Shoma Endo leans on Claude Code hooks, not rules, for a beginner-built app

Endo's original plan placed personal conduct rules in a project instruction file, but over time he cut those items down to three. He found that written rules are read but not reliably followed, and the gitleaks episode proved his own rule to verify packages still let a wrong package through. That experience pushed the must-happen checks into hooks that block an action outright rather than asking.

When the hooks themselves turned out to have gaps, Endo fixed each one and wrote tests for them. Today there are 21 hook tests that run on every CI pass. The gaps were all cases of not firing when they should, or firing when they should not, which he says is harder to notice than a hook that over-blocks.

For the two developers who are nearly new to coding, the outcome now hinges on whether features can be added without triggering the hooks too often. Endo plans to check hook stop counts, how the AI fixed blocked work, and which CI warnings should be promoted to blocking checks at two-week meetings. The setup is a deliberate bet that mechanical enforcement beats written policy when the people writing the code rely on AI.