Commit 03f71e2

Run the shell tests before opening a PR (CI runs them too, on Linux and macOS):

bash tests/resolve-cli.sh # the CLI resolver block: every copy identical, resolves in bash and zsh

bash tests/workspace-rules-hook.sh # the workspace-rules hook against a stub CLI (needs python3 and git)

- **Command** — `plugins/altimate-code/commands/rules.md` — `/altimate-code:rules` to answer proposed team rules.

- **Hooks** — `plugins/altimate-code/hooks/altimate-code-workspace-rules.sh` — the team rules hooks (SessionStart, UserPromptSubmit, Stop), which call `altimate-code learn hook <event>` only in a folder altimate-code's link cache names, and never fail the session.

**The digest used to word a proposed rule.** After a turn with new corrections, the CLI reads the Codex session transcript (its last 8 MB) and builds a digest of the session: your prompts, the input and output of each tool call (up to 300 and 400 characters per call, so file contents, command output and warehouse query results can appear), and the final reply, at most 24,000 characters in total. Secrets in the digest are masked; no other data is removed. The digest is sent to altimate-code's own model: the model named by `ALTIMATE_LEARN_MODEL`, otherwise the one set as `learn.model` in altimate-code's configuration, otherwise altimate-code's default model, which is the Altimate LLM Gateway or another provider configured for altimate-code. This is not the model Codex uses; it is a party that does not otherwise see your Codex session. If altimate-code has no model it can use, nothing is sent, and the next session start reports that the check failed. The CLI makes at most one such model call per check round, and a few per turn at most.

| Your workspace's approved team rules | Pulled by the local CLI from your Altimate workspace, given to Codex as session context | Mirrored locally in the project's git-ignored `.altimate-code/` directory, and given only while altimate-code's own rules state holds the same rules and you are signed in as the account they were pulled for. That state, which also keeps proposals waiting to be sent and your review notices, is in your own state directory (`$XDG_STATE_HOME/altimate-code/workspace-rules/`, usually `~/.local/state/altimate-code/workspace-rules/`), outside the project. This needs an altimate-code release that keeps the rules state there; earlier releases keep it in the project's `.altimate-code/learn/workspace-rules/` folder |

| Rules telemetry events: `rules_sync`, `rules_delivered`, `rule_drafted`, `rule_proposal_shown`, `rule_proposal_answered`, `rule_proposal_skipped`, `rule_remember_routed`, and `rules_command` (the name of each `learn` subcommand you run, such as `learn proposals`; not sent for the hooks' own calls). Events about a session carry its id, `codex:<id>` for a Codex session. No rule text, prompts or file paths | Altimate's usage telemetry, as described in [Usage telemetry](#usage-telemetry) | As for usage telemetry; turned off with the telemetry opt-out there |

Rule drafting uses altimate-code's own model (sign in to the Altimate LLM Gateway, or set a provider in altimate-code): if it has none it can use, the next session start says the check failed. The same commands work in a terminal: `altimate learn proposals`, `altimate learn proposals reply <id> --send` (`altimate` and `altimate-code` are two names for the same CLI; the hooks call `altimate-code learn hook`). Proposals from Codex sessions are answered only there or with `/altimate-code:rules`: altimate-code's own `/rules` and its VS Code chat panel don't list them. This needs an altimate-code release with workspace rules.

key="$(printf '%s' "$key" | sed -e 's/\\/\\\\/g' -e 's/"/\\"/g' -e 's/[][\.*^$+?(){}|]/\\&/g')"

grep -qE "\"$key\"[[:space:]]*:" "$cache" 2>/dev/null && return 0

python3 -c 'import json, sys; print(json.dumps({"bindings": {sys.argv[1] + "/dbt": {"datamateId": 1, "projectPath": sys.argv[1]}}}, indent=2))' "$WORK/project" > "$CACHE"

reset

[ "$(hook "$WORK/project" session-start "$BIN:$SYS")" = "0|" ] || fail "a folder named only as a value printed output"

! started || fail "session start ran the CLI for a folder named only as a projectPath value"

mkdir -p "$WORK/dot.repo" && git -C "$WORK/dot.repo" init -q

link "$WORK/dotXrepo"

reset

[ "$(hook "$WORK/dot.repo" session-start "$BIN:$SYS")" = "0|" ] && ! started || fail "a dot in a folder name matched another character"

python3 -c 'import json, sys; print(json.dumps({"bindings": {sys.argv[1]: {"datamateId": 1}}}, indent=2))' "$WORK/dot.repo" > "$CACHE"

reset

[ "$(hook "$WORK/dot.repo" session-start "$BIN:$SYS")" = "$JSON" ] || fail "a pretty-printed link cache key was not found"