After a session where advisory gates got ignored, this is the honest picture: which gates mechanically block an action, which only nudge, and which are judgment calls no boolean can enforce. Three deterministic soft gates were hardened into blocking hooks on 2026-07-06.
What is this? A robot helper has a list of rules. Some rules are like a locked door: it truly cannot do the wrong thing. Some rules are just a sticky note reminder it can ignore. This page sorts every rule into locked-door, sticky-note, or use-your-brain, so nobody is fooled about which is which.
15hard blocks
8nudges
3hardened 7/6
30hook bindings
Every row below is grounded in ~/.claude/settings.json (the real fired hooks) and the memory index. Nothing here is aspirational: a gate is only in Tier 1 if a hook returns a blocking exit code.
🟢 Tier 1: hook blocks the action (exit 2 / Stop-deny)🟡 Tier 2: injected reminder, does not block🔴 Tier 3: judgment only, no boolean check possible
🟢 Tier 1 — Enforced (mechanically blocks)
These return a blocking exit code, so no session can proceed past them, regardless of recall or which account is logged in. They live on the shared filesystem.
🔒 PreToolUse blockers
yt_politeness_gateNEW 7/6
Blocks raw yt-dlp and youtube-transcript-api pulls. Forces the polite wrapper (serialized flock, random 45–90s spacing, budget cap). The fix for the IP-block I caused.
block_deletesNEW 7/6
Blocks rm / git rm / trash / shutil.rmtree on real user files. Temp zones and build cruft pass. Enforces the standing "never delete, move to delete/" rule.
block_desktop_writesNEW 7/6
Blocks Write/Edit and Bash writes into ~/Desktop (offloaded), except the four anchors. Covers both the file tools and shell redirects/moves.
block_archive_moves
Blocks moving files into any _Archive/ destination. Stops the auto-tidy-the-Desktop pattern.
opus_spawn_gate
Gates spawning Opus-tier agents (Account B billing discipline).
tts_spend_gate
Gates text-to-speech spend before it happens.
🛑 Stop-gates (block the reply)
done_claim_gate
Refuses a "done / complete / shipped" claim unless the turn ran the fraud check or opened the artifact and quoted proof.
source_grounding_gate
Refuses citation-shaped language ("from the corpus", "grounded in") without a real Read/Grep/WebFetch this session.
chat_voice_gate
Refuses replies containing em-dash, ellipsis, correctio ("actually"), antithesis, and the rest of the voice ruleset.
chat_link_gate / chat_donelink_gate
Refuses a reply with no clickable link, and a done-claim with no live URL.
chat_color_gate
Refuses a substantive reply that is not color-coded.
fraud_check_gate
Runs the session fraud check at Stop.
🧩 PostToolUse guards
kid_mode_gate
Enforces the kid-mode button on every HTML artifact.
memory_size_guard
Guards the memory store against oversized files on write.
🟡 Tier 2 — Nudges (injected, do not block)
These inject a reminder into every turn but cannot stop an action. They rely on me reading and obeying, which is exactly the weakness that let the YouTube burst happen. Useful, but not a gate.
💬 UserPromptSubmit injections
honesty_gate_nudge
Injects the three-phase-plan / enumerate-verify honesty directive.
model_fit_gate
Recommends a model tier; advisory only.
inject_shift
Injects the no-quit-shift queue state.
skills_nudge / ultracode_default
Reminds to check skills; forces ultracode framing.
These are real gates in memory, but they need semantic judgment, so no hook can return a clean block. The honest answer is that these will always depend on me applying them, and the defense is the fraud check plus you grading the output, not a green light.
⚖️ Can only be judged, not booleaned
source ≥90% paraphrase
Whether a chapter truly paraphrases the named corpus is a semantic call, not a regex.
one chapter / song per pass
"Bulk-complete" is contextual; a hook cannot reliably tell a legit multi-file change from fraud.
anti-AI voice richness
The tell-list is hooked (voice gate), but "Beato/Neely richness, finish the thought" is taste.
figurative read / intent
Reading the user's intent charitably is judgment by definition.
music theory correctness
Whether a chord analysis is right needs the actual audio and theory, not a string check.
no rapid live curl-poll
Partially checkable; a true poll-loop detector is future work, currently memory-only.