What it catches

Every shortcut an agent takes to look done maps to a fact it can’t author. The right-hand column is the signal each rule reads — and the agent writes none of it.

Text version of the diagram

the corner-cut	the fact that catches it
strip an assertion / guard line	forbid_removal
delete the failing test file	forbid_delete
commit straight to main	forbid_commit_on_branch
--no-verify to skip the hook	forbid_command
lower a coverage threshold	numeric_floor
edit outside the task	scope_lock
commit a secret / .env	secret_scan
claim a review that didn’t happen	protected_path / attest

A few of the sharpest

• scope_lock — the positive A/M/D allowlist; the structural inverse of every denylist. “Edit a subsystem outside the task.” Scope creep is the single most-reported agent failure class, and no denylist can express “any file not in the allow-set.”
• numeric_floor — the one-way floor. It pairs a number across the removed and added lines on the same key, so lowering fail_under 85→75 (which looks byte-identical to a raise if you only scan the added lines) blocks. Disarms the very quality gate the DoD exists to protect.
• self_protect — the live-write fact. A Write/Edit to a gate-defining file is denied at PreToolUse, so the agent can’t quietly loosen its own gate mid-session.
• forbid_removal — the - twin of forbid_pattern: a removed guard line (an assert, an await, an auth check) blocks. “Silently delete the safety net” — the cut a tool that only scans the added lines can’t see.

Where the rules came from

These aren’t a guess about how agents cut corners. The fact-kind primitives were derived two ways: a first-principles pass over how agents cut corners, then an empirical mining of real AI-authored PR/commit/review history — a 30-agent sweep over nine corpora that surfaced 95 findings, synthesized 19 candidate gaps, and adversarially verified six as real, ungameable facts. The full evidence (with issue/commit citations) is the coverage map →.

The full primitive library

Every check reads only facts — never your code. The 26 below; full field reference in SCHEMA.md. This table is generated from the registry in docs/primitives.md.

primitive	kind	decides over
forbid_command	fact	the agent’s command string — deny matches the normalized verb (agent layer)
forbid_commit_on_branch	fact	the live current branch (agent layer)
self_protect	fact	a live Write/Edit to a gate-defining file (agent layer)
secret_scan	fact	added lines vs token shapes + forbidden file globs
forbid_pattern	fact	added lines under a path scope
forbid_removal	fact	removed lines under a path scope
forbid_delete	fact	per-file D-status (a deletion under scope)
scope_lock	fact	every A/M/D path must be inside the allowlist (scope creep)
numeric_floor	fact	a value’s direction across the diff (lower coverage / raised retries)
change_budget	fact	count ceilings over the diff (blast radius)
file_must_contain	fact	an added/changed file in scope must add a matching line
max_added_file_bytes	fact	a per-file byte ceiling (vendored bundles, stray binaries)
path_requires	fact	name-status: if when changed, need must too
cooccur	fact	if trigger appears, require must too
marker_present	fact · agent	a marker block exists in the PR body
forbid_in_message	fact	forbidden tokens in a commit/PR message (e.g. [skip ci])
require_message_pattern	fact	every commit/PR message matches a shape (e.g. Conventional Commits)
commit_footer	fact	every commit ends with the required footer
protected_path	fact	gate-defining files changed → need an independent approval
require_approval_from	fact	a change under paths needs an owner’s APPROVED review (CI)
pattern_requires_approval	fact	an added line matching pattern needs an approval (CI)
approval_policy	fact	the approval is fresh, human, non-author, no changes-requested (CI)
require_checks_green	fact	every required status check concluded success (CI)
run	fact*	shell-out; the exit code is the fact (block only at the change layer)
attest	advisory	a class-gated Stop-hook checklist box (forcing function)
judge	advisory	an advisory LLM-judge prompt for a CI substance check

The eight semantic-weakening classes a fact can’t prove (assertion-loosening, fake-impl, guard-removal, …) ship as the advisory judge library — see the coverage map.

Want to feel it? Try it live →