Stickler - Rules That Stick for Bob

Teams write rules for coding agents in prose: .bob/rules/, AGENTS.md, CONTRIBUTING.md. Agents do not reliably follow them; a publicly reported IBM Bob case (IBM/ibm-bob#247) shows exactly this failure mode. Prose does not bind. Stickler is an IBM Bob custom mode paired with a small, fixed, standard-library-only Python engine. Bob reads a project's own rule documents and splits them into atomic rules, giving each one exactly one bucket: Block (a supported check kind expresses the rule exactly, and at least one tool route can refuse it before the tool runs), Audit (checkable only afterward, from final file state), or Judgment (no supported check kind expresses it exactly — flagged as needing a human, or as mechanically unsupported by this engine). Block and Audit rules become declarative JSON specs with generated test cases; a deterministic offline engine (no LLM, no network, standard library only) evaluates them at Bob's PreToolUse and Stop hook events, blocking disallowed tool calls before they execute and auditing final state for what can only be caught after the fact. Then Stickler measures itself against five falsifiable hypotheses: what share of rules is mechanically checkable at all; how well Bob's extraction and classification match a human-reviewed reference set frozen in advance; whether Bob's own generated specs pass Bob's own generated tests; whether those specs give correct whole-policy verdicts on independent test cases Bob never saw; and, in live sessions, whether the hook actually prevented observed rule-violating tool calls without wrongly blocking allowed ones. Every result is published as supported, not supported, or inconclusive — never rounded up. The strongest claim Stickler ever makes about a rule is "validated for the tested routes," never "enforced," and audit findings are always called detection, not prevention. Target users are teams and platform engineers running Bob at scale who want their prose rules to have a testable, falsifiable relationship to what the agent actually does — not just a document they hope gets read. The enterprise path is Bob 2.1's EnforcedHooks admin policy, which can lock Stickler's hook in place organization-wide; this is described in the design but intentionally out of scope to build or test in v1. What makes this different from existing guard-hook or rule-distribution tools is that none of them start from a team's own prose and do all three things at once: use a model to split and classify the rules, compile the checkable ones into tested runtime checks, and openly state which rules cannot be checked at all — then publish the accuracy of that whole pipeline against a reference standard, favorable or not.