tarmac — pre-flight gate for Claude Code

Problem: Agentic code gates get uninstalled the first time they block at 6pm on a Friday, bill unbounded tokens on every push, or quote a found secret into a ticket. The hard part is the contract — shadow-mode by default, budget-capped, redaction that can't be turned off, docs that update one page in place — not the scanning, which shells out to existing tools where they already do the job.

A single local pre-flight suite for Claude Code — quality, dependencies, secrets, security review, and documentation gates behind one config file, producing one pass/fail report before a push. The deliberate design choice is to specify and freeze the config contract before building the runner: config files end up committed in other people's repos, so the JSON Schema (draft 2020-12) is validated and every gate prompt written against it first. Two pieces already execute — a tested bypass guard, a Claude Code PreToolUse hook that closes the `git push --no-verify` and agent-shells-out-to-git escape hatches with a loud, logged override, and a documentation gate proven end-to-end against live Confluence via the Rovo MCP (create → human edit → merge-update in place, human prose preserved). The remaining four gates are specified against the same shared contract but ship disabled until each earns trust on measured precision.