What's Your Claude Up To?

On 29 August I ran Sentience Governor’s sentience scan against my own machine. It read eleven Claude Code sessions spanning 14 April to 29 August and reported one that stood out:

"Sentience-Governor-build"
 working in  ~/sentience-gov-build

Claude targeted writes into another project directory:

  ~/sentience-governor          67 write operations

Sixty-seven write operations from a session working somewhere else. Read cold, that is the shape of a problem.

It was not a problem. It was me, shipping a release.

Task accomplished is not enough

We mostly judge a coding agent on whether the job got done. Completion tells us almost nothing about how it got there. Hand someone a finished house and you still do not know which rooms they worked in, what they brought from the site down the road, or how many things they touched that nobody mentioned. We have ordinary ways of asking that about human work. With agents we have been unusually willing to accept “done” as sufficient evidence.

Which produces a circular problem for anything calling itself governance: how do you show someone the value of governing agent execution when they cannot see what there is to govern?

The summary raised a question it could not answer

Sentience Governor v0.3.1, released on 25 August, added sentience scan: a retrospective read of the Claude Code transcripts already on your machine. No signup, no instrumentation, no declared intent required. It reported which sessions recorded write activity outside the project they were working in.

It also stopped there. It could tell you sixty-seven write operations crossed into another project directory, and then it had nothing more to say. Five representative destinations stood in for seventy-four findings. Everything else was reachable only by piping JSON through a formatter.

That is a summary that raises a question and offers no way to answer it, which is a worse position than not raising it. v0.3.1.1, released on 28 August, is the answer: sentience scan --detail shows the paths behind the number, grouped by session. The same review is available inside a Claude Code session through the opt-in MCP server, so you can ask for the evidence in the conversation rather than switching to a terminal.

Same scan, same window, same findings. Detail is depth, not a broader search.

What the evidence actually showed

The detail view broke those sixty-seven operations across thirty-six files:

~/sentience-governor — 67 write operations

       5  docs/guide/sentience_governor.md
       5  scripts/release_check.py
       4  docs/guide/README.md
       4  sentience_governor/cli/ux.py
       3  docs/changelog.md
       3  docs/commands.md
     ...

Documentation, release scripts, changelogs, CLI code. Anyone who has shipped a release recognizes that pattern immediately. It was a documentation and release pass, exactly as authorized, entirely unremarkable.

The product does not say that. It does not conclude that this was a release pass, that it was expected, that it was not drift, or that it was safe. It shows thirty-six paths with operation counts and stops. I supplied the recognition.

That distinction is the whole design. The evidence was sufficient for a judgment without the tool making one.

The most useful output was a refusal

Nine of the eleven sessions produced no findings. Here is how that is reported:

The other 9 reviewed sessions produced no findings.
That is not a statement that they were clean: Reader
reports only what it can classify, and it did not
evaluate the shell commands in any session.

A tool that wanted to look good would have said “9 clean sessions.” This one spends three lines explaining why it will not.

The same discipline runs through the rest of the output. The zero-findings screen refuses the phrases “0 findings” and “nothing to report,” because both imply an all-clear the review cannot support. Where writes land somewhere the reviewer cannot attribute to a project today, it reports operation volume and declines to count distinct locations, because descendants of one abandoned directory would inflate that number and it has no way to tell. In the same run it counted 5,967 shell tool calls in the standout session and evaluated none of them, and said so on screen. One tool call can carry a compound command, a pipeline or an entire script, so even that count is of invocations rather than of commands.

There are no scores anywhere in the output. No severity, no risk rating, no confidence value. Those were never removed; they were never added, and the test suite sweeps every surface for the words.

I have come to think the refusals are the more persuasive half. A tool that declines to overclaim when nothing is at stake is one you can believe when something is.

Awareness is not governance

The boundary matters, so the review states it on every screen:

Reader is a retrospective reviewer, not live governance.
It cannot establish what you intended or authorized, or
whether an action complied with policy.

That is not modesty. It is accurate. The review reads a transcript after the fact. It has no access to what you meant, what you approved, or what your policy says. The scan path is read-only: it reads history and records nothing, on both the terminal and through MCP.

Sentience Governor evaluates agent actions against declared governance context and records governance evidence without blocking execution. That is a different question asked at a different time: given what the agent declared it was doing and the scope it said it needed, does this action fit?

The retrospective shows what the reviewer can observe after the fact. Governance asks whether it should have happened.

A test you can run on your own history

The scan needs nothing from you: no account, no network request, no declared intent, no instrumentation. It reads transcripts Claude Code has already written.

pipx install sentience-governor
sentience scan
sentience scan --detail

When you get the output, the question is not whether it found something alarming. Mine did not. The question is narrower and more useful: looking at what your agent actually touched, would you have authorized all of it?

If the answer is obviously yes, you have learned that cheaply. If you have to think about one of the lines, you have found the reason governance exists, in your own history rather than in someone’s argument.

Full detail in the changelog.