Ring 0 · Hooks

Editing a governed file

Ever had a teammate change code they clearly never read the docs for?

Refuses an edit to a governed file until the document that governs it has been read in this session.

git commit

Ever pushed code that didn't even compile?

Refuses a commit that does not build or pass its own checks, before the broken state exists at all.

git push

Ever had someone accidentally push straight to main?

Refuses a push that would land straight on main, on the machine that attempted it.

Guards: publish the branch

Creating a pull request, or editing its title/description

Ever opened a PR that was missing half the info reviewers needed?

Refuses to open or edit a pull request until it carries everything a reviewer needs to judge it.

Guards: open a pull request, revise a pull request, grant a waiver

Creating a task Issue, or editing its title/description

Ever seen a ticket with zero context on why it exists?

Refuses to open or edit a task Issue until it carries the full reasoning behind the task.

Guards: create a task issue

Writing to pull requests or Issues through the raw API

Ever had a bot silently edit a PR or issue behind your back?

Refuses raw API writes to pull requests and Issues, so nothing can edit them behind the gates.

Guards: open a pull request, revise a pull request, grant a waiver

Merging

Ever had a broken build get merged anyway?

Refuses a merge while anything the gates check is still failing.

Starting the Dig

Ever started work only to find out halfway it was blocked on something else?

Refuses to start work until every precondition for the task is checked live and found clear.

Opening a task PR whose surface includes real code

Ever had a PR's description quietly stop matching what the code does?

Refuses a code-carrying pull request whose description no longer matches what it changes.

Opening a task PR (final self-check before creation)

Ever opened a PR and only then discovered the tests were failing?

Runs the whole exit check before a pull request is created, so failures surface first.

Spawning a check (vinaya check, ring-0 pre-push AND ring-1 CI)

Ever had a check quietly read a secret it had no business seeing, because nothing scoped what it could reach?

Governs which environment variables a spawned check's child process can see, instead of every check inheriting the full parent environment unconditionally.

vinaya check / vinaya check --plan (a CLI mechanism, not a git hook — this row is .husky-free)

Ever had a config entry silently double-run alongside the core check it was meant to replace, with no way to see that from the outside?

Resolves core-registered and config-registered checks into one deterministic table before anything runs, instead of letting a config entry run alongside the core check it collides with, unannounced.