A flag file in /tmp decides whether the agent is allowed to stop

Exit 2 is the whole of the enforcement. The Stop event is the harness asking whether the turn may end, and a non-zero exit from the hook hands the refusal back to the model inside the session, not in an instruction it has been drifting away from for the last ten hours ^{[2] [10]}. That is the part of this design that travels: the check lives where the session ends, so forgetting the prompt or swapping the model does not disarm it ^[10].

What gets checked is narrower than the framing suggests. The Stop hook parses the transcript JSONL in Python, pulls the last assistant text, and searches it for audit keywords ^[3]. Keywords present, exit 0 ^[4]. The gate checks the report the model writes, and stops there. An agent that has learned the vocabulary clears it with a paragraph. Writing that paragraph still forces a pass over the diff, which is worth something, but this is a lexical check and should be sized as one.

The two-hook split is the good engineering here. PostToolUse fires on a file write or edit and touches /tmp/claude-audit-pending-{sid}; the Stop hook looks for that flag and exits silently when it is absent, so conversation-only turns stay quiet ^[5]. The author's first version prompted on every turn, and a performance review dated 2026-07-11 concluded the audit had become a ritual that was wrecking the actual work ^[6]. Getting from there to here required a redesign that went well beyond a config tweak.

The trigger set is worth checking closely. The flag rises on Write and Edit events ^[5]. An agent that patches through Bash with sed -i or git apply changes the tree without ever touching those tools, and the Stop hook has no way to know a change happened.

The unattended-run fix is where the arithmetic gets interesting. Nineteen sdk-cli automation runs fired overnight on 2026-07-12 and stacked 19 audit requests into stderr with nobody there to read them ^[7]. There is also a per-session cap of two prompts, held in a counter file ^[9]. So the cap alone would have left a ceiling of 38 messages on that night's runs rather than eliminating them ^[12]; the entrypoint check is what actually silences it, by reading the first 15 lines of the session and skipping when "entrypoint":"sdk-cli" appears ^[8].

The premise underneath all of it is that a prompted "always self-audit" is followed some of the time and dilutes as the session grows ^[1]. The post does not measure that fraction, and it does not report how much broken code the hook has caught ^[14]. What it documents precisely is two dated regressions in the hook's own behaviour and the fixes that followed ^{[6] [7]}. Read it as a working record of making a blocking gate quiet enough to live with in 67 lines of bash ^[13]; it says little about actual defect rates. For the mechanism to transfer you need a harness that exposes a blocking Stop hook and a tool-use hook, an agent that edits through those tools, and a human in the session to receive the refusal ^[8].