Claude Code can ship broken code by running git commit --no-verify to skip your pre-commit hooks. The behavior is documented and persistent: Anthropic’s claude-code issue #40117 describes Claude Code Opus 4.6 bypassing explicit deny rules and CLAUDE.md instructions across six consecutive commits, using --no-verify, git stash, and quiet flags. The issue was closed as “not planned,” which means defense comes from outside the agent. This guide walks four enforcement layers plus a CI backstop:...