---
title: "A pull request check for AI agent work — CommitCycle"
description: "Layer 3 recomputes a pull request's diff against what its task declared. It runs only on CommitCycle's own repository; there is nothing to install."
url: https://commitcycle.com/ci/
language: en
---

# The diff, checked again on the pull request

> Layer 3 recomputes a pull request's diff against what its task declared. It runs only on CommitCycle's own repository; there is nothing to install.

CI check Runs on our repository only · not installable

Three layers, each catching the failure of the one above: context advises, the local hook denies in flight, and this recomputes the whole diff on the pull request. It exists for the one failure the other two cannot see.

Layer 3 re-checks the diff against what the task declared. It runs in CommitCycle’s own CI today, advisory there; nothing installs it in yours.

## The failure it is for

The local hook is the enforcement point, and it is honest about its ceiling: it can only deny calls it is present for. A contributor who never ran `cycle init`, an agent in a harness CommitCycle has no adapter for, a machine where the plugin was removed — in every one of those the hook is not wrong, it is simply **absent**, and absence is invisible from the inside.

So the last layer runs on the pull request, away from the machine. It reads the same `zones.yml`, recomputes which zones the diff actually touches, and compares that against what the task declared. Same model, different vantage point.

Its limits, in the same breath. It checks the diff against what the task _declared_, not against the grant, so approvals and expiry go unchecked. It reads the zone map from the pull request's own checkout. A board that does not answer turns the check into a skip that still passes. And on a pull request from a branch in the same repository, that branch can rewrite the workflow that checks it. A stricter gate mode and a board-side check run are built; neither is switched on.

## What it reports

- **Declared versus touched** — the zones the task named, against the zones the diff proves it changed
- **Work that arrived without a task** — the case only CI sees
- **Overrides, by name** — a bypass is legal here, recorded, never silent

## Honest status

The check runs on this repository today, and only here. It is **not published to GitHub Marketplace** — no release script or workflow in this repository publishes it — and nothing installs it into yours. A page that said "install our Action" would be selling something nobody can install.

One more limit worth stating in the same breath: a check stops a merge only where branch protection requires it, and on a private personal free plan branch protection answers **403**, so this layer runs advisory and says so out loud rather than reporting a success it did not enforce.

How the three layers divide the work is in [the docs](https://commitcycle.com/docs/concepts/three-layers/), and the map all three read is [the zone map](https://commitcycle.com/zones/).

## Questions this page answers

### What does the CI check catch that the local hook does not?

The case the hook cannot see: work done where the hook was never installed at all. The check recomputes the diff on the pull request from the zone map, so a branch produced without the hook is still measured against what its task declared. Today it runs only on CommitCycle's own repository.