code-warden

name	code-warden
description	AI development governance protocol for Codex, Claude Code, and Cowork. Enforces modular architecture, adversarial feedback, patch-first editing, blast radius safety, zero-trust secrets, and context drift prevention. Use at the start of any coding session, when generating or modifying modules, when refactoring existing code, when making architectural changes, or when any of the following are said: "load protocol", "apply dev rules", "check the rules", "start a new module", "review this before we write", "are we following the rules", "new session", "begin coding", "load code-warden", "governance check", or any request to begin writing code.
metadata	{"author":"Justin Davis","version":"3.1.1","category":"development-governance","changelog":"v3.1.1 (2026-05-15): Stabilization. Behavioral tests (8 scanner/hook pass/fail\n cases via node:test). Shared policy modules: lib/line-count.js, lib/secret-patterns.js,\n lib/file-collection.js, lib/config.js. Line-count off-by-one fixed (trailing newline).\n Secret-pattern drift fixed (GitHub token gh[posx]_ → gh[pousr]_ unified across all consumers).\n README wording: zero-trust secrets policy (governance) vs hardcoded credential scanner (impl).\nv3.1.0 (2026-05-15): Codex partial hook enforcement. --hooks=codex installs\n PreToolUse hooks for apply_patch (secrets + estimated size) and Bash (secrets).\n Hooks live in tools/hooks/codex/. Claude hooks moved to tools/hooks/claude/.\n Doctor and verify-target validate Codex hook paths via ~/.codex/hooks.json.\nv3.0.0 (2026-05-15): Optional Claude Code hooks package. --hooks=claude installs\n PreToolUse hooks that block writes violating file-length or zero-trust secrets\n policy before they happen. --uninstall-hooks=claude removes them. Doctor and\n verify-target validate hook script paths when hooks are registered.\nv2.8.0 (2026-05-15): Added --verify-target=<id> strict per-target health check.\n Unknown target IDs exit nonzero. Known but not-installed targets exit nonzero.\n Added npm scripts: install-list, install-doctor.\nv2.7.1 (2026-05-15): Added Scope Gate and Plan Gate pre-implementation declaration\n blocks. Both gates must be confirmed before any code is written. Covers goal,\n non-goals, files in/out, patch order, blast radius class, and post-patch checks.\nv2.7.0 (2026-05-15): Added GitHub Actions CI template and npm run ci script.\n Code-Warden now enforces file length and zero-trust secrets outside the chat session.\nv2.6.0 (2026-05-15): Added cross-platform auto-installer with app detection,\n atomic install, --doctor health checks, and Windsurf flat-file adapter.\nv2.5.0 (2026-05-14): Added Research and Fit governance to force live research\n for current facts and challenge default stack/product assumptions.\nv2.4.0 (2026-05-14): Added operational governance for verification evidence,\n source-control hygiene, dependency control, and technical claim sourcing.\nv2.3.1 (2026-05-14): Added Codex/shared-agent install support, AGENTS.md context discovery,\n ASCII tool output for reliable terminals, and refreshed setup docs.\nv2.3.0 (2026-03-26): Added stronger secret scanner, Windows installer, README, version sync,\n and broader Claude context discovery.\nv2.2.3 (2026-03-25): Replaced soft checklist with mandatory Hard Gate output block.\nv2.2.2 (2026-03-25): Added verifiable Pre-Flight manifest, CONFIGURE.md, and examples.\nv2.2.1 (2026-03-25): Fixed reference paths, triggers, DECISIONS.md stub, and checkpoint threshold.\nv2.2.0: Added anti-drift.md, Anchor Check, and Drift Trigger Response Protocol.\nv2.1.0: Added modular references for safety, cognition, cleanup, architecture, and anti-drift.\nv2.0.0: Initial production release.\n"}

code-warden v3.1.1

Production-grade AI development governance skill. Load at the start of every session involving code generation, refactoring, or architectural changes.

Session Start - HARD GATE

Do not ask implementation questions. Do not gather requirements. Do not proceed past this block until all outputs are produced and confirmed by the user.

Mandatory sequence — produce in order, each confirmed before the next:

1. Architecture State (below)
2. Session Scope (below)
3. Reference Files (below)
4. Scope Gate — see references/planning-gates.md
5. Plan Gate — see references/planning-gates.md (fires after Scope Gate confirmed)

Before responding, execute node <installed-skill-dir>/tools/get-context.js if you lack architectural context.

Common install directories:

• Codex shared agents: ~/.agents/skills/code-warden
• Codex local skills: ~/.codex/skills/code-warden
• Claude Code: ~/.claude/skills/code-warden

Output this block as your first response before anything else:

---

ARCHITECTURE STATE (Re-injection Rule)

[Paste the context found by get-context.js or provided by user. If none found, write:]

[WARN] No architecture doc found - applying Re-injection Fallback:

• Last known files: [list any files mentioned in this session]
• Current data flow: [unknown - user must provide before proceeding]

REQUEST: Paste your architecture doc, PRD, or a 3-sentence scope summary before we continue.

SESSION SCOPE (Session Scoping Rule)

This session is scoped to: [module/feature name] Files in scope: [list] Files explicitly OUT of scope: [everything else]

[If scope is unknown, write:]

[WARN] Scope undefined - user must confirm before proceeding.

REFERENCE FILES LOADED (Blueprint Rule)

For this task, loading: [list relevant references/ files] Status: [PASS found | WARN missing from install - rules enforced from prompt]