Known limitations

A fresh clone has the hooks but not the config that points at them. It is unprotected until refresh-instance.sh --apply runs, and the forge check is the layer that does not live in a clone.

A deliberate flag with an obvious name, or Setlist's own escape variable, skips every git hook, the push-time audit and content scan included. Every git hook reads the variable first. SETLIST_SKIP_TRUNK_AUDIT=1 is the narrow escape. No refusal names either, and the forge check has no such flag.

The stamp and the refresh chain husky, lefthook or pre-commit and leave it in place. Each Setlist git hook runs that manager's hook of the same name beside its own verdict, before its checks where the index becomes the commit, and both refusals surface. A manager that re-points core.hooksPath on install switches Setlist off again, and the next session start reports it.

A fast-forward creates no merge commit, so no merge hook runs. The stamped merge.ff=false makes a plain --squash fail with a message that names neither Setlist nor the setting. The push-time audit still reads a one-commit close correctly, a squash included, and refuses a multi-commit fast-forward on its intermediate commits.

Merge onto a branch with another name than the recorded trunk, and the whole layer stays silent. The audit walks history from audit.baseline, which the upgrade records where an instance's history predates its hooks. A key moved forward walks less, so review it as you review the hooks.

A push to Gerrit's refs/for/<branch> or any other namespace skips both the content scan and the trunk audit. Since 2.7.0 the hook reports the skip by name. The ways through are to push the trunk directly or to require the forge check.

The em-dash and secret scans read every added line of the index, vendored code and fixtures included, unless scan_exclusions in .claude/sdd.json names the paths. Every skip is printed with the glob that matched it.

The scan reads a rendering the repository controls, with a first-cut pattern set, so it catches accidents on the ordinary path and nothing more. Since 2.11.0 a .gitattributes -diff or binary entry no longer hides a text file from it, except in a merge commit's own change at push.

A branch that never carried Setlist has no .githooks/, so checking it out leaves git no hook to run, and a push refused from the trunk succeeds from it. pre-push reads a pushed commit's own .claude/sdd.json when the checkout has none. The forge check refuses a pull request whose head carries none.

The suite runs on Linux under two awks, on macOS under bash 3.2 with the BWK awk, and since 2.11.0 on Windows 11 under Git Bash. On Windows a hook call costs about three times a Mac's, and NTFS cannot hold some of the file names the suite exercises. The list is extended, and it is never restated as a proof.

It reads bytes against criteria in a fresh context, and its judgment is no different from the builder's. QA Pass 2 stays yours. So does the decision at its two-round cap, recorded as ACCEPTED-BY-HUMAN beside the reviewer's verdict.

The field checks establish that the files the closer named are the files the commit touched. The node check establishes that every drawn path exists, and the lockfile that the generated view equals the command's output.

Only a path-shaped name (a slash, no whitespace) is checked, and the rest is printed as unverified. Three Mermaid shapes are unread by decision. The render check parses only where a renderer runs, and without one it fails the stamped workflow's job instead of passing.

The bypass deny stops an obvious spelling of disarming the git hooks for its own run, and ordinary variable expansion, a short list of spellings its frozen parser misreads, a persistent core.hooksPath change or a fresh clone (reported at the next session start as [SR-HOOKS-NOT-ARMED]), and a write or a git command through Bash or another interpreter all pass it.

From Claude Code 2.1.295 it blocks a command when it times out or cannot start; a skipped scope or Stop hook is advice missed, and a hook whose matcher is not a valid pattern never runs. The git hooks and the trunk audit are the catch.

The stamped check is a report until the trunk lists setlist forge check as required beside a review and review from Code Owners, and it cannot require itself.

A rebase-merge trunk defeats it before the fact. A trunk protected after an unreviewed flip landed verifies that flip. A pull request that edits the workflow or the hooks is judged by its own edit.

So the check refuses a forge-custody trunk without "Require review from Code Owners", and it names every edit to the enforcement paths.

Owns: declarations are judged against the core CODEOWNERS grammar. Sections, negations and character classes are refused by name, and GitHub evaluates no character class either. Only email owners resolve locally.

A close is audited file by file against its own Owns: lines, which travel in the commit they justify, so the hooks verify coverage and never truth. A spec that declares nothing closes under the older whole-commit exemption. A signature proves a key was used, and never that a person decided. forge custody has no key and rests on the forge's required review instead.

A quoted copy of the template above your Owns: lines ends the signed range early, and the declaration below it is refused as out of range. The refusal names the one-edit fix.

The Stop hook refuses once to end a turn with an unstaged spec or specs/STATUS.md change, in a project with its own repository. A session killed from outside fires nothing, and the git hooks are what refuse the work.

Each repository's hooks, audit and forge check read that repository alone, so a change across two is a spec in each, and whether the pair agrees is a reviewer's question.

A chained merge, and its octopus spelling into a spec branch, hide unspecced work behind a compliant close; an octopus onto the trunk is refused since 2.11.0.

Five sideways commands (git cherry-pick, a detached-HEAD merge, git rebase, git reset --hard, the pathspec checkout) are refused at push, unless composed with a compliant close that declares no ownership. A merge that edits a file outside its conflicts is reported on git 2.38 and later and never refused, while an edit inside them reads as resolution.

A local replace ref showed the audit a commit other than the one a push sends until 2.14.0, which closed that route.

Since 2.9.0 the scope hook's reason rides the field Claude Code delivers to the agent, and an agent may still judge the write harmless and proceed. The git hooks' refusals at commit, merge and push are what hold.