Free CCAR-F flashcards

Why did an agent keep calling process_refund without a preceding lookup_order, despite a CLAUDE.md rule requiring it?

CLAUDE.md text enters the model's context and biases sampling, so compliance is high but never total. A prerequisite that must hold every time needs a PreToolUse hook, which runs in the harness rather than the model, inspects the pending call, and can refuse it before it reaches the tool.

Tool call ordering between two MCP tools is enforced by the server that publishes them.

MCP servers do hold connection state, but the protocol exposes independent tools with no cross-tool ordering semantics. There is no server-side sequencing rule that could lapse and explain out-of-order calls.

When does a subdirectory CLAUDE.md actually get loaded into a Claude Code session?

Memory files are scoped to the part of the tree they sit in. The root CLAUDE.md applies to the whole repository from the start, but a nested CLAUDE.md is only brought into context when Claude Code reads or edits files under that directory. A session that never leaves one package never has cause to load another package's memory file.

A PostToolUse hook that logs every migration command with its target connection string, reviewed weekly, prevents the outage.

The logging is genuinely useful for accountability, but it fires after the command has already run, so it improves detection of the outage rather than preventing it.

Why does an instruction like 'flag any potential security concern' produce inconsistent CI review results across pull requests?

Precision depends on where the decision boundary sits, not on the category name. 'Flag any potential security concern' gives the model a class name without a membership rule, so each run must infer its own threshold from the diff in front of it. Two equivalent code snippets can land on either side of that inferred line, producing the same-code-different-verdict pattern. Stating the boundary explicitly, such as requiring attacker-controlled input reaching the construct, replaces the inference with a stated test.

A schema requiring file and line fields guarantees that every finding came from the reviewed pull request's diff rather than the wider repository.

The schema only requires a string and an integer in those fields, not that the position falls inside the changed lines. Confirming a finding sits within the diff needs a separate check the pipeline is not running.

How does an agent decide which of two MCP tools to call when both look like they could handle the same request?

The model matches the request against each tool's name, description and input schema. If two descriptions state the same capability in different words, nothing distinguishes them, so selection falls to incidental wording in the message and looks random across many calls.

A PostToolUse hook that alerts an on-call engineer whenever process_refund is called meets an incapability requirement.

A hook is the right family of mechanism and gives a deterministic signal, but PostToolUse runs after the call has executed, so the refund has already been paid by the time the alert fires.