Canny

That distinction is the whole point. A rules file asks the model to remember; Canny hooks into the agent and records what actually happened. Every hook event lands in an append-only ledger under ~/.canny/sessions/ storing paths and outcomes, never file contents, and the Stop hook refuses a done claim when no test, build, lint, or type-check command has passed since the last edit. Only pattern checks and the ledger gate can block.

Judgments, never blocks. A done claim is refused because the ledger holds no passing check, not because a probability crossed a line. Jev answers what code cannot, such as whether the message claims the work is done or whether a diff breaks a project rule, and those become notes in the agent's context. When Jev is unsure, or no key exists, the deterministic rule stands alone and still works.

There is an explicit escape hatch in the refusal message: if no check applies to the change, say so explicitly and stop again. The list of commands that count as a check is configurable, and the built-in one holds about eighty entries (pytest, vitest, jest, go test, cargo test, tsc, eslint, ruff) with quoted strings stripped. A documented live session shows the agent blocked twice before reaching for a command on the list.

It writes hook entries into the harness settings, and you pick the scope. init writes hooks for the agents it finds installed, --claude or --codex selects one explicitly, and --global guards every project instead of this one. It is not on npm: you clone the repo to ~/.canny/src and the compiled CLI is committed, so there is nothing to build. Removing it is one remove command.

Four. PreToolUse runs the pattern checks and can deny or ask. PostToolUse writes the evidence ledger and asks Jev whether the edit breaks a stated project rule, which only becomes a note in the agent's context. Stop runs the ledger gate and, when there is no passing check, asks Jev whether the message claims the work is done. Claude Code also gets PostToolUseFailure, since that is where it reports a non-zero exit. A fourth, SessionStart, tells the agent what the done-gate wants and names the project's test command from package.json, justfile, Makefile, Cargo.toml or go.mod.

Content about to be written that contains a secret shape: AWS, GitHub, Slack, Stripe, Google, OpenAI or Anthropic keys, private key blocks, or password = "..." with real-looking entropy. Shell commands that write a file are read the same way, and a .env file that git ignores is exempt. The same hook covers edits that remove test cases, add .skip, .only, xit, @pytest.mark.skip, t.Skip, #[ignore], @Disabled or XCTSkip, or delete a test file.

Yes. canny replay on any session re-derives every Stop verdict from the recorded facts and the recorded Jev answers, then reports any mismatch, and there are none in the documented runs. canny status shows the same table live, and canny-check is the quick probe an install runs. The reason that works is that only paths and outcomes go into the ledger, never file contents, so the inputs to a verdict are all still there.