Prose-only fixes for skill-trigger reliability keep proving insufficient - decide where hooks belong

[ptr727]

What happened

Across two related but distinct incidents, prose-only enforcement of a critical behavior has
proven unreliable, and the maintainer's own conclusion on #1073 states the general lesson
plainly: "Agent can not be trusted to follow written rules, we must enforce critical behavior in
blocking code."

Incident 1 (this issue's original subject, #1073): an agent worked directly in a shared hub
checkout instead of its own worktree, twice, despite the rule being stated in both the host-wide
CLAUDE.md block and the resync-a-repo skill text it had just loaded.

Incident 2 (surfaced 2026-08-29, this session): local-strict-review (a skill whose own
description states an explicit, detailed trigger: "before a unit of work is pushed toward a pull
request or claimed done") was not being invoked automatically across many sessions unless the
user explicitly reminded the agent to use it — despite already having been chained into
drive-pr, pr-review-conduct, and agent-conduct's own trigger moments once already (PR #1065,
issues #1056/#1057/#1059), specifically to fix this same complaint.

Root cause found for incident 2 (fixed via PR #1081)

Claude Code (the CLI) reads CLAUDE.md for project memory, never AGENTS.md, confirmed
against current official docs. This repo (and every fleet repo, by the same convention) carries
AGENTS.md as its provider-agnostic instruction file specifically so Codex, opencode, and Claude
Code all read the same rules with no per-provider duplication — but that design silently failed
for Claude Code specifically: AGENTS.md never reached a Claude Code session's context
automatically at all. It only surfaced when an agent chose to read it mid-task on its own
initiative, an unreliable path. PR #1081 adds a root CLAUDE.md using Claude Code's official
@AGENTS.md import syntax, closing that specific gap, and registers it as a new fleet-wide
baseline entry so every repo picks it up via its own next resync/audit.

That fix should measurably improve trigger reliability for skill-description-based rules in
Claude Code sessions specifically going forward, but it does not fully close the underlying
pattern:

• It only helps Claude Code sessions. Codex and opencode were already reading AGENTS.md
  natively (per the fleet's own provider-agnostic design), so if incident 2's actual root cause
  were purely "wrong file read," Codex/opencode sessions should not have exhibited the same
  unreliable-triggering symptom — worth checking whether they have, since if they have too, the
  CLAUDE.md fix does not explain the whole pattern.
• Incident 1 was not a skill-trigger problem at all: the rule was present, loaded, and read (the
  agent's own retrospective in Prevent one repo from modifying the state of another repo, force them to work in worktrees using safety hooks #1073 confirms it read the text), and still was not followed. No
  file-loading fix addresses that class.
• A skill's trigger description competes with everything else in a long session's context for
  attention at the exact moment it matters (mid-task, many turns after the skill list was last
  shown), which is a structural property of relying on any prose-based trigger, not a bug in one
  file's wording.

What #1073 already proposes, and what to decide

#1073 asks for "safety hooks" to force worktree isolation mechanically, the same category of fix
this repo already ships for GitHub write safety (gh-write-guard). Given incident 2's own fix
history — two rounds of prose-only fixes (chaining into three other skills' trigger moments,
then a CLAUDE.md load-reliability fix) that each helped but did not fully close the complaint —
the same "prose isn't enough for a critical behavior" conclusion plausibly applies beyond
worktree isolation:

1. Should local-strict-review get the same category of mechanical backstop gh-write-guard
   has — e.g. a PreToolUse hook that fires on git push (non-default branch) or gh pr create,
   reminding (not necessarily blocking, since a hook cannot verify a review actually happened)
   toward running it first? This generalizes Prevent one repo from modifying the state of another repo, force them to work in worktrees using safety hooks #1073's own ask to a second critical behavior.
2. Is there a general design worth stating once — which behaviors in this fleet's growing set of
   skills are "critical enough to need a hook" versus "fine as a documented, chained trigger" —
   rather than deciding this repo's-worth-of-skills case by case as each one recurs?
3. Should Codex/opencode sessions be checked for the same reliability gap incident 2 showed for
   Claude Code, to confirm or rule out that the CLAUDE.md fix (PR Add CLAUDE.md Bridge So Claude Code Actually Loads AGENTS.md #1081) actually explains the
   whole symptom rather than one contributing cause among several?

This needs a maintainer design call before building anything further — filed rather than acted
on unilaterally, per the fleet's own escalation convention for a genuine trade-off.

References

• Prevent one repo from modifying the state of another repo, force them to work in worktrees using safety hooks #1073 (original worktree-isolation incident and "safety hooks" ask)
• New fleet skill proposal: local-strict-review — adversarial pre-PR self-review on a stronger model #1056/pr-review-conduct/drive-pr: chain local checks (lint -> strict-review -> future CodeRabbit CLI) before opening a PR #1057/agent-conduct: trigger local-strict-review before claiming PR-bound work is done #1059 -> PR Add local-strict-review skill and wire it into the pre-PR flow #1065 (local-strict-review skill creation and first trigger-chaining fix)
• local-strict-review skill copies AGENTS.md's subagent briefing template instead of referencing it #1070 -> PRs Reference AGENTS.md's Unresolved-Rule Line Instead of Copying It #1074/Give the Closing-Reference Line Its Own Template Field #1079/Drop the Close Field, Match AGENTS.md's Own Unlabeled Shape #1080 (local-strict-review's own subagent-briefing template, fixed
  across 5 review rounds while dogfooding the skill itself)
• PR Add CLAUDE.md Bridge So Claude Code Actually Loads AGENTS.md #1081 (the CLAUDE.md bridge fix for incident 2's diagnosed root cause)
• host-setup/agent-safety/README.md ("The hook is the mechanical backstop... Prose alone is not
  enough, since the incident happened under prose rules, so both ship.") - the existing precedent
  for exactly this class of decision, already applied to GitHub write safety and git operations
  that bypass a repository protection.