Everything so far runs on the machine where the agent is working. The check that holds runs somewhere the agent can't reach.
Continuous integration
Also called CI
Everyone merges their work into the shared code often, and a server builds and tests each change on a clean copy of the project. That server is called CI too, and its green tick or red cross sits on the pull request.
A clean machine has only what was committed, so it finds what works only on the agent's laptop. A local hook can be skipped, and a required check on a server can't, unless the agent can edit the check itself, so the file that defines the check needs guarding as well. And ten agents get the same gate as one.
“Add .github/workflows/ci.yml that runs bun install --frozen-lockfile, bun run typecheck, bun run lint and bun test on every pull request. Name the job check, so I can make it required on main. Then break a test on purpose and show me the run failing.”