules/releases/tag/v10.53

phase/SUMMARY.md

@@ -1,9 +1,9 @@
 # RULES Phase Summary
 
-> **Current Version:** 2.08
+> **Current Version:** 2.09
 > **Target Design:** [../design/phase-implementation.design.md](../design/phase-implementation.design.md) v2.35
-> **Session:** 1f1873d2-0feb-485f-a5ff-d383254590dd
-> **Status:** No active phase selected; latest released baseline is v10.51 / P143 hybrid progress-reporting surface alignment
+> **Session:** 8b04beb0-b5ef-4500-a3f5-558bcedd088a
+> **Status:** No active phase selected; latest released baseline is v10.53 / P145 source-first scope guard and repo-authority enforcement
 > **Full history:** [../changelog/changelog.md](../changelog/changelog.md)
 > **Daily History:** [history/2026-05-16.md](history/2026-05-16.md); [history/2026-05-08.md](history/2026-05-08.md)
 > **Pre-Rollover Snapshot:** [history/2026-05-08-pre-rollover-SUMMARY.md](history/2026-05-08-pre-rollover-SUMMARY.md)
@@ -27,6 +27,12 @@ Active scans should start here, then follow `history/` or `done/` links only whe
 
 ### Most Recently Completed
 
+- **P145:** [phase-145-source-first-scope-guard-and-repo-authority-enforcement.md](phase-145-source-first-scope-guard-and-repo-authority-enforcement.md)
+  - Output: repo-root `CLAUDE.md` now makes source-first scope explicit for RULES maintenance, so work starts from the checked source repository and `/home/node/.claude/rules` is treated as a downstream install target instead of a source-authority workspace.
+  - Gate: source-first scope guard wording passed, README/release-facing wording aligns to `v10.53 / P145`, `TODO.md` / `phase/SUMMARY.md` / phase / patch / master-changelog/detail surfaces align, runtime install/update verification was rerun from the checked source repo, selected runtime parity checks passed in checked scope, `git push` to `master` passed, tag `v10.53` passed, and GitHub release verification passed.
+  - Release URL: https://github.com/DarKWinGTM/claude-code-rules/releases/tag/v10.53
+  - Patch: [../patch/source-first-scope-guard-and-repo-authority-enforcement.patch.md](../patch/source-first-scope-guard-and-repo-authority-enforcement.patch.md)
+
 - **P143:** [phase-143-hybrid-progress-reporting-surface-alignment.md](phase-143-hybrid-progress-reporting-surface-alignment.md)
   - Output: non-trivial Claude progress updates now have one compact hybrid snapshot built around `Current`, `Done so far`, `In progress`, `Remaining`, `Blockers / Notes`, and `Next`, while keeping evidence-strength wording, continuation-first execution, and the route-only `/goal` authoring boundary aligned.
   - Gate: touched runtime owners, companion design docs, per-chain changelog parents, TODO/phase/patch/master-changelog/detail surfaces align to `v10.51 / P143`; touched runtime-owner install/update verification passed with source/runtime parity + body sufficiency; `git diff --check` passed; and push to `master`, tag `v10.51`, and GitHub release verification passed.