▲ mission control for one change

watch the change move
brainstorm → ship

One change enters the pipeline. A packet streams through the active lane, lighting each stage as it passes — while the gauges for risk flags, confidence, blast-radius and hooks update live. Pick a lane, or trip a gate, and watch the board react.

// lane:
stage runs in lane skipped ⚠ hard gate → forces high-risk
hard gate trippedauth · escalated to high-risk · specs/<slug>/ESCALATIONS.mddeny-on-no-response until a human confirms scope.
PIPELINEchange.packet ░▒▓
stage 0/0
node inspector
┤ RISK FLAGS ├
nominal
0/ 10 fired
0–1 tiny2–3 normal4+ HIGH
┤ CONFIDENCE ├
auto
HIGH
low → escalatemediumhigh
┤ BLAST-RADIUS ├
files touched
▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁
0in plan set
┤ HOOKS ├
0/7 fired
enforcement rail · runs regardless of lane
┤ LIVE LOG ├ tail -f harness.log
● streaming
┤ LANE PROFILE ├
grep -i 'hard gate' rules/

The hard gates

These categories always force high-risk, regardless of the lane intake first assigned — and only a human narrowing scope can lower them. Click any gate to watch the risk meter spike, the alarm fire, and the packet reroute through the full high-risk path.

⛔ auth
login, sessions, token handling
⛔ authorization
permission & access checks
⛔ data-loss / migration
schema change, drop, destructive op
⛔ audit / security
logging, secrets, security-sensitive
⛔ external provider
broker, AI provider, webhook behavior
⛔ public contract
API route/method, response envelope, client-visible behavior
⛔ weakening validation
removing / loosening a guard or check
⛔ high-blast file
settings.json, hooks/*, skill engines

A gate hit and not yet narrowed by a human → the change stops at specs/<slug>/ESCALATIONS.md. It's deny-on-no-response: with no recorded decision, the work stays blocked.

cat settings.json | jq .hooks

The enforcement rail

Hooks fire on Claude Code lifecycle events — the machine safety net that runs regardless of lane. They're why even the no-ceremony tiny lane is safe: the rules are enforced by code, not by hope.

hookfireswhendoes
scope-gate.shUserPromptSubmiton requestWarn on implementation intent with no plan referenced (lane-aware)
ruff-on-edit.shPostToolUse · Edit/Writeon editruff --fix + ruff format on edited .py
blast-radius-check.shPostToolUse · Edit/Writeon editWarn when an edit touches a file outside the active plan's file set
render-plan-on-write.shPostToolUse · Edit/Writeon editAuto-render PLAN.mdPLAN.html (deterministic, no LLM)
check-untracked-py.shPreToolUse · gitat commitBlock commit/push if untracked .py files exist
commit-quality-gate.shPreToolUse · git commitat commitSecrets scan + debug-artifact check + targeted pytest
risk-corroboration.shPreToolUse · git commitat commitBlock if the staged diff trips a hard gate but the declared lane is below high-risk
branch-guard.shPreToolUse · git commitat commitWarn when committing on main
branch-isolation-guard.shPreToolUse · Edit/Writeon editBlock a code edit when implementation is underway on a shared branch with no isolated worktree
session-knowledge.shSessionStarton startLoad the knowledge base (INDEX + critical patterns) into session context; never blocks
state-breadcrumb.shSessionEndon exitAppend a dated breadcrumb to specs/STATE.md for cross-session resume; never blocks