Lifecycle commands & boundary enforcement

warden moves the deterministic, error-prone parts of an agent’s job — git and running checks — off the agent and onto first-class commands, then enforces the worktree boundary with PreToolUse hooks. The agent stops spending tokens narrating git status/add/commit round-trips, and parallel agents stop colliding in a shared checkout.

The lifecycle verbs

All four are CLI commands and MCP tools, and all take --json. They run on the agent’s pinned worktree branch.

warden commit -m "fix: handle nil token"   # stage + commit the whole worktree
warden commit                              # …or let warden write the message
warden commit src/a.go docs/               # stage + commit only these paths
warden commit --amend                      # rewrite the last commit (--force if already pushed)
warden push                                # push the branch to origin (sets upstream)
warden push --force-with-lease             # …after a rebase/amend (safe force)
warden sync --base main                    # fetch + rebase onto origin/main
warden sync                                # no --base: session base → integration branch → repo default
warden sync --continue                     # finish a conflicted rebase (or --abort to drop it)
warden git pr --title "…" --body-file pr.md  # open (or return) the PR without ending the agent; MCP: create_pr
warden check                               # run every configured check
warden check test                          # run one (test / lint / build / …)
warden check list                          # list configured checks without running them

Rails

The verbs refuse the mistakes a raw git session makes:

No commits or pushes on protected branches — main/master by default; push your agent branch and open a PR (this holds even for --force-with-lease). Configure with git.protected_branches (replaces the default list) and git.protect_default_branch (default true: the repository’s remote default branch stays protected too); both hot-reload.
Force pushes use --force-with-lease only — warden push --force-with-lease overwrites your own remote branch after a rebase/amend but aborts if a teammate pushed to it since your last fetch; warden never issues a bare git push --force.
sync refuses a dirty tree (commit first) and, on conflict, leaves the rebase in progress reporting only the conflicting files and exiting non-zero. Resolve, then warden sync --continue (or --abort); raw git rebase --continue also works. A plain sync or commit during a rebase is refused with that hint. With no --base, the base is the session’s recorded base, then its autopilot integration branch, then the repository default branch.
commit --amend is refused on a merge commit and on a commit already in the upstream branch unless --force (then push with --force-with-lease). A rejected commit exits non-zero and restores the index.
push and sync report up_to_date when nothing moved; pushed/updated keep their meaning.
Pre-commit hooks run, and a hook failure comes back as a structured result instead of a wall of output.
Each action is linked to the agent for the audit trail.

Auto-written commit messages

Omit -m and warden fills the message: Fast-Brain distils a Conventional-Commits subject from the staged diff; if it is unavailable, a deterministic conventional message is derived from the changed paths. A blank commit is impossible.

Fast-Brain PR titles and bodies

warden agent stop <id> --keep-worktree --pr pushes the branch and opens the PR. When Fast-Brain is available it drafts a Conventional-Commits title and a short what/why body from the task, git diff --stat and the commit subjects against the base (fast tier first, thinking tier as a retry), and the digest attribution footer is kept. Each field falls back on its own to the deterministic title (from the agent’s subject/task) and the completion-digest body, and an explicit title or body in the request always wins. A failed draft never blocks the PR.

`warden check` and `.warden/check.yml`

check runs the commands declared in the project’s .warden/check.yml and returns a pass/fail summary with captured output for the failing checks only — in place of the hundreds of lines a raw test run spills into the transcript (the single biggest token win). Commands come from the project, so warden stays language-agnostic; a repo with no .warden/check.yml has nothing to run. Per-entry dir: supports monorepos. The file is located from the repository root, so warden check works from any subdirectory, and warden check list (MCP list_checks) shows what is configured without running it.

`warden git release` (alias `wd release`) — release tag advisor

warden git release reads the commits since the latest SemVer tag, recommends the bump (major/minor/patch) and next vMAJOR.MINOR.PATCH, and prints a categorized changelog. It then offers a 1-click flow: create an annotated tag (default N), and — with --push — push it to origin (default N). The tag message carries the changelog; an existing tag is never overwritten.

wd release --dry-run          # recommendation only — what agents should run
wd release                    # interactive: confirm tag
wd release --push             # confirm tag, then confirm push
wd release --yes --push       # no prompts: tag and push
wd release --json             # advice + actions taken

Pushing a v* tag triggers the release pipeline, so agents must not pass --yes unless the operator explicitly asked to tag. When nothing is releasable (bump none) the command says so and does not prompt.

Boundary enforcement (PreToolUse hooks)

The verbs are only half the story — warden also keeps agents on them. On the Claude Code backend, each agent is launched with a per-agent claude --settings file carrying PreToolUse hooks (backends without a system-prompt/hook seam degrade gracefully — the verbs still work, the in-agent guard rails are skipped). Every hook fails open (a hook error never blocks the agent) and is individually config-gated (default on). The layering goes steer first, then deny-and-redirect.

Hook	Config key	What it does
Prompt steer	`rails.git_conventions`	A system-prompt hint nudging agents toward `wd commit`/`push`/`sync`/`check` over raw git/test Bash — the gentle first layer.
Isolation guard	`rails.isolation_guard`	Denies an isolated agent’s Edit/Write that escapes its worktree into the shared repo.
Git-guard	`rails.git_redirect`	Argv-parses each Bash command and deny-redirects raw `git commit`/`push`/`pull`/`rebase` to the warden verbs (reads stay allowed); the deny message names the exact replacement.
Check-guard	`rails.check_redirect`	Deny-redirects a raw test/lint/build command that `.warden/check.yml` registers to `wd check` (broad runs redirect; focused `-run` runs pass through).

Default-isolated write agents (code/docs/website/debug-ci/tests, see Worktrees & task types) are what make the isolation guard meaningful: each gets its own worktree unless you pass --in-repo, so the guard has a boundary to enforce and parallel agents never clobber one another.