sdlc-hookslisted

# Hooks: the part that actually holds A documented rule is advisory — it makes compliance likely. A hook is deterministic: it runs on every matching action, for everyone, whether or not anyone remembered it. **Put a hook behind any rule whose violation you can't live with.** Documentation makes violations rare; the hook makes them not happen. The two together is the working combination — a hook with no explanation is obeyed but not understood, and documentation with no hook is understood but not obeyed. ## Three verdicts - **allow** — pre-approve the safe inner loop, so routine commands don't generate a stream of prompts. Without this the rest becomes noise people click through. - **block** — refuse outright. Exit non-zero; the message goes back to the agent. - **ask** — hold until a specific person approves. ## Where each belongs Most agent actions are file edits and shell commands during implementation, so that's where hooks fire most. **Guardrails — no human in the loop. Use these freely:** | Guard | Why | |---|---| | Block writes to generated output, vendored code, frozen packages | The agent can't know these are off-limits by looking at them | | Format and lint after an edit | Drift never accumulates; review never spends attention on it | | Reject secrets in a staged diff | Cheapest possible place to catch it | | Block test edits during a fix task | Protects the check from whoever is fixing the thing it checks (`sdlc-feedback-loop`) | | Require the plan to change