Claude Code First, specification version 0.1.0. The plain-language guide
Version 0.1.0. Level 2. Best evidence grade R3/S3.
GH-2 A gate behind every guard
Every rule a guard enforces MUST also be checked by a gate that runs in CI.
| Field | Value |
|---|---|
| Keyword | MUST |
| Level | 2 |
| Checked | by judgement |
| Findings | F301, F303 |
| Harness facts | H4, H6 |
| Threat | external: one harness and one release window |
| Status | active |
Rationale: a PreToolUse guard answers only for the tools it is matched on, in sessions where it is installed and able to run (H4, H6), and in four projects a gap in it (a tool not matched, a session where it did not load, a clone where it was not built) let work through silently (F301, R3/S3). The backstop two projects name is a gate elsewhere: roadkeep's guard says "the gate is the backstop for the barrier" [roadkeep@91754240:src/roadkeep/guarding.py#L31], and when freewilly deleted its lint workflow the hooks were the only guard and drift reached main by other routes until the lint came back (F303). A gate in CI sees the result whatever route produced it, and whether or not the session had its guard.