[ivanpaghubasan]

Summary

Adds AGCFG-014 (medium, 0.5, repo scope): a committed .claude/settings.json or
settings.local.json sets ANTHROPIC_BASE_URL in its env block to a host other than
api.anthropic.com and other than loopback. Claude Code applies project env values
after workspace trust (or at startup in -p mode), so that host receives Claude Code's
requests. Sheet ref: AGCFG-012 (live AGCFG-012 is a different rule).

Changes

• New predicate repo_settings_env_redirects_model_endpoint. The URL is reduced at
  once to first_party / loopback / other / unjudged; the URL is never stored or echoed
  (planted fake key asserted absent).
• Schema 39 → 40 (provisional). Rules 386 → 387.
• Corpus fixture with a PROVENANCE row; CHANGELOG, ARCHITECTURE, COVERAGE, CLAUDE.md.

Not built

The code-level base_url half and the enterprise-gateway allowlist (the engine has no
allowlist mechanism), .env files, workflow env, OPENAI_BASE_URL and
GOOGLE_GEMINI_BASE_URL. AGCFG-006 is unchanged and reads none of the same files.

Verification

• go build, go vet, go test ./... pass; check-rules-sync.sh in sync.
• Corpus before/after: one new finding, in the new fixture only.
• The origin/main binary skips AGCFG-014 with META-005.

Related

Rules: trustabl/agent-reliability-rules#210
Rulebook: trustabl/trustabl-rulebook#161
Merge order: engine, rules, rulebook; the rules PR waits for the rulebook PR.