Customize the harness. Retest the boundary.

01A guard mod changes what can execute

On 3 October, Reddit user emarkosov described a Claude Code mod that asks before commits, pushes and deployments, refuses deployment commands unsafe in their setup, and filters API keys from tool output. That is a practical use for customization: put a repeated decision into the harness. The post describes intended behavior, without a test showing that its restrictions hold alongside other mods. ⁵

Claude Code 2.1.287 introduced mods on 1 October. Anthropic’s tutorial says the API can change between releases; the type declarations generated by the installed build are the authority for that version. A mod can observe a tool call, rewrite it or supply its own result. An extension that starts as a review pane can therefore become part of the execution path. ^{1 2}

The question for that guard is which decision reaches execution? A demonstration that the prompt appears establishes one transition. The harder case is a second installed mod with overlapping behavior. A published experiment from the day before emarkosov’s post makes this more than a hypothetical concern.

02Test the effective permission decision

On 2 October, Max Nardit reported a disposable-repository test on Claude Code 2.1.287, using a personal Max account without managed settings. His project hook rejected a harmless marker-file command. Without the mod, the command was blocked; with a mod approving the permission decision, the hook still logged its refusal but the marker file appeared. A separate settings-deny test also produced the file. This is his reported experiment, not a reproduction by NO FEED, and not a test of emarkosov’s guard. ⁶

Update, 19 October: the current permissions guide explicitly distinguishes these cases. A mod handling tool.check can replace an ordinary project hook’s block. Managed hooks and managed deny rules have different precedence; plan mode also constrains approvals. Which policy was loaded and which permission mode was active belong in the test result. A block in one configuration cannot establish enforcement in another. ⁷

For a hypothetical review panel that rewrites shell commands, test a deliberately disallowed operation through that same path on disposable data. Record the effective command, the permission decision and the resulting file change or refusal. The diagram below maps that acceptance question; it does not claim an internal hook order or reproduce Nardit’s experiment. ²

Separate an observer from a gate. If the display fails, work may reasonably continue without it. If a required approval checker fails, continuing may defeat its purpose. The team must choose and test those outcomes independently, including a plugin update that adds a new handler.

03The same endpoint can hold another account

Next, the team upgrades its MCP setup. Pi 1.0.0 made OAuth credentials specific to both server name and URL. Previously URL-only credentials move to the first server that uses them. The release also rejects authorization responses whose issuer identifies another authorization server. These are concrete configuration and authentication changes, even if the model appears unchanged. ³

Suppose our panel retrieves review information from two configured servers sharing one endpoint but representing different accounts. A successful login only establishes that a credential was accepted. The useful result is which account each server now uses, and whether its scope matches the intended repository. A read-only identity check can expose that distinction without copying a token into the upgrade record.

Configuration has an owner and a source. A repository setting, a personal preference and an organization rule can express different intended behavior. Before rewriting an apparently ignored instruction, establish which setting was loaded. Otherwise the team may improve a file the running harness never reads.

04A cancelled stream can keep the next task waiting

The panel then starts a streamed model request and its consumer stops early. Pydantic AI’s release notes, updated on 9 October and checked for this revision, identify a fix in 2.53.0 for a concurrency slot held when a streamed request released it from a different task. Early exits and some fully consumed debounced streams were affected; repeated requests could block other work sharing that limiter. Agent-level max_concurrency, non-streaming requests and v1 were unaffected. ⁴

The developer sees one cancelled operation. The next task can experience an exhausted shared limiter. That relationship explains why a normal successful response does little to test cancellation cleanup. A focused trial stops a stream early, raises an exception or cancels the consumer, then submits another request through the same limiter. It asks whether interrupted work leaves capacity for the next task.

The release also changed the limiter contract. Custom limiters must allow release from another task, and certain nested uses of the same limiter now raise UserError. ⁴ An explicit configuration error can be the intended new outcome. A test that insists on preserving the previous silent behavior would miss the point of the change. This is a proposed trial for the team’s wrapper, not a test result we obtained.

05Keep an upgrade record another person can use

The team’s record can now name the harness and plugin revisions, the effective permission policy, the observed MCP identities and the outcomes of one accepted, one denied and one interrupted task. For the review panel, the accepted result is still a patch and its relevant checks. A session marked complete does not establish that the right revision was reviewed.

Keep the previous configuration available while evaluating the new one. If the panel changes an approval decision, uses the wrong account or leaves later work blocked, there is a specific failing transition to investigate and a known configuration to restore. This is more useful than arguing about whether the model seemed more capable during the demonstration.

The guard’s value is its repeatable behavior across those transitions. A team can keep the convenient panel while recording which component owns the final decision. If the hook chain cannot yet be described precisely enough to test, limit the experiment to disposable work with a visible owner.