The guardrails that make an AI coding agent safe to run unattended.
An agent is only as good as the harness around it. A raw agent in a repository is a liability. The 'corePHP' harness is the layer that makes one worth running unattended: what it knows, what it is allowed to do, and what it must never do.
Shared from one source. A teammate pulls, runs setup, and has exactly what everyone else has. Personal preferences layer on top as an overlay rather than as a divergent fork of the whole thing.
Some things an agent should simply be unable to do.
Not a prompt asking it to be careful. A hook that refuses the call before it runs. Destructive filesystem operations, force pushes to a protected branch, disk operations, fork bombs, permissive chmod, pipe-to-shell, dropped tables, and hardcoded secrets in a write.
The guard layer is deliberately lean. It enforces safety, not process. It will not stop you shipping; it will stop an agent doing something you can never undo.
$ rm -rf /× denied: destructive filesystem operation$ git push --force origin main× denied: force push to protected branch$ curl example.com/i.sh | sh× denied: pipe to shellTen hooks wrap every tool call.
These are the actual scripts, listed with the point in the session each one fires at. Each one fires at a fixed point in the session, so behaviour is enforced by the harness rather than left to the model to remember.
| Hook | Fires on | What it does |
|---|---|---|
memory-router.sh | every prompt | Surfaces the past decisions, conventions and gotchas relevant to what was just asked. |
read-intelligence.sh | before a file read | Detects a re-read and attaches a token estimate, so the same context is not paid for twice. |
brain-context.sh | before a write or edit | Opens the bug log and do-not-repeat entries for that exact file, and warns at three edits to one file. |
cost-watchdog.sh | before a tool call | Keeps token cost visible while the session runs rather than after it has finished. |
pretooluse-guard.sh | before a tool call | Hard-denies destructive operations and refuses hardcoded secrets in a write. |
pre-commit-gate.sh | before a commit | Blocks any commit carrying attribution trailers you did not ask for. |
post-file-change.sh | after a write | Logs the change, and optionally formats the file and runs the tests that cover it. |
log-skill-activation.sh | after a skill runs | Records which skill fired and advances the pipeline state. |
memory-index-regen.sh | after a write | Regenerates the recall index so new knowledge is findable immediately. |
pre-stop-check.sh | on stop | Finalises the session record and suggests capturing what was learned. |
Skills are the difference between an agent and a colleague.
A skill is a packaged way of doing one kind of work: the checklist, the constraints, the traps. You write it once, commit it, and it is available to every session on every machine. Two levels: global ones for technology and team standards, project ones that live in the repository beside the code they describe.
Domain
Language and framework. These cover Laravel, Symfony, Python services, React and TypeScript patterns, and clean architecture layers.
Pipeline
Build and design. These cover scoping and specification, design systems, motion, template generation and design QC.
Process
Quality and verification. These cover test-first development, systematic debugging, quality gates, and verifying work before anyone claims it is finished.
Tooling
Environment. These cover server configuration, console debugging, the issue-to-pull-request flow, ticket writing and time tracking.
Add your own. A skill is a directory with a markdown file in it. Commit it and every teammate has it on their next pull.
The diff decides who reads it.
A CSS change does not summon a security review, because the diff itself decides who reads it.
Security
It runs whenever a diff touches authentication, payment or user data.
TypeScript
It checks type safety, hook correctness and component patterns.
Laravel
It checks framework conventions, query performance and service boundaries.
Tech debt
It names what was deferred and why, instead of letting the shortcut go quiet.
Change summary
It turns a diff into a description a human reviewer can actually act on.
Shared configuration. Private data.
The configuration is shared because everyone benefits from it. Client work, personal overlays and local session history are not, and are kept out of the shared repository by design rather than by discipline.
| Shared with the team | Stays local |
|---|---|
| skills, commands, agents | your composed settings |
| hooks and guard rules | personal overlay and preferences |
| team memory you publish | session history and transcripts |
| documentation sync | client data and project profiles |
The ten hooks, the five review agents, and exactly what each one blocks, in writing. This is the part that decides whether an agent is safe to leave running unattended, so read it first.
The harness is included.
Skills, commands, review agents and the guard layer come with the seat, and you can write your own.
A real number in two business days, from an engineer. No sales deck, and no call just to book another call.