Fresh evidence before done.

30-Second Quickstart

Install the local evidence engine, initialize the target Git repository, review the generated policy, and confirm the environment before adding one Codex integration route.

go install github.com/rrrrrredy/beforedone/cmd/beforedone@latest
beforedone init
beforedone doctor

Then choose exactly one Codex route. The Git Marketplace Plugin, standalone Skills Pack, and project-local hooks are separate delivery forms; combining them duplicates workflows.

Choose evidence before asking for PASS. BeforeDone verifies project-approved commands; it does not infer whether they fully cover a natural-language requirement. A user does not need to locate the exact bug, but the task needs observable acceptance criteria and a credible verifier. Treat non-Go git status --short initialization as scaffolding, never correctness proof.

Help me configure BeforeDone for this repository. Inspect the existing test,
build, lint, type-check, package-script, and CI configuration. Use
`beforedone init` only as a starting point. Configure the smallest credible set
of existing commands, include every file class that can affect each check, and
report assumptions and coverage gaps. Do not add dependencies, use
`git status --short` as proof of correctness, or invent a check merely to get
PASS.

Use BeforeDone for this task. Turn my request into observable acceptance
criteria, map them to existing tests or checks, and add the smallest regression
test when coverage is missing and that change is within scope. Before saying
done, run every required BeforeDone check and confirm fresh PASS receipts for
the current files. If any criterion lacks credible evidence, report it as
unverified instead of calling it PASS. Do not weaken checks merely to obtain
PASS.

How the Stop Gate Works

The gate evaluates explicit verifier results against the current configured files. It does not infer success from prose or from the word “PASS” appearing in logs.

1. Agent stopsA completion claim reaches the hook.
2. Receipts checkedRequired checks and fingerprints are compared.
3. Missing or staleOne corrective continuation explains what to run.
4. Fresh PASSA new receipt matches the current files.
5. Done allowedThe claim now has inspectable support.

Evidence Receipt

A receipt records what actually ran, its exit status, and the relevant-file fingerprint it covered. A later file change makes the old result stale.

{
  "schema_version": 1,
  "check_id": "test",
  "argv": ["go", "test", "./..."],
  "exit_code": 0,
  "relevant_files_fingerprint": "sha256:7f3c…d6f8e",
  "verdict": "PASS"
}

Incident Replay

BeforeDone reconstructs the first observable divergence from normalized events, receipts, diffs, logs, and user corrections. It reports exact events only when evidence supports that precision, and never claims access to hidden chain-of-thought.

Install Routes

The CLI is always the source of truth. Add one integration depending on whether you want automatic Stop enforcement or a manual skills workflow.

Security Boundary

BeforeDone is designed for fallible agents, stale evidence, and accidental early completion. It is not an attestation boundary against a malicious process running as the same OS user.

• Local by default. No account, cloud service, or telemetry is required.
• Fail closed. Invalid, oversized, ambiguous, or incompatible evidence cannot become PASS.
• Redacted artifacts. Captured output passes through bounded semantic and configured redaction.
• No command import. Replay cases never control which commands are executed.
• Honest limit. A hostile same-user process can change policy or manufacture local state.

Command Reference