claudeguard-integritylisted

# ClaudeGuard Integrity — the gate that does not judge This skill runs a **deterministic** static-analysis gate over the whole merged tree. It is the sibling of `claudeguard`, and the difference is the point: | | `claudeguard` | `claudeguard-integrity` | |---|---|---| | decides by | an LLM reading a diff | mechanical analysis (AST + bytes) | | scope | the diff | the whole tree, merged code | | when | pre-merge | in your test command, so also pre-push and CI | | failure mode it covers | intent, policy, judgement | drift, and what review cannot see | **Your judgement is not an input here.** Run it, read the findings, report them. Do not argue with a finding, and never "explain away" one you believe is wrong — if a rule is wrong, the fix is a change to the config, not a verdict you talk past. ## Running it ```bash bun run src/cli.ts --config <path-to>/integrity.config.ts [--root <dir>] ``` Exit `0` = clean, `1` = at least one finding, `2` = could not run. Those last two are deliberately different: **"never looked" must never be reported as "found nothing".** Most projects wrap this in a script (`integrity:check` or similar) and put it in the same command as lint and tests. If the project has one, prefer it — it carries the right `--config`. An MCP surface exists for mid-session use: ```bash bun run src/mcp.ts --config <path-to>/integrity.config.ts ``` Its tool `check_integrity` **takes no arguments**: the ruleset and the root are pinned at startup, because a caller who