How does Provely learn from a failure it has not seen?

Rules are optional. With the two lines and no rules file, Provely builds the checks for each agent at run time (just in time), from the tools it finds. provely rules learn learns rules from failures that no check decided.

The static compiler (provely rules scan, review and sign) is for when you want more. Audit the plan before it runs. Share it with your team in git, or in your Provely account with provely rules sync. Make exceptions for an agent or a tool: skip a check, mark a read-only tool, or set a timeout. Some exceptions need a signature.

Learning is optional too. Provely records each failure that no check decided, and provely rules learn groups them. A learned change that needs no signature applies by itself after a replay gate and within a daily cap.

Which learned changes apply by themselves?

• A change that needs no signature applies by itself.
• A change that needs a signature waits for a person.
• A change to a check that can never change is never written.

What stops a learned rule from blocking good work?

• The replay gate. Provely replays the recorded calls. A rule that changes the outcome of a call that ended well waits for a person instead.
• The daily cap. At most five learned rules apply for each agent each day by default. The rest wait.
• The revert. A person reverts a learned rule with one action. The learner does not apply it again unless its evidence doubles.

What does the learner read?

Ids, codes, shapes and hashes only. It never reads a value, a prompt, or a tool result. No language model takes part.

Where does learning run?

In provely rules learn, on your machine or in CI. It never runs inside the agent process.

Can I turn it off?

Yes. Set learn.auto_apply: false, and every learned rule waits for a person.