The exit code is the load-bearing piece. The script hands its message back to the model through the code it exits with [4], and that is what makes a refusal cost nothing: the session reads why the move was refused and which move to make instead, in the same message [15]. The published text for a force push says it rewrites history other sessions may have built on, tells the model to push to a new branch and open a merge request, and states outright that this is not an owner-permission question [17]. Every rule in the destructive class is shaped that way [16]. Only a credential or a release ends with "the owner runs it", because that shape parks a parallel session on the scarcest resource on the machine [14], which the writeup calls the most expensive event there is, against a redirect it calls free [26].
Grepping a rule file proves the rule was written, not that it loads in the session about to break it. That is the gap the hook closes, and it closes it by loading in every permission mode rather than in one directory [3].
The admission bar is throughput, not caution: a rule qualifies only if it fires almost never, or if it prevents cross-session destruction that makes other sessions redo work [9]. A plain push, a new branch, a dry-run clean and deleting build output are all left alone [10]. The published table comes out at five refusals against five passes [24], and the suite is deliberately balanced between blocking and passing cases, with the passing half weighted heavier, because a false block on a move that runs dozens of times a day costs more than the rule saves [11]. Two of the passes are worth reading closely: git reset --hard passes in a solo repo, and rm -rf clears node_modules and a build output directory [13]. The same command is refused only inside the shared working tree [12].
The doctor is the part I would copy first. A field rename in the harness would leave the known-bad cases quietly passing, so it fails loudly instead of letting the guard permit everything [19]. Its 59 cases do not split evenly, so the closest the two halves get is 29 and 30 [23]. The false-positive half paid for itself before the rules landed, catching a repetition operator from the wrong regex dialect, a separator consumed twice so the recursive clean never matched, and a commit message scanned as command text, which made the guard refuse its own landing commit because the message contained the table of moves it refuses [20]. Heredoc bodies are prose now [21]. A guard that will not let you commit the guard is at least consistent.
For any of this to transfer, a harness has to do three things: call a hook before every tool call in every permission mode [3], hand that hook the call as JSON [4], and route a non-zero exit's message to the model rather than to a terminal nobody is reading [4]. Without the third, every rule degrades into a block that waits for a person, and the whole cost argument inverts. The 59 cases are a measure of one harness's habit of renaming its fields [18], not a safety rating.
What the account does not carry is a false-block rate from the nightly and noon runs, an incident count since the change, or any operator beyond the author. The two mis-rooted sessions are the only violations reported [8]. And the guard is parsed before every tool call in every session on the machine, so a syntax error in it stops every tool [22], including the edit that would repair it [25].
