A written rule is guidance; a check wired into a merge gate can enforce a mechanically testable requirement. But neither Markdown instructions nor CI are automatically reliable: checks can be skipped, mis-specified, or wrong. In a September 20, 2026 article, Navesz reports reviewing 161 commits across six personal repositories and concludes that enforcement is useful only when it is more reliable than the rule it replaces. The sample is a firsthand case study, not evidence about software repositories generally.
What the six-repository review found
Navesz says they reviewed 161 commits across six repositories they own on August 25, 2026. They explicitly caution that six repositories, all theirs, are too small and narrow a sample for a general result. The observations are useful as examples of failure modes, not as an estimate of how often developers or coding agents follow repository rules.
As an Amazon Associate I earn from qualifying purchases.
- Three of the six repositories had no CI; those same three had broken lint at the time of the review.
- Forty-one of the 161 commits, or 25.5%, contained an AI co-author trailer. That is a count from these repositories, not a prevalence estimate for AI-generated code.
The initial problem was practical: Navesz encountered coding agents that hardcoded values, missed stack conventions, or skipped an existing component library. The review shifted the question from whether instructions were clear enough to whether the standards had a working enforcement path.
Why a rule in Markdown may not change behavior
Repository instructions such as AGENTS.md can tell a coding agent what conventions to follow. They are still instructions, not proof that the convention was observed. Navesz describes a repository containing an AGENTS.md “Hard rules” section, SECURITY.md, GOVERNANCE.md, CONTRIBUTING.md, and a script chaining formatting, lint, type checking, tests, and a build. The script existed but, according to the author, was never run.
#1 Best Overall
That example makes two distinct gaps visible: rules can be overlooked, and checks can sit unused. Adding another document does not close either gap. A routine local check can help developers catch problems early; a required pull-request check can make passing a specified test a condition of merging. The latter only enforces what the check actually measures.
Which rules can be checked mechanically?
Some standards have objective conditions a tool can evaluate: formatting, lint findings, types, tests, or whether a required build succeeds. Other rules depend on intent or context—for example, whether a design choice fits the project or whether a component library was appropriate for a particular change. A script may help flag candidates, but a heuristic is not the same as a dependable verdict.
ESLint’s official Markdown processor documentation gives one narrow example: JavaScript code blocks embedded in Markdown can be linted, including through CI or git hooks. This converts a code convention in documentation into a checkable condition; it does not make subjective prose rules mechanically decidable.
A separate project, tenet, documents a rule-based review-gate approach for changes. It is an implementation example, not independent evidence that one enforcement style produces better compliance. Its own comparisons and benchmark references should be understood as project-authored claims.
How automated gates can fail
Navesz’s examples show why simply adding a check is not enough. One checker treated “not applicable” as though the rule had passed. Tests that examined only exit codes missed the distinction because both passed and not-applicable cases returned zero. The author reports applying 70 mutations during checker development and finding that 30 survived while the test suite remained green; they then added expected-state assertions. These are development observations from the author’s project, not independent validation.
Another literal-color heuristic produced seven hits and zero true positives in the example repository. A noisy rule that blocks valid changes can erode trust and encourage workarounds, so uncertain heuristics may be better as warnings until their precision is improved. A green verification command can also be misleading: Navesz describes a broken project generator that the command failed to catch.
- Test distinct outcomes explicitly, including pass, fail, and not applicable.
- Try representative bad cases and confirm the check catches them; also test valid cases to expose false positives.
- Verify that the command exercises the behavior named by the rule, rather than merely returning a green status.
- Choose blocking versus warning behavior according to confidence and the cost of a mistaken block.
Local hooks and CI are not the same as a server-side rule
A local hook or workflow file can make checks convenient, but Navesz notes that someone with repository write access may be able to edit those files. The article also reports a bypass using git update-index --skip-worktree. These examples are reminders that a check’s location and permissions affect its enforcement; they do not establish that every hook or workflow is easy to bypass.
For one repository, Navesz reports configuring a GitHub ruleset with a required check and no bypass actors. In the author’s test, it blocked a pull request containing a planted failure and refused a direct push to main. This is a report about that repository’s tested configuration, not a universal guarantee for all GitHub rulesets or access-control setups. Server-side controls can strengthen a gate, but their effectiveness depends on the ruleset and who can change or bypass it.
Best Value
A practical way to choose and build enforcement
- Write the rule clearly. Keep agent-facing or contributor-facing instructions where people can find them, and state the intended behavior rather than relying on an unexplained check.
- Decide whether it is objectively testable. If the rule has a reliable machine-verifiable condition, implement a focused check. If context or judgment is central, retain human review or use automation as a non-blocking signal.
- Run the check in the workflow that matters. Local checks offer fast feedback; a pull-request or merge gate is more effective when passing is required before integration. Confirm that the check actually runs rather than merely existing in a script.
- Test the checker itself. Include examples that should pass, fail, and be not applicable. Make sure the check catches representative violations and does not block ordinary valid changes.
- Set enforcement strength deliberately. Use warnings for uncertain heuristics, and make a check blocking only when its behavior is sufficiently dependable for that role.
- Protect the gate if bypass resistance matters. Review who can edit workflows, change rules, or bypass required checks; use server-side protections appropriate to the repository.
What this case study does—and does not—show
The observations support a limited but useful conclusion: written rules and available scripts do not ensure compliance, while automated checks can make objective requirements harder to miss when they are actually run and correctly designed. They do not prove that Markdown instructions are useless, that CI universally improves compliance, or that a required check prevents every bypass.
Navesz’s central standard is that “the enforcement has to be more reliable than the rule it replaces.” The author discloses that rebar, discussed as a tool in the article, is their open-source project, was in alpha, and had only them as a contributor at the time of publication; those details may change. The personal measurements should be read separately from the author’s product claims.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →
