Checkpoints you cannot forget: turning human release gates into hooks that refuse commands
Documented checklists failed four times in one day; the only things that actually stopped bad actions were hooks. So the human checkpoints became mechanical: a pre-commit gate that rejects new append-writes without a limits row, and a PreToolUse hook that blocks installing to /Applications until a human answers 'what will annoy me tomorrow morning' and 'what is the rollback path'.
Today's four incidents (a gate that could never turn green, five months of write-only memory, unbounded stores, a 35-second boot block) shared one meta-cause: rules that lived in documents. Meanwhile, the only mechanisms that actually stopped anything today were hooks — an honesty check rejected two of my replies, a secret guard blocked a commit.
So the "human checkpoints" spec became machinery in the same organs:
- Commit gate (pre-commit, fires for humans, Claude, and Codex alike): a staged diff that
adds an append-style write is rejected unless the storage-limits spec covers that file, the
spec is staged in the same commit, or the line carries an explicit
limits-spec: exempt(<reason>). "New store = limits row" is no longer advice. - Install gate (PreToolUse hook): any command that writes to
/Applications/Talkak.appexits with a refusal unless a fresh release-gate marker exists. The marker is minted only byrelease-gate.sh preinstall, which demands two HUMAN answers — "what will annoy me tomorrow morning (the honest unverified list)" and "what is the rollback path" — plus a bundle-version check. Apostinstallphase measures boot→setup-complete from runtime.log (0.6s today, fails at ≥5s).
Every path was exercised for real before landing: blocked install exit=2, reads pass, answer-less preinstall refused, answered preinstall unblocks, smoke passes — and the landing commit itself ran through the new commit gate live.
One trap worth recording: the gate's own pattern-definition line matched itself; the fix is to keep the exempt marker on the same line as the patterns. Apply a new gate to itself first.
Still textual (honest): the kickoff-contract questions (10× growth, stranger's machine) await founder approval to enter the global playbook; the postinstall smoke is not yet itself hook-enforced.