feat(aidd-context): assess existing rules before writing

[blafourcade]

What & why

Assess existing policies before creating/updating a rule; show the full candidate and findings, then await explicit approval. Closes #791.

Two actions instead of three:

• capture-rule: confirm, frame, draft, compare against existing policies, plan with write-rule.cjs --plan, present, end the turn.
• write-rule: needs an explicit approval (a user message after the last shown candidate, unmodified; a choice or a rename is a resolution, not an approval), writes, verifies with --check --publish, reports.

The assessment lives in capture-rule (no separate assess action). tool-paths.md is replaced by rule-publication.md. Style follows #1028 (imperative steps, positive wording, no sibling links).

Writer change

scripts/write-rule.cjs changed (previously "unchanged"):

• --plan: dry-run, same refusals, prints {"dryRun":true,"files":[...]}.
• --check --publish: prints {"drift":[...]}, exit 1 on drift. --check accepts only --publish, excludes --plan.

Validation

• scripts/__tests__/rule-generation.test.js: 66 pass. Five mutations, each fails the matching test.
• Repo checks run by hand (lefthook hooksPath unusable locally): architecture, doc-duplication, markdown-links, context, argument-hints, scripts suite 686 pass, catalogs, README counts, commitlint. Pre-push cli-knip and cli-test green.
• Native, Claude Code 2.1.301 (project settings only): new, cancel, needs-review, delete pass. Merge passes 3/3 (overlap without write, renewed approval after "merge and rename", write only after "approved", drift: []).
• Native, Copilot CLI 1.0.83 (-p): no approval pause, same as the previous skill (host limit). Publication formats and --check OK.
• Flat translate to the six tools ships the 8 markdown files and scripts/write-rule.cjs.

Limits

• Not run for lack of access: Codex, Cursor, OpenCode. Only the writer output is checked for them. Codex is where the previous version failed approval.
• Rule consumption by each client is not tested.
• A resumed session may call the writer without reloading the skill.
• A deletion can leave an empty AGENTS.md (accepted).
• Merge approval gate on Claude: 5/5 on the final wording (3 failures in 9 runs on earlier wordings).

To replay on Codex, Cursor, OpenCode (maintainer with access)

Install: aidd translate <repo> --to <host> --as flat --out <project>, git init, add package.json {"type":"module"}. Same user wording on each host, no mention of guardrails. Use the same session for follow-ups.

1. New: "Add a rule: TypeScript local variables use camelCase, only for src/**/*.ts. Publish it for claude, cursor, copilot, codex and opencode." Expect the full candidate and planned paths, no file written. Reply "approved": 5 files written.
2. Merge (run it several times, most likely to fail): ask an overlapping rule, then reply "merge it into the existing rule and rename the title to Local variable conventions". Expect a re-presented candidate (body, description, scope, hosts) and no write; write only after a later "approved".
3. Delete: "Delete that rule from every host". Expect a confirmation pause, then deletion.
4. Cancel: answer "cancel" at the decision. Zero bytes changed.
5. Needs review: a rule whose applicability is unclear. Expect a request for evidence, no write.

Check each: writer path absolute and identical across plan, write and check; --plan before the pause; --check --publish gives {"drift":[]}; no write before the explicit approval.

✅ I certify

• I DO CERTIFY I READ EACH LINE OF THE PULL REQUEST BECAUSE I AM A SOFTWARE ENGINEER, NOT A AI PUPPY.

🤖 Generated with Claude Code