Each guardrail has an enforcement mechanism and a source - click any card for details
hookplugin
Branch Protection
Blocks git commit, push, and merge on protected branches (main, master, staging)
hookplugin
Worktree Guard
Detects active worktrees at session start, injects warning to work in .worktrees/ directory
hookplugin
Review Gate
Blocks PR creation unless review verdict exists and has no critical/high findings
hookskillplugin
Verdict Bridge
Review writes verdict JSON, hook reads it before PR. Bridges LLM review with deterministic gate.
hookplugin
Secrets Guard
Blocks reading .env, *.pem, *.key, credentials.json and similar files. Blocks bash commands that expose secrets.
hookskillplugin
Test First
Hook reminds on production file edit. Skill defines the TDD workflow: failing test before code.
hookplugin
OpenSpec Check
Reminds to create proposal when editing production code without active OpenSpec change.
CLAUDE.md.claude/rules/
Brainstorming First
Creative work must start with exploration: clarify intent, explore approaches, design before code.
CLAUDE.md.claude/rules/
Drift Check
After 3+ autonomous steps, re-read original request. Stop if scope shifted.
CLAUDE.md.claude/rules/
Self-Review
Re-read every changed file before done. Check for debug code, hardcoded values, edge cases.
CLAUDE.md.claude/rules/
Stop and Ask
Stop on: ambiguous requirements, API/schema changes, 2 failed approaches, scope growth.
CLAUDE.md.claude/rules/
Minimal Blast Radius
Touch only what the task requires. Note adjacent improvements separately, don't bundle.
CLAUDE.md.claude/rules/
Verify Before Done
Demonstrate it works: tests pass, behavioral diff, or build succeeds. Not done until verified.
CLAUDE.md.claude/rules/
Self-Learning
Capture corrections and discoveries to .claude/learnings/log.md. Harvest into skills/rules when 10+ ACTIVE entries accumulate.
hookplugin
/df:doctor
Verifies all guardrails are working. 11 checks, zero LLM.
CLAUDE.mdproject
Review Dimensions
Project-specific review dimensions. Generated by /cs:init, discovered by /df:review.
CLAUDE.mdproject
Domain Invariants
Business rules: state machines, tenant isolation, entity lifecycle. Generated by /cs:init per project.