Test the instructions against the work.
Repository instructions can say which package manager to use, which paths to leave alone, or when to run tests. obey turns those rules into checks and small tasks that give a coding agent an opportunity to break them. The report compares recorded actions with the rule, using commands, file changes, commits, and pushed refs.
The extractor reads AGENTS.md, CLAUDE.md, GEMINI.md, Cursor rules, and Copilot instructions. It maps supported instructions to twelve deterministic checker types; rules that need judgment remain uncheckable, and optional LLM suggestions require review.
Measure before and after enforcement.
By default, each probe runs in a fresh container, alongside a baseline with the relevant instruction removed. A model gateway keeps the provider key outside the agent container and meters spending; a separate proxy limits network access. Tracked repository files enter the run and may be sent to the chosen model provider.
The same Python rule engine scores recorded runs and powers generated hooks. Reports separate violations from cases where the rule was never exercised, show confidence intervals, and count attempts that still break a rule after a hook blocks the direct route.
A study that also tested the checkers.
The main experiment recorded 2,241 runs of Claude Haiku 5.5 through Claude Code and OpenCode on two authored repositories. After checker corrections, the agent followed a present instruction in all 1,474 exercised runs; without the instruction, it complied in 397 of 488.
Reviewing the traces exposed 136 checker false positives, all corrected from violated to obeyed after the outcomes were known. The project publishes both analyses and the deviations. In a separate exploratory comparison on selected rules broken by the baseline, hooks raised compliance from 47 of 138 exercised runs to 137 of 137; none of 123 blocked runs ended in a measured evasion.
Guardrails with explicit limits.
These are results on designed probes, one model, and two agent harnesses. They do not establish everyday compliance, universal phrasing advice, or a security boundary. Hooks allow the action with a warning if they encounter an internal error, and some edit routes can bypass a pre-tool check.
Hook generation covers six agents plus Git pre-commit checks, with different capabilities and levels of validation. The committed study exercised generated hooks in Claude Code and OpenCode; Gemini and Cursor support relies on contract tests, and Cursor has no headless runner in this release.