A guardian is a behavior you declare once with a name & an expected state. Declarations live in .crux/guardians.json inside the repository, so committing the file shares the same protected behaviors across the team & CI.

usage

Default expectation is pass. --expect fail is equally valid for canary behaviors that should keep failing, like asserting a deprecated path stays rejected. guardian list prints declarations. guardian rm removes one.

why declare

Watch mode checks every guardian without arguments, so the same command works locally & in CI. The expectation field turns watch into a gate: a guardian whose current state differs from its expectation fails the run even without drift, catching violations the moment they appear.