# AI use cases for Canny (qkal/Canny) Repo: [qkal/Canny](https://github.com/qkal/Canny) | Use cases: 5 | Page: https://dedupedai.com/use-cases/qkal-canny/ Canny is a supervision layer that hooks into Claude Code and Codex CLI, records what the agent did in an append-only ledger, and blocks the agent from finishing on an unsupported claim. This file holds every use case of this repo. Each one starts with a "## " heading and ends with its URL. - Stop an agent from finishing before a test passes: https://dedupedai.com/use-cases/qkal-canny/block-unverified-done-claims/ - Stop an agent from writing API keys into files: https://dedupedai.com/use-cases/qkal-canny/block-secrets-written-by-agent/ - Review what an agent actually did in a session: https://dedupedai.com/use-cases/qkal-canny/audit-agent-session-after-the-fact/ - Catch an agent that removes or skips tests: https://dedupedai.com/use-cases/qkal-canny/stop-agent-from-deleting-tests/ - Guard all projects on a machine with one setup: https://dedupedai.com/use-cases/qkal-canny/guard-every-project-with-one-install/ ## How to stop an agent from finishing before a test passes with Canny Repo: [qkal/Canny](https://github.com/qkal/Canny) | Difficulty: Intermediate | Time: 30 minutes | Basis: From the README Blocks the agent's Stop when code changed and no test, build, lint or type-check has passed since. **Who it is for:** A developer using Claude Code or Codex CLI who keeps getting 'done' messages on code that was never run. **The problem:** An agent edits code, runs nothing, and reports the work as finished. A rules file only asks the model to remember to test, and nothing checks it did. **The outcome:** The agent's Stop is refused until a check exits 0 after the last code edit, and the project's test command is named to it at session start. ### Steps 1. Confirm `node --version` prints 22 or newer. 2. Run `git clone https://github.com/qkal/canny.git ~/.canny/src` to fetch the repository. 3. From the root of your project, run `node ~/.canny/src/dist/cli.js init`. 4. Start a session, ask the agent for a small code change, and watch for a blocked Stop that names the files and the expected check. 5. Run `node ~/.canny/src/dist/cli.js status` to confirm the session and its events are recorded. ### Prompt to paste into your agent ```text Install Canny from https://github.com/qkal/canny into ~/.canny/src by cloning it, then run `node ~/.canny/src/dist/cli.js init` from the root of . Report the hook entries written and run `node ~/.canny/src/dist/cli.js status` to confirm at least one event is recorded. ``` ### Caveat On Codex, the hooks only take effect after you run /hooks and trust them, and on Claude Code the agent may need a restart before events appear. Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/ URL: https://dedupedai.com/use-cases/qkal-canny/block-unverified-done-claims/ ## How to stop an agent from writing API keys into files with Canny Repo: [qkal/Canny](https://github.com/qkal/Canny) | Difficulty: Intermediate | Time: 30 minutes | Basis: From the README Denies a write when its content has a known secret shape, such as an AWS, GitHub or Stripe key. **Who it is for:** A developer or team lead whose agent edits config, scripts or source files that sit in a git repository. **The problem:** An agent may paste a live credential into a source file or shell command while fixing something, and the key then reaches version control. **The outcome:** The write is denied before it happens, with a reason, so the credential never lands in the file. ### Steps 1. Install Canny by cloning `https://github.com/qkal/canny.git` into `~/.canny/src`. 2. Run `node ~/.canny/src/dist/cli.js init` in the project root. 3. Ask the agent to add a config value that contains a key-shaped string, and confirm the write is denied. 4. If a `.env` file is the target, check that git ignores it, since ignored `.env` files are exempt from this check. ### Prompt to paste into your agent ```text Clone https://github.com/qkal/canny into ~/.canny/src, run `node ~/.canny/src/dist/cli.js init` in , then ask the agent to write a test file containing a fake AWS-style key and report whether the write was denied and the reason given. ``` ### Caveat The check covers the key shapes listed in the README, and files written by an interpreter such as `python -c` or `node -e` are not seen, so it is not a complete secret scanner. Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/ URL: https://dedupedai.com/use-cases/qkal-canny/block-secrets-written-by-agent/ ## How to review what an agent actually did in a session with Canny Repo: [qkal/Canny](https://github.com/qkal/Canny) | Difficulty: Intermediate | Time: 30 minutes | Basis: From the README Reads the ledger and re-derives every Stop verdict from the recorded facts. **Who it is for:** A reviewer or team lead who needs to check an agent's claims on a finished task before merging its output. **The problem:** After an agent reports done, there is no record of which commands it ran or whether the checks passed. **The outcome:** A list of recorded events with exit codes and verdicts, plus confirmation that each Stop verdict replays to the same result. ### Steps 1. Install Canny and run `node ~/.canny/src/dist/cli.js init` in the project. 2. Complete an agent session on the task you want to review. 3. Run `node ~/.canny/src/dist/cli.js status` to list recorded sessions and their events. 4. Run `node ~/.canny/src/dist/cli.js replay` on the session to re-derive every Stop verdict and report any mismatch. (inferred, check the README) ### Prompt to paste into your agent ```text Using the Canny repository at https://github.com/qkal/canny installed in ~/.canny/src, run `node ~/.canny/src/dist/cli.js status` and then `node ~/.canny/src/dist/cli.js replay` for the most recent session in , and report each Stop verdict and whether any mismatch was found. ``` ### Caveat The ledger stores only paths and outcomes, not file contents, so the review shows what happened but not the full text of every edit. Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/ URL: https://dedupedai.com/use-cases/qkal-canny/audit-agent-session-after-the-fact/ ## How to catch an agent that removes or skips tests with Canny Repo: [qkal/Canny](https://github.com/qkal/Canny) | Difficulty: Intermediate | Time: 30 minutes | Basis: From the README Flags edits that delete test cases or add skip markers, and asks for approval on Claude Code or denies on Codex. **Who it is for:** A developer whose agent is asked to make a failing suite pass and might disable the failing tests instead. **The problem:** An agent can make a suite look green by removing test cases or marking them skipped, and the failure disappears from view. **The outcome:** Test removals and skip markers trigger a prompt or a denial, with a reason that says how to allow it if the removal was intended. ### Steps 1. Install Canny and run `node ~/.canny/src/dist/cli.js init` in the project root. 2. Ask the agent to make a failing test pass by any means, and watch whether it tries to add a skip marker or delete a test. 3. On Claude Code, approve or reject the permission prompt that shows Canny's reason. 4. To allow an intended removal, add the exception in `.canny.json` as described by the reason text. ### Prompt to paste into your agent ```text Clone https://github.com/qkal/canny into ~/.canny/src and run `node ~/.canny/src/dist/cli.js init` in . Ask the agent to make a failing test pass and report whether any edit adding a skip marker or removing a test case was asked about or denied, with Canny's reason. ``` ### Caveat Detection covers the skip markers and commands the README lists, so an unlisted way of disabling a test will not be caught. Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/ URL: https://dedupedai.com/use-cases/qkal-canny/stop-agent-from-deleting-tests/ ## How to guard all projects on a machine with one setup with Canny Repo: [qkal/Canny](https://github.com/qkal/Canny) | Difficulty: Advanced | Time: 45 minutes | Basis: From the README Writes Canny's hook entries to the global agent settings so every project is covered. **Who it is for:** A developer or platform lead who wants the same supervision in every repository on a workstation. **The problem:** Setting up hooks project by project is repetitive, and a new project can be started without any guard. **The outcome:** Claude Code and Codex hook files point at Canny, so every project the agent opens is supervised. ### Steps 1. Clone the repository with `git clone https://github.com/qkal/canny.git ~/.canny/src`. 2. Run `node ~/.canny/src/dist/cli.js init --global` once. (inferred, check the README) 3. Open any project and run a short agent task to confirm events are recorded with `node ~/.canny/src/dist/cli.js status`. 4. To remove a single project later, run `node ~/.canny/src/dist/cli.js remove` from that project root. ### Prompt to paste into your agent ```text Clone https://github.com/qkal/canny into ~/.canny/src and run `node ~/.canny/src/dist/cli.js init --global`. Report the files written, which per the README are ~/.claude/settings.json and ~/.codex/hooks.json, and run `node ~/.canny/src/dist/cli.js status` after a short session in . ``` ### Caveat Global hooks change settings used by every project, so review ~/.claude/settings.json and ~/.codex/hooks.json before relying on them. Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/ URL: https://dedupedai.com/use-cases/qkal-canny/guard-every-project-with-one-install/