The agents do not decide when to ask you. A file does.

{
  "$comment": "The human gates. Bellows and the guard hook read this file. A rule that matches turns an agent action into a question for Priya. Decisions: 'ask' stops and prompts; 'deny' blocks with the reason. Keep this file short; every rule is a promise you make to the humans on the team.",
  "owner": { "name": "Priya Raman", "notify": ["slack:#alderline-gates", "sms:+1-503-555-0142"], "quietHours": "22:00-07:00 America/Los_Angeles" },
  "budgets": {
    "maxMinutesPerRun": 45,
    "maxRunsPerIssuePerDay": 6,
    "maxReviewRounds": 2,
    "maxQaFailsPerIssue": 3,
    "maxDailySpendUsd": 40
  },
  "rules": [
    { "id": "prod-deploy", "when": { "tool": "Bash", "command": "vercel .*--prod|vercel promote|npm run deploy" }, "decision": "ask", "reason": "Production deploy. Always a human." },
    { "id": "spend", "when": { "tool": "Bash", "command": "vercel domains add|stripe |npm publish|aws |gcloud " }, "decision": "ask", "reason": "This can cost money or change an account." },
    { "id": "delete-data", "when": { "tool": "Bash", "command": "DROP |TRUNCATE |DELETE FROM|rm -rf|prisma migrate reset|db:reset" }, "decision": "ask", "reason": "Deletes data. Priya confirms the target first." },
    { "id": "force-push", "when": { "tool": "Bash", "command": "git push .*--force|git push -f|git reset --hard origin" }, "decision": "deny", "reason": "History is shared. Open a new commit instead." },
    { "id": "secrets", "when": { "tool": "Edit|Write|MultiEdit", "path": "(^|/)\\.env(\\.|$)|secrets?/|\\.pem$|\\.key$" }, "decision": "deny", "reason": "Secrets never go through an agent. Priya sets them in Vercel." },
    { "id": "billing-code", "when": { "tool": "Edit|Write|MultiEdit", "path": "^src/billing/|^src/lib/payments" }, "decision": "ask", "reason": "Billing code. Warden's threat note and Priya's yes come first." },
    { "id": "auth-code", "when": { "tool": "Edit|Write|MultiEdit", "path": "^src/auth/|middleware\\.ts$|proxy\\.ts$" }, "decision": "ask", "reason": "Authentication and the access gate." },
    { "id": "migrations", "when": { "tool": "Edit|Write|MultiEdit", "path": "^drizzle/|^prisma/migrations/|^migrations/" }, "decision": "ask", "reason": "Schema change. Show the migration and the rollback." },
    { "id": "customer-send", "when": { "tool": "Bash|mcp__gmail__send_message|mcp__resend__*", "command": "resend|sendgrid|mail\\.send|twilio" }, "decision": "ask", "reason": "Anything that reaches a real customer is sent by Priya." },
    { "id": "external-network", "when": { "tool": "Bash", "command": "curl .*(?<!vercel\\.app|localhost|127\\.0\\.0\\.1|api\\.linear\\.app|api\\.github\\.com)[a-z]/" }, "decision": "ask", "reason": "Calling somewhere new. Say where and why." }
  ],
  "escalations": [
    { "id": "review-deadlock", "when": "Flint and Ember disagree after maxReviewRounds", "decision": "ask", "reason": "Two engineers, two opinions. The founder picks." },
    { "id": "qa-third-fail", "when": "Gauge reports THIRD FAIL", "decision": "ask", "reason": "Three cycles usually means the spec is wrong, not the code." },
    { "id": "flaky", "when": "Gauge reports FLAKY", "decision": "ask", "reason": "Reruns hide bugs. A human decides whether to quarantine the test." },
    { "id": "security-high", "when": "Warden reports any High or SECRET FOUND", "decision": "ask", "reason": "Rotate the key, then decide." },
    { "id": "scope-size", "when": "Anvil sizes a slice above 5 points", "decision": "ask", "reason": "Big slices hide risk. Approve the split or the exception." },
    { "id": "customer-data", "when": "Anvil flags customer-data, auth, billing or delete", "decision": "ask", "reason": "Priya sees every change to what customers trust us with." },
    { "id": "budget", "when": "Any budget above is exceeded", "decision": "ask", "reason": "Spend and time are the founder's call." }
  ]
}

Two decisions only. ask stops and prompts a human. deny blocks and tells the agent why, so it can do the right thing instead. There is no "warn". A warning an agent can read and ignore is not a gate.

