A covenant is a promise, not a fence
The disciplines it enforces are the ones a good developer already imposes on themselves. They bind the human exactly as much as the AI, and the framework's own authors get judged by them daily.
Judge the work,
then decide whether to stop it.
A development discipline framework for building alongside an AI coding partner. Polydeukes judges what a developer or an agent is about to do, records the verdict, and by default lets the work proceed.
$ pdks init && pdks-claude-code init
scaffold polydeukes.config.yaml
hook PreToolUse -> covenant check
$ # the agent proposes a write to a protected path
blocked shell-mod packages/core/dist
read-only proof missing; witness with pdks witness
exit 2, and one row in .polydeukes/roi.logAsking the model nicely has a measured failure rate
These are other people's numbers, from the papers and system cards that published them. Each one is measured under conditions worth reading, so the conditions are stated with it.
55% → 35%
An explicit instruction not to cheat leaves a third of runs cheating.
Anthropic's own anti-hack prompt, given to its own flagship model, cut hacking on Impossible Tasks from 55% to 35%. Sonnet 4.5 went 53% → 20%, Haiku 4.5 30% → 23%, Opus 4.1 80% → 45%.
Impossible Tasks are built to be unsolvable, so the model must give up or hack. On ordinary reward-hack-prone coding tasks Opus 4.5 scores 0%.
Claude Opus 4.5 System Card, §6.10.130% vs 55%
A better model is not a more obedient one.
On the same evaluation, the smallest model in the family hacked least and the largest hacked most. Anthropic calls its flagship "comparatively less corrigible when given instructions".
Within one model family on Impossible Tasks. Across vendors the ordering is not monotonic either way, which is the point: you cannot pick a model that will not take the shortcut.
Claude Opus 4.5 System Card, §6.10.154% → 6%
The harness around the model decides the outcome.
One model, two scaffolds, the same 50 tasks. Across the table the spread reaches 48 points, and it is far smaller for some model families than others.
SWE-bench Verified Mini is 50 tasks, so one task is two points. This measures scaffolding, not constraint enforcement.
Holistic Agent Leaderboard, arXiv:2510.11977, Table A19DO NOT MODIFY THE TESTS
The researchers' own remedy is mechanical, not verbal.
Agents edited the tests anyway. Every prompt variant in the study carried that line verbatim, and the paper's recommendation is to hide the tests or make them read-only.
Measured on constructed impossible and conflicting tasks, where a correct solution does not exist.
ImpossibleBench, arXiv:2510.20270
None of this measures Polydeukes. It measures the gap a covenant is meant to sit in: an instruction is a request, and a request has a failure rate. What a framework can add is not a stronger request but a record of what was actually about to happen.
So we are judged by it too, on every call
This repository runs the framework against itself. Every Edit, Write, and Bash call is judged before it runs, and every commit is judged again as a diff. Of 81,939 judgments over 20 days, it refused 1.56% and reopened 12.6% of those through a witness. That is one project's record, not a benchmark.
- 1.56%of calls refused
- 1,205recorded, not refused
- 12.6%of refusals reopened
- 37disciplines in force
whenverdictdisciplinepath
16:43:33blockedshell-modpackages/core/dist
16:36:57blockedshell-mod.git/hooks
16:36:52blockedshell-mod.git/hooks
16:33:46advisedenglish-only-sourcespackages/documentation/src/pages/index.astro
16:33:46advisedself-modbiome.json
16:32:11advisedbranches-come-from-a-ticket—
These rows are this repository's own, copied from .polydeukes/roi.log on 2026-09-15. The framework's authors are judged by the disciplines they publish, on every call, and the record is the same one a reader gets.
Three ideas carry the rest
Judging and stopping are separate decisions
Every declared discipline is judged on every matching call. What a break then does is a second question. By default it is recorded with its reason and the call continues. enforce: block is a promotion the author chooses.
Every judgment leaves a row
.polydeukes/roi.log holds one line per verdict, in a vocabulary that says what was observed rather than how it felt.
What it does today
pdks-claude-code initJudge a session call- A PreToolUse hook hands each edit to the judge before it runs. The adapter builds the input IR, and the umbrella returns a verdict.
pdks covenant check --diffJudge a finished change set- The same promises, observed a second way. Every verdict lands advised at exit 0 unless the command carries --enforce block.
pdks docs searchRead the docs offline- The documentation ships inside the package, so the answer comes from the same version that does the judging. No network, and no drift.
pdks explainSee what each surface judges- Print the live assembly: what each surface observes, skips, and excludes, without judging anything at all.
The verdict vocabulary
An exit code alone does not describe all observations. Exit 0 means the operation may continue, not that every discipline passed.
passed- judged and upheld the covenant
advised- recorded without stopping the operation
blocked- a violation stopped the operation
witnessed- a blocking result allowed through its valve
Watch one call get judged
Install it, wire one surface, and send the hook a proposed write. The tutorial ends with a verdict on your screen and a row in your own log.