Checks

In order to verify that each skill is applied, the tstorm CLI discretely runs the following checks to confirm that they were used. Exit codes are used to communicate status.

Check	Reads	Says
tstorm check commit-message <file>	a commit message, or a pull request’s title and body with --pr	the type, the 60-character subject, the blank line, the 72-column body
tstorm check frontmatter [dir]	the documents tree .tstorm.toml names	that every document carries the identifier an issue cites it by
tstorm check policy [settings]	a repository’s permissions	which of the four reserved commands it does not deny
tstorm check isolation [dir]	skills and role definitions	that none of them asks the harness for a worktree
tstorm check version	the manifest, BaseVersion, the last tag, the base branch	whether the manifest’s version sorts below the last release, whether a tag names a development version, whether a tag disagrees with the manifest or the binary’s version, and whether the base branch holds the tagged commit

0 is nothing found, 1 is something found, and 2 is a check that could not run. A caller reading only “non-zero” cannot tell a bad commit message from an unreadable file, and the two need different answers.

What runs on its own

The payload registers one script for two events, and tstorm hook picks the check from the event it is given.

A write to a document under your configured tree is checked for its frontmatter and never refused. What it finds is reported into the session, which decides what to do. A hook that blocks an editor gets uninstalled, so this one never does.

A git commit runs one check that does refuse. A message whose shape is wrong is denied before git takes it, because a subject that will not read in git log --oneline costs nothing to fix now and cannot be fixed later.

Harness	Write check	Commit check
Claude Code	on a Write or Edit	on a Bash command
Pi	through the package extension	through the same extension
Codex	registered, never fires	on a Bash command

Codex writes through its exec tool rather than a Write or Edit tool, so the write check’s matcher never matches; tstorm render --target codex says so in its report, and #18 is where the extraction that fixes it goes.

CI runs the same binary. This repository’s check.yml runs the frontmatter, isolation, policy and version checks. The release workflow runs the version check again with the tag it is building.

A harness caches an installed plugin by version and reports it current while that string is unchanged, so a re-rendered payload reaches an existing install at the next release, when tstorm release moves the version. A pull request leaves the version alone.

When nothing fires

A hook is a session-start affair and a binary is a PATH affair, so there are three ordinary ways to be working with no check behind you:

• The session started before the plugin was installed or enabled. Restart it. claude plugin list names what the next session will load.
• tstorm is not on PATH. The hook lets everything through and says so once per machine, since it runs on every shell command a session makes. TSTORM_BIN names the binary where it is somewhere unexpected.
• The commit was written in an editor, or its message was built by a command substitution or a heredoc. The check reads what a shell would give it and says nothing about the rest, which is the safe direction for a check that refuses.

The editor case is what a git hook covers, and it is yours to add. This repository keeps one in .githooks/commit-msg, enabled with git config core.hooksPath .githooks. That setting replaces .git/hooks wholesale, so every hook you already had stops firing; move them across first.

Running them by hand

tstorm check commit-message .git/COMMIT_EDITMSG
tstorm check frontmatter               # reads the tree from .tstorm.toml
tstorm check policy .claude/settings.json
tstorm check isolation .claude

Before a commit, the one worth typing is the one the commit check runs:

git log -1 --format=%B > /tmp/msg && tstorm check commit-message /tmp/msg

Prose has no check. The writing-docs skill and its tells catalogue are the standard, and a reviewer reads the diff’s prose against them.