Coldstart has not been released. The behavior on this page runs in the development build; there is no release you can install today.
A rule carried by code still needs the right moment to run. Coldstart uses four lifecycle events emitted by the coding agent: session open, before a tool call, before context compaction, and stop. There is no background timer or resident process; the event is the clock. That roster is closed by policy, so a later build carries a different count only by a deliberate act.
Across one export session, those moments orient the work, inspect a pending deploy or serializer edit, preserve a small in-flight signal before context is shortened, and check that the stop leaves a usable handoff.
The four moments
| Moment | What Coldstart does | Nearest limit |
|---|---|---|
| Session opens | Reads the pointer and announces scope, next action, blockers, reading list, available capability, and profile state | An unreadable source is reported; orientation cannot repair it |
| Before each tool call | Applies the risk floor and the declared session mode | It sees the pending call, not the whole project or human intent |
| Before compaction | Writes a small freshness and dirty-state signal into existing state | This is not a verified close or a complete memory dump |
| At stop | Records touched paths and checks whether a durable handoff covers the work | One bounded refusal cannot guarantee a correct close |
Without these events, a disciplined operator can run the same steps manually: read the pointer, review risky commands, note in-flight work, and close with checks. That is enough when missing an occasional step is acceptable. Lifecycle code earns its cost when skipping the step at that exact moment is itself a defect.
Different failures need different postures
The pre-tool floor asks if its matcher cannot run. A broken guard should not look like clean silence, and the cost is one unnecessary approval.
The opening, compaction, and stop paths continue after reporting their own failure. Blocking a session indefinitely would be worse than losing the automatic help. Neither posture is universally stronger: one favors the represented boundary; the other favors a usable escape.
Installed is not proved
Four claims must stay separate:
- Registered: the coding agent is configured to invoke the code.
- Fired: a recent event actually invoked it.
- Enforced: a particular input received the expected decision.
- Proved: a named check established its own predicate in its tested environment.
“The hook is installed” therefore cannot become “deployments are protected.” The complete account names the event, pending call, matched rule, returned decision, and evidence that was actually observed.
These lifecycle events are specific to the supported coding agent. Recent traces and local tests do not prove the same behavior on every shell, machine, or coding agent.
Next
Four moments and one list is not the whole answer. Most rules should not be on either: where a rule belongs.