Three checks and a lock

flowchart LR
  A["agent runs a command<br/>or edits a file"] --> H{{"1 · tool-call hook"}}
  H --> C["commit"] --> K{{"2 · commit check"}}
  K --> P["pull request"] --> I{{"3 · CI"}}
  I --> R{{"lock · your review"}} --> M["main"]

	Runs	Stops
1	before each tool call	tag pushes, force pushes, skipped checks; root commands, wipes of the home or a system folder, disk commands; test edits in a fix task; a worker editing the rules; a program the project blocks; an issue or pull request title that breaks the title rules; personal data or a secret in an issue, pull request, comment or release note an agent posts with gh; cancelling or deleting an Actions run
1b	when a Claude Code agent ends its turn	the same personal data, secrets and file rules as the commit check, in the changed files. It sends the agent back once with the findings
2	on every commit	what the hook can’t see: files changed by sed or a script, personal data, an overfull folder
3	on every pull request	a commit made with the hook off
lock	on the server	a merge without your review, a push to main, a release tag that isn’t yours