14 posts tagged #hooks.
While you watch an agent work, you are quietly doing two jobs: judging what it may touch, and judging when the work is actually done. Headless mode deletes you from both at once. The gate that inherits the second job fails two separate ways unless it has two teeth.
Against a 1-in-12 hallucination rate on a checkable failure, a deterministic hook with one capped retry drives the shipped-wrong rate to exactly zero and moves the remaining risk onto one computable number: the halt tax.
A soft AGENTS.md rule is a per-commit probability, and probabilities compound: 95% compliance becomes a 92.31% chance of a lapse somewhere in a 50-commit sprint. The hook most teams write only cuts that to 22.37%. Here is the arithmetic, layer by layer, and the one layer that zeroes it.
Every inline authorization check an agent writes is an independent guess at the same policy. The guesses disagree, quietly. Here is the arithmetic of how fast that compounds, and the one call that stops it.
The GitHub MCP server that leaked private repo names in May 2025 had no malicious code in it. The token's authority was ambient, good for every repo you can see. Scope it to the task and the blast radius drops 12x.
An event can fire a headless agent run as reliably as a hook fires inside a session. But wiring the event only removes the human who had to remember to ask. The one who caught bad output has to be rebuilt as code too: rules for what a careful review would do, guards for what it would never let happen unattended.
A suite thorough enough to catch a real regression is too slow and noisy to gate every PR. Split the same 50 cases into a 32-case deterministic gate and an 18-case nightly judge sweep, and a team merging 8 PRs a day gets 156 minutes of blocked PR time back every week - without dropping a single case.
A rules file is right the day you write it and silently wrong forever after, because nothing marks a reversed line. Auto-memory keeps both truths and cannot pick one. A trigger, a dated demotion, and a human gate end it.
Every failed agent run is a labeled example. Capture them with a hook, judge them, count them. The count tells you which failure to fix first. The shape of the failure tells you where the fix belongs, and in one two-week log, half the rows are not fixable in the rules file at all.
An agent reviewing its own plan misses the same defaults it always misses. Gate plan-mode exit on a different vendor's model, and a FAIL verdict re-engages planning before any code exists.
Permission systems that gate on scariness ask about everything and protect nothing. Gate on reversibility instead, and the same 12-call session drops to 3 interrupts without losing the one that counts.
A rule in your rules file only gets read if it survives to the top of a shrinking window. Move it into a hook that fires on the event instead, and expected compliance across one session's edits goes from 42.8% to 95.0%.
The model cannot tell an instruction from data, because both arrive as tokens in one flat stream. The defense that measured best marks which channel a token came from. It never reads the words.
A one-line AGENTS.md fix that visibly resolves the case you were chasing can still fail its own regression gate. Fixing one case here drops a six-case eval from 0.833 to 0.500 - and only a baseline that ratchets upward catches it before a user does.