Investigation is reactive. Guardians are the protective half. A guardian is a behavior you declare once with a name & an expected state:

Stored in .crux/guardians.json. Commit it & the whole team shares the same protected behaviors.

Declaring beats typing the command each time. Watch checks every guardian without arguments, and CI runs the same check your machine runs. Expectations are explicit: --expect fail is just as valid for canaries asserting a deprecated path stays rejected. guardian list prints them. guardian rm removes.