#!/usr/bin/env node
// .claude/hooks/guard.mjs — the PreToolUse gate.
//
// Claude Code runs this before every Bash, Edit, Write and MultiEdit call and
// passes the call as JSON on stdin. We match it against .claude/gates.json.
// A matching rule with decision "ask" makes Claude Code prompt the human
// before the tool runs; "deny" blocks it and tells the agent why. Everything
// else passes through untouched. Every decision is appended to the telemetry
// log so the dashboard can show how often gates fire.
//
// Output shape (check the current Claude Code hooks docs before relying on it):
//   { "hookSpecificOutput": { "hookEventName": "PreToolUse",
//       "permissionDecision": "allow" | "ask" | "deny",
//       "permissionDecisionReason": "..." } }

import { readFileSync, appendFileSync, mkdirSync } from 'node:fs';
import { dirname, join } from 'node:path';
import { fileURLToPath } from 'node:url';

const here = dirname(fileURLToPath(import.meta.url));
const root = join(here, '..', '..');
const gates = JSON.parse(readFileSync(join(here, '..', 'gates.json'), 'utf8'));

let input = '';
for await (const chunk of process.stdin) input += chunk;
const call = input ? JSON.parse(input) : {};
const tool = call.tool_name || '';
const ti = call.tool_input || {};
const command = ti.command || '';
const path = (ti.file_path || ti.path || '').replace(/\\/g, '/').replace(root.replace(/\\/g, '/') + '/', '');

function matches(rule) {
  const w = rule.when || {};
  if (w.tool && !new RegExp('^(' + w.tool + ')$').test(tool)) return false;
  if (w.command && !new RegExp(w.command, 'i').test(command)) return false;
  if (w.path && !new RegExp(w.path).test(path)) return false;
  return Boolean(w.command || w.path);
}

const hit = (gates.rules || []).find(matches);

function log(event) {
  try {
    const dir = join(root, 'telemetry'); mkdirSync(dir, { recursive: true });
    appendFileSync(join(dir, 'events.jsonl'), JSON.stringify({ ts: new Date().toISOString(), agent: process.env.AGENT_NAME || 'unknown', issue: process.env.ISSUE_ID || null, ...event }) + '\n');
  } catch { /* telemetry must never block work */ }
}

if (!hit) { log({ event: 'tool', tool, gate: null }); process.exit(0); }

log({ event: 'gate', tool, gate: hit.id, decision: hit.decision, detail: command || path });
const reason = `[gate:${hit.id}] ${hit.reason}` + (hit.decision === 'ask' ? ' Say in one sentence what you are about to do and wait for Priya.' : '');
process.stdout.write(JSON.stringify({
  hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: hit.decision, permissionDecisionReason: reason }
}));
process.exit(0);

1. Read the call from stdin

   Claude Code pipes the tool call in as JSON: the tool name and its input. For Bash that is the command. For Edit, Write and MultiEdit it is the file path. The hook normalises the path to be relative to the repo so the rules can use short patterns like ^src/auth/.

2. Match against gates.json

   matches() takes the first rule whose tool pattern fits and whose command or path pattern fits. The tool pattern is anchored, so Bash does not match BashOutput. Command matching is case-insensitive. A rule with neither a command nor a path never matches, so a typo cannot create a rule that fires on everything.

3. Decide: allow, ask or deny

   No match: the hook logs a tool event and exits without output, which lets the call proceed under the normal permissions. A match: the hook writes permissionDecision from the rule and a reason prefixed with the rule id. For ask it adds one instruction to the agent: say in one sentence what you are about to do and wait for Priya.

4. Log every decision

   Both branches append one line to telemetry/events.jsonl with the agent name and issue id from the environment Bellows set. The dashboard folds those lines into how often each gate fires, how often it is approved, and how long Priya took. Telemetry never blocks: the write is wrapped in a try so a full disk does not stop the crew.

5. Exit 0

   The hook always exits cleanly. The decision travels in the JSON, not the exit code. Check the current Claude Code hooks docs for the exact output shape; the comment at the top of the file says where to look.

The stop hook

One more hook, for the end of a run. It logs the end so Bellows can measure time, and it notices when the run changed how the crew works: anything under .claude/, AGENTS.md or CLAUDE.md. When that happens it tells the agent to call Quill before it finishes, so the change becomes a learning-log entry. That is how the dashboard counts learning.

#!/usr/bin/env node
// .claude/hooks/on-stop.mjs — runs when an agent session ends.
//
// Records the end of the run in the telemetry log (Bellows records the start),
// and, if the run changed anything under .claude/ or AGENTS.md or CLAUDE.md,
// flags it as a learning event: the crew changed how it works. Quill turns
// those into learning-log entries in the wiki.

import { appendFileSync, mkdirSync } from 'node:fs';
import { execSync } from 'node:child_process';
import { dirname, join } from 'node:path';
import { fileURLToPath } from 'node:url';

const here = dirname(fileURLToPath(import.meta.url));
const root = join(here, '..', '..');
let input = ''; for await (const c of process.stdin) input += c;

let learned = [];
try {
  const changed = execSync('git status --porcelain -- .claude AGENTS.md CLAUDE.md kit', { cwd: root, stdio: 'pipe' }).toString().trim();
  if (changed) learned = changed.split('\n').map(l => l.slice(3));
} catch { /* not a git repo yet */ }

try {
  mkdirSync(join(root, 'telemetry'), { recursive: true });
  appendFileSync(join(root, 'telemetry', 'events.jsonl'), JSON.stringify({ ts: new Date().toISOString(), agent: process.env.AGENT_NAME || 'unknown', issue: process.env.ISSUE_ID || null, event: 'end', learned }) + '\n');
} catch { /* never block */ }

if (learned.length) process.stdout.write(JSON.stringify({ hookSpecificOutput: { hookEventName: 'Stop', additionalContext: 'You changed how the crew works (' + learned.join(', ') + '). Before you finish, call Quill to add a learning-log entry: the lesson as the title, the issue, what changed.' } }));
process.exit(0);