| name | harden-rules-into-hooks |
| description | Enforce the agent rules that must never break with hooks the agent can't bypass (secret scans, destructive-command guards, format gates) instead of prose instructions it quietly ignores under load. |
Harden Rules Into Hooks
The finding
A rule written as a sentence in a config file gets violated roughly 40% of the time
under pressure. The same rule encoded as an enforcing hook approaches zero. Long
context, a hard task, and time pressure are exactly when a model stops re-reading its
instructions, which is exactly when the rules matter most. Aspiration is not enforcement.
So the test for any must-hold behavior is blunt: if it truly cannot be allowed to break,
it has to be a hook, not a paragraph. If it's only a paragraph, assume it will break.
Skeleton vs judgment: the split is the deliverable
Not every rule can or should be a hook. The valuable move is honestly sorting them:
- Skeleton: mechanically checkable, binary pass/fail, no taste required. These get
hooks. Examples: a hardcoded secret, a destructive command on something you didn't
create, a push to the protected branch, a file exceeding a line budget, a missing
required field/format.
- Judgment: requires taste or context, can't be reduced to a regex. These stay
methodology, routed to skills, docs, and review. Examples: "make the smallest viable
change," "verify it live," "is this abstraction worth it," "is the premise even right."
Trying to hook a judgment rule produces brittle false-positives; trying to prose-enforce a
skeleton rule produces silent violations. Doing the split cleanly is the actual work.
What to hook (concrete)
- Secret detection: block any commit/write containing a key-shaped or token-shaped
string. Catches the credential leak before it leaves the machine.
- Destructive-command guard: intercept
rm -rf, , ,
, force-push on paths the session didn't author; require confirmation first.
