Product
Guards
See what a check protects and the gate where it runs.
Gates and guards
A gate is a stage in the workflow where checks run, such as Push, Merge or Done. A guard is one of those checks. A category groups guards by what they check. A guard can run at more than one gate.
For example, a security check can belong to the Security category while running at Push and Cloud. Its category explains what it checks; “Runs at” explains when it is evaluated.
The gates
- Session
- During the coding session and supported lifecycle hooks.
- Directive
- When goal and work instructions are evaluated.
- Push
- Before a supported push proceeds.
- Verify
- During explicit verification of the work.
- Cloud
- During server-side checking of a submitted revision.
- Merge
- At configured merge checks.
- Done
- When the work is presented as complete.
Full guard catalog
Each table lists the guards in a category, what they check and the gates where they run.
Code quality
| Guard | What it checks | Runs at |
|---|---|---|
| Complexity | Measures cyclomatic complexity of changed functions. | Push, Cloud |
| CRAP | Flags high-complexity changed functions using a conservative proxy; measured test coverage is not included. | Push, Cloud |
| YAGNI | Flags code with no caller and no need. | Push |
| Duplication | Flags copy-pasted logic inside the diff. | Push |
| Imports | Fails when changed-file imports don't resolve. | Push |
| AI code patterns | Denies AI-typical bug classes: tmp names, TOCTOU, non-atomic writes. | Push, Cloud |
| Anti-pattern | Denies known-bad structural patterns. | Push, Cloud |
| Unreachable | Flags code no path can reach. | Push, Cloud |
| Cycles | Denies new import cycles. | Push |
| Fail-fast | Requires failures to surface, never pass silently. | Push, Cloud |
| Size | Enforces change-size discipline. | Push, Cloud |
| Edit syntax | Checks supported JavaScript and JSON files for syntax errors. | Cloud |
| Modularity | Enforces module boundaries. | Cloud |
| Placeholder | Flags placeholder code shipped as real. | Cloud |
| Code slop | Flags sloppy patterns inside the diff. | Push |
| Types | Type-checks the changed TypeScript. | Push |
Security
| Guard | What it checks | Runs at |
|---|---|---|
| Secret scan | Blocks pushes when configured secret scans detect exposed credentials. | Push |
| Exfil | Blocks exfiltration patterns in changed code. | Push, Verify, Cloud |
| Isolation | Work stays inside its allowed paths. | Directive |
| OWASP LLM | Flags the LLM risk classes. | Directive |
| Commit identity | Checks commit authorship against the configured owner identity. | Push |
Tests & evidence
| Guard | What it checks | Runs at |
|---|---|---|
| Regression | Guards the named regressions. | Directive |
| Canary | Canary evidence before release. | Directive |
| Test quality | Flags hollow tests that assert nothing. | Push, Cloud |
| Findings | Every claim needs a logged finding. | Verify |
| Test edit | Flags weakened or deleted tests. | Verify |
| Observe | Requires observed behavior over assertion. | Verify |
| Claim confidence | Scores how sure a claim may sound. | Verify |
| Source support | Checks that cited files and line references resolve. | Verify |
| External facts | Checks outside claims against evidence. | Verify |
| Claim entailment | Fails claims the evidence doesn't entail. | Verify |
| Evidence | Blocks evidence-free pass claims. | Done |
| Best-of-N | Requires the sampled-N evidence where set. | Done |
| Critic lenses | Runs the independent review lenses. | Done |
Planning & coordination
| Guard | What it checks | Runs at |
|---|---|---|
| Plan | The plan critic passes before work starts. | Directive |
| Plan challenge | Checks the plan-challenge record for complex goals and reports missing evidence. | Directive |
| Contracts | Task contracts keep their shape. | Directive |
| Contract layout | Advisory: contract files laid out right. | Directive |
| Criteria | Pass criteria stay consistent. | Directive |
| Recursion budget | Delegation depth stays capped. | Directive |
| Roster | The reviewer roster is complete. | Directive |
| Reviewer goal binding | Reviews stay bound to the goal. | Directive |
| Playbook | Checks the playbook is current. | Done |
Session & context
| Guard | What it checks | Runs at |
|---|---|---|
| Session bootstrap | Registers the session and starts cloud push. | Session |
| Intake log | Logs every prompt as a checkbox to triage. | Session |
| Model | Keeps verify roles off the weakest tier. | Session |
| Reread | Denies rereading files already in context unchanged. | Session |
| Rewrite | Forces Edit when a rewrite keeps most lines. | Session |
| Orchestrator | Warns on oversized tool results before they bloat context. | Session |
| Precompact | Snapshots the run state before compaction. | Session |
| Session restore | Rebuilds context and issues the restart handoff. | Session |
| Quiesce | Restart only when helpers are quiet. | Directive |
Writing
| Guard | What it checks | Runs at |
|---|---|---|
| Brevity | Caps final replies short while evidence stays exempt. | Session |
| Commit | Blocks long subjects and AI credit. | Push |
| Comment verbosity | Flags comment bloat and narrated noise. | Push, Verify, Cloud |
| PR text | Scans PR title and body for forbidden phrases. | Push |
| AI writing | Catches signs-of-AI prose in public text. | Push, Cloud |
Delivery & completion
| Guard | What it checks | Runs at |
|---|---|---|
| Prepush | Runs the scanners before every push. | Push |
| SHA256SUMS | Fails when shipped files drift from their hashes. | Push |
| Door parity | Keeps all four install doors equivalent. | Push |
| Gate | Checks the diff and denies on failure. | Push |
| PR size | Reports oversized pull requests without blocking. | Push |
| Push main | Denies pushing to origin's default branch. | Push |
| Canary gate | Deploy goals must pass the canary gate. | Directive |
| Done | The done preflight itself runs clean. | Directive |
| Gate cache | Cached gate results stay honest. | Directive |
| Merge | Denies merging on red or unchecked CI. | Merge |
| Postmerge cleanup | Flags branch cleanup and names leftovers. | Merge |
| Stop | Blocks stopping until every pass cites logged proof. | Session |
| Intake | Every logged prompt must be triaged. | Done |
| Cleanliness | Flags workspace dirt before done. | Done |
Understand enforcement coverage
A guard can block an action only where the coding tool or repository workflow exposes an enforcement point. Claude Code has the full hook integration; other tools support a smaller set or telemetry and routing. See the integration coverage before relying on a particular gate.
Respond to a failed check
For example, if a configured secret scan finds an exposed credential, resolve the finding and rerun the check before pushing. If merge checks remain pending or failed, wait for or repair those checks before retrying the merge.
- Read the check name and the condition that failed.
- Fix the code, configuration or missing evidence identified by the result.
- Rerun the check against the current revision.
- Review the resulting evidence before continuing to the next gate.
A passing guard confirms its tested condition. It does not establish that every possible defect or security issue has been ruled out.