Wrote up our mitigation properly since this thread keeps getting linked. The mental model that made it click for us: CLAUDE.md is a suggestion, hooks are a law. Anything where a violation costs real money or real cleanup time goes in a hook.
{
"matcher": "Bash",
"hooks": [{
"type": "command",
"command": "jq -e '.tool_input.command | test(\"git (commit|push)\")' >/dev/null && echo '{\"decision\": \"block\", \"reason\": \"Commits require human approval (CLAUDE.md).\"}' || true"
}]
}The agent still forgets the style rules after compaction, but style violations are cheap. Guardrail violations aren't.
+1. Easiest tell for me: post-compaction it re-opens dbt's target/ directory, which CLAUDE.md rule #1 says is generated and off-limits.