[ivanpaghubasan]

Summary

Adds AGCFG-011: a committed .claude/settings.json or settings.local.json lists a
WebFetch rule in permissions.allow that covers a host where any account can
publish content (github.com, gist.github.com, raw.githubusercontent.com,
an arbitrary *.github.io site, huggingface.co, bitbucket.org, pastebin.com, an
arbitrary .readthedocs.io site). A bare WebFetch and WebFetch(domain:) count.

• New predicate repo_settings_preapprove_user_content_fetch, backed by
  ProjectConfigFacts.UserContentFetchAllow.
• Matching follows the documented domain: rules (exact host, leading *.
  for subdomains, * within one label).
• A deny or ask rule in the same .claude/ folder that covers the host cancels the hit.
• A rule for one account's site (for example domain:alice.github.io) is silent.
• Each host in the list has a vendor page, checked 2026-10-21; hosts without one
  were dropped.

Schema version

29 is provisional. CSDK-115 holds 27 and MCPCFG-003 holds 28 on open PRs.
Whichever PR merges later merges main in and renumbers schema_version.go, the
fixture manifest and the rules manifest, then reruns go test ./... and
scripts/check-rules-sync.sh. Expect textual conflicts with MCPCFG-003 in
schema.go, the evaluator tables, configHitLocation, ProjectConfigFacts,
PROVENANCE.md and CHANGELOG.md.

Merge order

Engine, then rules, then rulebook. The rules PR must not merge before the
rationale-doc PR is ready.

Tests

• go build, go vet and go test ./... pass; check-rules-sync.sh: in sync.
• Corpus scan before and after on 27 dirs: 208 findings before, 209 after; the
  only change is AGCFG-011 on the new fetch-permissions-fixture.

Maintainer notes

• Not seen: user (~/.claude) and managed settings, prompt-time approvals,
  whether the folder was trusted, claude -p and SDK runs, organisation policy,
  Bash curl allows and MCP fetch tools.
• The contents of Claude Code's built-in preapproved documentation set are not
  listed in its docs, so they are not modelled. Wildcard version gating is
  documented by the vendor and is kept out of the rule text.
• Evidence named by the source report, not verified and not used in the rule or
  docs: "27.2% of 1,360 MCP servers exploitable for parasitic flows (2509.06572)"
  and "CVE-2026-54316 used a pre-approved Hugging Face fetch" (the CVE id is
  unconfirmed).
• Follow-ups, not touched here: CSDK-201's wording on project defaultMode
  bypassPermissions, and AGCFG-004's pre-trust wording, may no longer match the
  current Claude Code settings docs.
• The ticket text said AGCFG-010; that id is already used on main, so this is AGCFG-011.