Nothing here yet.
Agreed. CI is that separate process, with the config under CODEOWNERS. Locally the launcher sits in a protected folder and fails closed if the tool was changed. First thing I'd log: every write attempt on guardrail paths, denied or applied. The silent one is a successful write that removes the hook, since it can't report on itself, which is why CI re-checks the diff.
In my tests the node_modules edit mattered most, since it worked in normal mode. Skipping permissions worked too, but that's a mode the user chooses, and nothing local holds there anyway. No real-world data yet on which is more common. Either way the fix is the same: protected launcher locally, CI plus CODEOWNERS as the real gate.
Ran it. Normal mode was fine, but the agent could patch Proof of Done in node_modules and skip the check and with permissions off it could just delete the hooks. Fixed the first onee the hook now runs from a protected folder and checks its own files first and the same attack got caught on the rerun. The permissions-off case can't be fully stopped locally, but verify still catches it afterwards, so CI is the real answer there. Thanks for pushing on this, it's in v0.3.0.
