Hooks reference

Hooks reference

Hook	Default	What it does
git-denylist	ON (AGENTIC_SDLC_GIT_DENYLIST=0 turns it off)	Refuses force push, reset --hard, clean -f, whole-tree discard, git -c, GIT_CONFIG_*=, config --global.
commit-pathspec	OFF (AGENTIC_SDLC_COMMIT_PATHSPEC=1)	Refuses a git commit that names no paths, for trees shared by agents.
write-confine	OFF (AGENTIC_SDLC_WRITE_CONFINE=1)	Refuses a file write into another git repo.
context-budget	ON, warns only	Warns when CLAUDE.md > 200, AGENTS.md > 100, or .claude/rules/*.md > 400 lines.

Env vars

Var	Value	Effect
AGENTIC_SDLC_GIT_DENYLIST	0	Turns git-denylist off.
AGENTIC_SDLC_COMMIT_PATHSPEC	1	Turns commit-pathspec on.
AGENTIC_SDLC_WRITE_CONFINE	1	Turns write-confine on.

How a hook works

• Hooks are POSIX sh (awk, sed, grep, git only). Stdin is the hook JSON.
• Exit 0 allows. Exit 2 with a 1-line reason on stderr refuses.
• Any error fails open.

The hooks are early warnings inside each tool. The CI checks enforce the rules for every provider: CI checks. Codex runs 3 of the 4 hooks: Install for Codex.