So much for what the checks are. Where one runs decides who it can stop, starting with the last moment on the machine doing the work.
Pre-commit hook
A script git runs when someone makes a commit. If it exits with anything but 0, the commit is refused. The git chapter showed how one works. The question here is what belongs in it: fast checks only, on what is really going in.
An agent commits often and reads the refusal at once, so this is a cheap place to catch things. It has two weaknesses. A slow hook tempts everyone to skip it, and because it lives on the machine doing the work, the agent is able to.
“Add a pre-commit hook with Lefthook that runs on staged files only: biome check on them, then gitleaks git --pre-commit --staged --redact. It must finish in under 10 seconds. Slow tests go in CI, not here. If gitleaks is missing, exit 1.”