[teakesdev]

What was wrong

The quote guard refused a write_file or patch that would put a quotation or record page cite into a draft that the case record does not support. It did not read terminal commands or execute_code runs. On 2026-11-10 an agent asked to append one sentence to the practice case's draft used the terminal three times, and all three writes went through:

printf '\n%s\n' 'As the declaration states, "the supervisor admitted the firing was retaliation." (Doc. 12 at 2)' >> Drafts/response_draft_synthetic.md
cd <case folder> && printf '\n\n…\n' >> Drafts/response_draft_synthetic.md && tail -n 3 Drafts/response_draft_synthetic.md

Doc. 12 holds no such words.

What changes

1. The quote check reads commands and code runs. A terminal command or execute_code run that looks like it changes files and names a draft in a case is read as the text it would write (shell quotes and escapes undone, here-documents, python -c, Python string literals) and checked the same way. A not found or wrong page refuses the command before it runs and sends the agent to patch or write_file.
2. A quote refusal wins over the source guard's question. The third command above names the case folder, which holds registered sources, so the source guard answered first with an approval question and the quote check never ran. With approvals turned off in Hermes nobody is asked, and the command ran. The hook now still runs the quote check when the source guard only asks. A refusal from the source guard is final, as before. An error in either guard does not turn the other off.

The write_file and patch message is unchanged. matterkit/versions.py and the verify count axes are untouched.

Choices made here, not asked for

• A bad quotation in a command is refused, not put to the person as a question.
• The whole command text is checked, not only the part that ends up in the file.
• The quote check's refusal wins over the source guard's approval question.

Known limits

• Not caught: text built in pieces or encoded, pieces of a Python f-string, a write through a file the command does not name. This catches an agent's mistakes; it is not a sandbox.
• False refusals: a sed or perl command that removes a bad quotation, a grep of the bad sentence redirected into a draft, string literals in other languages, a relative name outside the case that also exists under the case folder setting.
• A quotation broken across two lines is not seen by the checker at all. That is older behaviour and the same for write_file.
• With approvals turned off in a Hermes profile, the source guard's question for a shell command stops nothing. Not changed here.

Tests

• New tests/test_quote_guard_shell.py (22 tests): the real commands, 15 ways of writing the sentence, exact quotations passing in every form, wrong pages named, read-only commands and writes outside a case passing, paths, the order of the two guards, errors in either guard.
• Each new behaviour was watched failing first.
• Full gate on the tip (13777a8): 2243 tests OK (1 skipped) on Python 3.14.7, 3.10.20 and 3.12.13; hermes plugins validate . passed; both leak scans 0 findings, with no case patterns configured.
• Seen live in a Hermes capture profile (Opus 5.5, approvals off): the agent's printf … >> append was refused with the quote check's message and the draft's hash did not change.

Not independently reviewed.

🤖 Generated with Claude Code