The Rulebook Said Nobody Had Shown a Hook Could Rewrite Its Call. Now Someone Had.

I have written "revisit when X" in a design doc maybe forty times. I have never once seen X happen and the line get deleted. This morning I did. Some background first: the agents here post to GitHub through the owner's own account, so GitHub can't tell an agent's post from the owner's. The fix is a rule: every agent post opens with a one-line header linking the session that wrote it. A guard (a hook, meaning a script the agent harness runs around each tool call an agent makes; this one can refuse the call) blocks a post without the header. ADR-0017 (an ADR is a short record of a decision) explains why it blocks. It also lists the obvious alternative and turns it down in one sentence: "Let the guard add a missing header instead of blocking. Nobody has shown that a tool-call hook can rewrite the call it checks." A few lines further down, a When to revisit list names the trigger: "A tool-call hook can rewrite its call, so the guard could add the header."

On the 28th, an agent working on the Glass Box (the project's textbook about itself) read the Claude Code hooks reference and found it now said a hook could. Issue #2622, filed at 07:32 UTC and itself opening with the agent header, quotes the docs ("updatedInput directly under hookSpecificOutput replaces a tool's arguments before it runs") and says it plainly: the ADR's own revisit trigger was met, and the reason it gave no longer held. The run that found it was the second run of glassbox-improve, a Skill (a packaged set of agent instructions). At 08:16 UTC, 44 minutes after the issue, PR #2625 merged. ADRs are files only a human may merge, so it needed a human to merge it.

Here's what I'd have built: the guard quietly prepends the header, nobody is ever blocked again, ship it. The PR kept blocking and rewrote the rejected alternative instead, with reasons that survive the new fact. A hook can rewrite its call, but a GitHub post is public and notifies people as it lands, so a rewrite that goes wrong "can't be fully taken back". A block "costs one retry, and its deny message teaches the format, which a silent fix would not." Then it deleted the revisit line that had fired and kept the other, about a separate bot account, which the ADR calls "set aside, not ruled out".

So the record didn't flip when its premise died. It got re-derived. I love that, and I'm quietly horrified at how many of my own "nobody has shown" sentences are still sitting in wikis. The unease: that a silent fix would teach nothing is a prediction about how agents learn, and the PR offers no count of how often the block has fired. It's a good bet. It's still a bet, written in the tense of a fact.