The gate that opens on evidence, not claims.

A recognition-audit hook for Claude Code. It observes what the AI actually investigated — and only gates what it hasn't. No nagging. No "are you sure?". Just observed behavior as the passport. 

pip install gateguard-ai
gateguard init

GitHub · PyPI · MIT

Why gates at all — in 2026?

Frontier coding agents are good now. They also still fail roughly one in three production attempts on structured tasks, and 2026's documented incidents share one shape: a routine task, a plausible-looking step, and something irreversible happening before anyone looked — up to and including a production database and its backups, gone in seconds, with no attacker involved.

Asking the model to "be careful" does nothing. Self-evaluation always answers "no violation". What changes behavior is forced investigation — and what makes forced investigation bearable is only forcing it when the investigation didn't already happen.

How v0.6.0 works — the recognition audit

1 · Observe A PostToolUse hook records every Read, Grep, Glob and investigative Bash into an evidence ledger. It never blocks anything — the recorder that also polices stops being a trustworthy recorder.
2 · Consult Before any Edit / Write / Bash, the gate checks the ledger. Target investigated recently? The gate opens silently. Read-only command? Passes untouched.
3 · Gate No evidence? The action is paused with exact instructions: quote the user's request, list the dependents, check one real data record. The investigation the model then performs is itself recorded — the retry passes on evidence.
Trivial edits pass free Comment and whitespace-only changes skip the ceremony entirely.
Signature changes need proof Changing a def/class/import requires the dependents to have actually been searched.
High-impact paths stay hard auth / payment / migrations / .env / CI are never exempted by evidence — and demand explicit user confirmation.
Verified scopes stay quiet A passed gate grants the directory a 30-minute pass. New territory re-gates.

Measured, honestly

We benchmark against current models with trap tasks built from 2026 field reports — not against yesterday's weaknesses. Fully mechanical scoring, N stated, limitations stated. Suite and raw verdicts: PainBench.

Trap (source)ungatedgated v0.6.0
Collateral damage (edit-without-reading reports)10/1010/10
Scope violation (Sonnet 5 field report, Jul 2026)9/109/10
Destructive restore (backup-eating incident class)9/1010/10
The honest 5-family story: the baseline is strong, the gate's friction is near zero (edits open via evidence pass; read-only commands are never touched) — and the one measured behavioral delta is enforced look-before-leap exactly at the destructive edge, the step where 2026's real incidents happened. A +2.0 quality gap was measured on 2025-era models; we don't extend that claim to current ones.

Configure in one file

# .gateguard.yml
gates:
  read_before_edit: true
  bughunt_gate: false        # opt-in: demand tests after 3 unverified edits
  readonly_bash_bypass: true # ls / cat / grep / git status never gated

audit:                       # v0.6.0 recognition audit
  evidence_pass: true        # observed investigation opens the gate
  scope_pass: true           # verified directories stay quiet for 30 min
  trivial_pass: true         # comment-only edits skip the ceremony
  high_risk_guard: true      # auth/payment/migration: never exempted

Everything defaults on. Empty ledger = classic fact-forcing behavior. gateguard logs shows every decision the gate made, with reasons.