CI check Runs in-repo · not on Marketplace
The layer that holds when the hook was never installed
Three layers, each catching the failure of the one above: context advises, the local hook denies in flight, and this recomputes the whole diff on the pull request. It exists for the one failure the other two cannot see.
The failure it is for
The local hook is the enforcement point, and it is honest about its ceiling: it can only deny calls it is present for. A contributor who never ran cycle init, an agent in a harness with no adapter yet, a machine where the plugin was removed — in every one of those the hook is not wrong, it is simply absent, and absence is invisible from the inside.
So the last layer runs where nothing can be uninstalled: on the pull request. It reads the samezones.yml, recomputes which zones the diff actually touches, and compares that against what the task declared. Same model, different vantage point.
What it reports
- Declared versus touched — the zones the task named, against the zones the diff proves it changed
- Work that arrived without a task — the case only CI sees
- Overrides, by name — a bypass is legal here, recorded, never silent
Honest status
The check runs on this repository today and it speaks GitHub rulesets natively. It isnot published to GitHub Marketplace — the package is private and still at0.0.0 — so today it arrives by living in the repository rather than by being installed from a listing. A page that said "install our Action" would be selling something nobody can install.
One more limit worth stating in the same breath: on a private personal free plan, branch protection answers 403, so this layer runs advisory and says so out loud rather than reporting a success it did not enforce.
How the three layers divide the work is inthe docs, and the map all three read isthe zone map.