Guard hooks add deterministic checks around archive writes, protected Git
operations, and pipeline publication. They complement the pipeline’s written
contracts. Git hooks and native tool hooks have different coverage.
Install guards
Use an initialized Git repository and Python 3.9 or newer. Run from the GSD
Path clone when installing project contracts for the first time:
Select only the hosts you use. For an existing project with contracts, add
guards without replacing those contracts:
Understand enforcement
The installer resolves the effective Git hooks directory, including
core.hooksPath and linked worktrees. Native guards reject malformed events
or events they cannot validate.
Codex requires you to review and trust the project hook configuration in
/hooks. Until activation is complete, treat the installation as Git-only
enforcement. Review changed hook definitions again after updates.
Recognize expected blocks
Guards can reject writes to shipped archives, destructive Git commands,
ambiguous shell destinations, changes to routing controls, and publication
outside the ship contract. Read the reported reason and use the named pipeline
helper or forensics to proceed.
The precise command rules and host caveats live in
HOOKS.md.
See updating to refresh installed guards. 