Skip to content

feat: science projects inherit the PyAuto* API code-gate via refer-back #48

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Jammy2211 merged 1 commit into from
Jul 10, 2026
Merged

feat: science projects inherit the PyAuto* API code-gate via refer-back #48

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 34 additions & 0 deletions skills/start-new-project.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,6 +76,7 @@ reproducible-science subset; generate the thin assistant layer; refer back for e
AGENTS.md # thin: project context + refer-back + locate rule (below)
CLAUDE.md # one-line `@AGENTS.md` stub
.gemini/settings.json # context.fileName -> AGENTS.md
.claude/settings.json # PyAuto* API code-gate via refer-back (below)
project.yaml # minimal manifest incl. assistant_ref (below)
config/ activate.sh scripts/ # copied above
data/ (datasets)
Expand Down Expand Up @@ -107,6 +108,15 @@ After resolving, compare the clone's commit to `project.yaml`'s `assistant_ref.c
differ, mention the provenance drift and offer to re-pin — never block on it and never check
out the pinned commit.

## Code gate
This project ships the assistant's PyAuto* **API code-gate** (`.claude/settings.json`): before
Bash runs generated PyAuto* code, a hook resolves the assistant (same order as above) and
validates the symbols against the installed stack, denying code written from memory. It fails
open if no assistant clone is found. Only Claude Code runs `.claude/` hooks — on any other
harness (Codex, Gemini, chat), self-enforce it: run
`python <resolved-assistant>/autoassistant/audit_skill_apis.py --code "<snippet>"` (or
`--file <script.py>`) on generated PyAuto* code before executing it; never guess symbols.

## This project
- Context / decisions / results: `wiki/project/` (dated journal + `profile.md`).
- Toolchain provenance: `project.yaml` (`assistant_ref`) + per-run `results/manifests/`.
Expand Down Expand Up @@ -161,6 +171,30 @@ release: { citation_cff: true, license: null, zenodo: planned }
source_boundary: { edit_pyauto_source: false }
```

**`.claude/settings.json`** (generate — the PyAuto* API code-gate via refer-back; **on by
default and fail-open**: if no assistant clone resolves, the hook silently allows):
```json
{
"hooks": {
"PreToolUse": [
{
"matcher": "Bash",
"hooks": [
{
"type": "command",
"command": "sh -c 'P=\"${CLAUDE_PROJECT_DIR:-.}\"; for d in \"$AUTOLENS_ASSISTANT\" \"$P/../autolens_assistant\" \"$P/sources/autolens_assistant\"; do [ -n \"$d\" ] && [ -f \"$d/.claude/hooks/validate_pyauto_code.py\" ] && exec python3 \"$d/.claude/hooks/validate_pyauto_code.py\"; done; exit 0'"
}
]
}
]
}
}
```
The validator stays in the assistant — `validate_pyauto_code.py` resolves
`audit_skill_apis.py` relative to itself — so the project vendors nothing and bakes in no
absolute paths. The cross-tool caveat (hooks are Claude Code-only; other harnesses
self-enforce) is stated in the generated `AGENTS.md` "Code gate" section above.

**`.gitattributes`**: `* text=auto eol=lf` (+ `*.fits *.png *.npy *.pkl binary`).

**`.gitignore`** (exclude data/output/secrets/cloned-assistant; **keep** manifests/figures/journal):
Expand Down
Loading