Stop agents editing tests to make them pass

Goal: Make sure “tests pass” means the code was fixed, not the tests.
Setup: agents used in source: Claude, Codex, Gemini CLI; tools/MCPs stated: agent-guard-hooks.
Steps:
1. pip install agent-guard-hooks; agent-guard install (add --tool codex or --tool gemini for those CLIs).
2. On SessionStart it hashes every test file; edits to tests are caught.
3. A PreToolUse hook on Bash blocks risky patterns (pushes to protected branches etc.) before they run.
4. Run agent-guard verify --tool codex --days 7 to check gates are mounted and firing.
Rules: ask me before anything irreversible (sending, posting, paying, deleting); don’t invent data, results or tools I haven’t given you; tell me what you couldn’t verify.
Based on: hao li — https://dev.to/haoli/my-agent-changed-tobe10-to-tobe9-and-called-it-done-i-built-hooks-to-stop-that-8c4

Steps are from the source. Includes a “Based on” credit line.