rules-as-mechanism

Constitutions grow as prose. Every incident becomes a clause, every clause goes into the instructions file, and one day the AI must read an entire wall of rules before writing a line — so it skims, and the rules it skims are the ones it breaks. Anthropic's own docs say it plainly: an instruction like "never edit .env" in an instructions file is a request, not a guarantee; a hook that blocks the edit is enforcement.

The fix is not writing the rules better. It is moving each rule from paper to hardware.

The conversion table

Hard rules

• Rule files route; they never restate. A summary of a spec is a second source of truth, and it will drift. Each rule file holds pointers ("read section 4 of spec Y") plus at most a handful of negative gates ("feature Z was deleted — don't resurrect it"). If you catch yourself paraphrasing the spec, stop.
• Fire every gate before trusting it. Feed it the bypasses on purpose: uppercase paths, ./ and ../ tricks, absolute paths from a worktree, the field name a different tool uses. A gate you never saw block is a decoration — the same red-light principle you apply to tests, applied to config. Our first report-gate matched a skip-pattern on exactly the directory all real work happens in; it would never have fired once.
• Budget the founder's friction. Every gate that pings a human must be worth a human-minute. Gate only what the founder personally must approve; everything else stays silent. Our founder's line, now law: anything that adds my workload is the wrong direction. We shipped a gate on test-file edits and repealed it the same day — too chatty, no danger.
• Anything that must survive a machine switch goes in git. Local memory is machine-local: our cloud sessions had read zero of the lessons the founder spent weeks teaching, because every one lived in one laptop's memory directory. If a rule should hold on any machine, it is a checked-in file, not a memory.
• Config is decision-grade output — it gets reviewed like code. Have a different model try to break it, with only the requirements and the artifacts (never the author's reasoning). Ours returned FAIL: three bypasses, one gate that could never fire, and a false fact the author had copied into a spec without checking the code.
• Scaffolding dies the day its question is answered. Diagnostic hooks, verification loggers, one-off probes: remove them the moment they've proven the point. Mechanisms you keep must earn their keep forever.

What good looks like

Session start injects a few hundred bytes of live status, not a constitution. Specs load by the section, when the file they govern is touched. The two or three rules that truly need a human land as one confirmation dialog each. Everything else is silence — until the day a session tries the forbidden thing and the gate catches it in the act.

Full story with numbers: case-studies/rules-as-mechanism-campaign.md