Map it before you touch it.

1. 26 Oct 2026 · 6ac960f
   The build gate stopped asking about file writes when he has switched prompts off, and a single letter such as A or 1B now counts as a menu pick.
2. 15 Oct 2026 · dce950f
   A file write inside a separate working copy of a project passes the gate, because helper agents were asking him to approve every edit.
3. 15 Sept 2026 · 6bd79a1
   The repeat-command hook began leaving a trace each time it runs, so it can be shown to have run.
4. 7 Sept 2026 · 927b41b
   The skill went back to its earlier text, because the older memory it reads came back and nothing needed renaming.
5. 7 Sept 2026 · 54fb511
   The pair of memory lookups shipped three hours earlier was measured and corrected.
6. 7 Sept 2026 · 640c9a0
   When the older memory stopped working, the skill was pointed at the newer one, and the history was kept.
7. 7 Sept 2026 · aea06b0
   The repeat-command hook, a different hook with a similar name, was changed to speak only when a command has failed before, since a past success tells nothing.
8. 1 Sept 2026 · b9975ab
   Added the already-built check: a plain text search for every name the skill is about to call missing.

Dates and short codes are from the version history of the skill and of the write gate (the build-gate hook) that holds its rule, newest first. Dates are Israel time. Routine moves and a checkpoint commit are not shown. One line is about a different hook with a similar name, and says so.

It reads

Files and folders, the layout of the database and what changed in it, the names of settings (never their values), scheduled jobs, the skills and tools that already exist, the state of the project’s version history, and two memories of what he has decided.

It writes

Nothing. The skill forbids edits, new files, database changes, deploys and commits, and any call that creates, updates or deletes. Reading, searching and read-only queries are allowed.

Helpers

It may send read-only helper agents to look through many files at once, and must brief them with the same no-write rule.

What it hands back

One report of fixed shape: the scope, what he decided before, what exists, what is missing, the open questions, a numbered build spec and the success checks. The open questions may never be empty; if none are found, the look was too shallow.

How the guard decides

The build gate reads only his last message. Reading and searching pass at once. An explicit “don’t build” wins and the write is held with one question. A go word or a bare menu pick lets it through. With neither, the write is held with one question. Prompt-free mode and a separate working copy relax file writes only; database changes, sends and merges still need a go.

Where it lets a write pass

Scratch folders and logs; file writes inside a separate working copy of a project, since nothing there ships without a merge; and, when he has switched prompts off, file writes unless his last message said not to build.

If it breaks

The gate fails open: if his last message cannot be read, the write is allowed, so a broken gate cannot stop work. The skill alone is only words: in July 2026 a measurement found that a stop from him had often arrived after writing had begun, and that is why the rule became a hook.

A hook with the same name

preflight_action runs before every shell command and database query. It looks the command up by shape in a local index of past commands and speaks only when that shape failed at least a quarter of the times it ran. It never holds anything, and it stays silent if the index is missing.

Code

A skill and two hooks in his private plugin. They are not published, so the commit hashes above are for him to check.

Read from the skill and its hooks on 28 October 2026. No keys or passwords are shown, by rule.