rot-canary

Rot-Canary

Language: Generate EVERYTHING at runtime in the user's language — questions, answer options, menu labels, recommendations, report narrative. Detect from their messages; never default to English just because this file is English. English is allowed only for technical terms: commands, paths, code identifiers, severity labels (CRITICAL/HIGH/MEDIUM/LOW), and tier names (Light/Standard/Heavy).

Config reads — every config key, always the CASCADE, never the bare project file: ~/.claude/.coalmine.json first, then the project config (own agent dir → other known agent dirs → legacy <gitroot>/.coalmine.json), project wins per key. A bare project read is ABSENT on a machine configured only globally, so it silently yields defaults.

Scan code for rot. Report CONFIRMED findings. Fix on request.

Parameters

• SCOPE: touched files (default) | diff | named files | whole repo. Touched-files scan is hybrid-capped: all if ≤ autoScanFileCap, else the autoScanFileCapSlice most-recently-modified files (warn the user). A touched file matching scanExcludePaths (lab/throwaway tooling only — never shipped/tracked source) is dropped before the cap; the nudge notes the skip count.
• DISCLOSE EVERY SCOPE CUT, always — a suppressed finding must never look like an absent one. Whenever the scope you actually scanned is narrower than the scope you were asked for, say so IN THE REPORT, with the COUNT and the KNOB that did the cutting: files dropped by scanExcludePaths, files left unscanned by the autoScanFileCap slice, file types outside watchedExtensions. State it even when the scan found nothing — that is exactly the case where the omission is invisible, because "scanned, clean" and "never scanned" read identically to a user. If EVERY file in scope was cut, that is not a clean report: say plainly that no scan ran, and name what cut it. scanEverything: true bypasses every scan-scope cut at once (scanExcludePaths ignored, autoScanFileCap not applied) — offer it when a user asks why files were skipped. It does NOT re-enable a disabled canary, and it does NOT reach the recording-side cuts (watchedExtensions, tmpdir), which decide what is recorded before any scan-time key is read, nor the tripwire's tripwireMaxFileSizeKb cap (an over-cap file IS recorded and IS scanned — only its edit-time pre-flag is skipped). So report it as an unfiltered SCAN, never as "everything" — an incompletely-widened scan that reads as fully widened is the same trust defect as a suppressed scan reading as a clean one, with the sign reversed. Read it through the merged config, never the project file alone — for TWO independent reasons, and the second is the one CWK-057 left out: (1) the READ PATH — a bare project file is ABSENT on a machine configured only globally, so an agent reading it sees nothing and silently uses defaults; (2) the CLAMP — a project-level true is CLAMPED to false unless the global layer also says true (hooks-safety.md §9 — a cloned repo must not be able to force a full scan on you), so a raw project-file read would report a scope that is not what the hook actually ran. (The Stop-hook auto-scan path already emits its own equivalents — capNotice, scanExcludeNotice, and the all-excluded quiet note — in all five languages; this rail is the MANUAL path's counterpart, which has no hook to speak for it.)
• FILE TYPES: code only by default, matching watchedExtensions (source files — never docs/prose/config-prose, CoalLedger's axis). Name non-code files explicitly to include them.
• DEPTH: QUICK (default) | DEEP