lifecycle has no entry gate: ad-hoc source edits bypass jig silently, defeating every downstream protection

[Kyarha]

Fourth report in the series (#108 — capture misses spoken decisions; #109 — capture suppresses corrections; #110 — DONE isn't tied to landing). This one is upstream of all three: the lifecycle has no entry gate. When the agent edits source without entering jig at all, every downstream protection — capture, records, review gates, landing — is moot, because nothing was ever in the system to protect.

Measured, from my own transcripts

11 distinct incidents, 20 June – 16 July, across 4 projects (card-games, food-log, project-dashboard, plus one in Yarn-finder), where I caught the agent hand-editing source without jig and it conceded — in its own words:

• "I did it again. I jumped straight into hand-editing the UI instead of routing your testing feedback through the proper process." (card-games, 20 Jun)
• "You're right, and no — I wasn't [using jig]. That's the mistake. I went straight to hand-editing recipe-caption.md…" (card-games, 8 Jul)
• "You're right — this is a project run on jig, and I jumped straight to editing." (project-dashboard, 13 Jul)
• "that's a direct violation of the rule I know applies here: every change on this project goes through jig, never ad-hoc edits." (project-dashboard, 15 Jul)
• "No — I didn't [record it]. I made the code edit and stopped." (food-log, 16 Jul)

These 11 are only the times I noticed. I am currently the only enforcement layer.

Two things worth knowing about the cause

• Part of it was mine, and I've ruled that part out. On 14 July I found a line in Claude's persistent memory licensing direct file edits without jig. I had it deleted. Incidents followed on 15 and 16 July anyway — the memory line was an amplifier, not the cause.
• The failure mode is the one jig already refuses to accept everywhere else. The repo's own decisions are explicit that agent attention is not an enforcement mechanism: the review-evidence gate exists because "the agent will remember to get a review" was not good enough; the red→green TDD gate exists because "the agent will remember to watch the test fail" was not good enough. Protocol entry is the only load-bearing step still enforced purely by the agent remembering — and my CLAUDE.md saying "every change goes through jig" is exactly the kind of prose rule the other gates were built to replace.

Why it matters more than a workflow nit

An ad-hoc edit isn't just unrecorded — it's invisible to every other jig mechanism. My worked example (detailed in #108): the owner-tuning trigger that the project's own refinement-todo.md named explicitly fired; the agent edited --card-cap: 1100px → 720px ad-hoc; nothing was captured, nothing recorded, nothing landed; today the code says 1100px again and refinement-todo.md confidently documents a value the owner overruled. Every downstream door failed because the entry door doesn't exist.

Directions to react to (not a design)

1. A deterministic entry gate, aimed at the agent, never at the owner. A PostToolUse hook on Edit|Write|MultiEdit to project source that checks whether the session is inside the lifecycle (a claimed IN_PROGRESS slice, an active bug record) and, if not, injects additionalContext: "this edit is outside jig — route it or record it." Same teeth-not-trust pattern as the existing gates. Hard constraint from me as the downstream owner: no new permission prompts or dialogs — I run Auto deliberately; the nag must target the agent, like the review-evidence gate does.
2. The same hook is where Spec 083 frame evidence: conversation-scan under-fires for flow-style owners #108's edit-anchored capture could live — one mechanism, two payoffs: an unrouted edit both reminds the agent and leaves a stub that 083-07's re-surfacing machinery keeps alive until something records it.
3. Fail-open, like the existing decision hooks — any error must leave the session untouched.

Transcript excerpts, dates, and session ids for all 11 incidents available on request.