Install

Two commands in the harness, three lines in a terminal, one canary to prove it.

Install (Claude Code)

Read the risks and mitigations first; installing means you accept them. Then two commands. Python 3.9 or later, standard library only. Nothing leaves your machine except a licence activation you start yourself.

/plugin marketplace add garitac/helmet-duck
/plugin install helmet-duck-bushido@helmet-duck

The duck refuses nothing until you record your acceptance, which arms the gates; then seal the installed copy so an edited duck fails closed. Both are typed by you in a terminal, never by the agent, which is refused them. The plugin installs under ~/.claude/plugins/cache/helmet-duck/helmet-duck-bushido/<version>/; these lines find it, accept, seal and show the result.

DUCK="$(ls -d ~/.claude/plugins/cache/helmet-duck/helmet-duck-bushido/*/duck.py | tail -1)"
python3 "$DUCK" accept && python3 "$DUCK" seal
python3 "$DUCK" status

Expected in the status: risks accepted (armed) : yes and sealed : yes. Then prove the deny channel from inside a session: ask the agent to run echo HELMET-DUCK-CANARY-DENY, and the harness answers GATE G0: canary: the deny channel is live.

To arm the commit gate in a project, declare its check command in .helmet-duck.json at the project root:

{"evidence": {"command": "python3 -m pytest -q"}}

Install (Codex)

Codex sends the same hook events and accepts the same answers; only its file-edit tool differs, and the duck reads the paths out of each patch. Clone the plugin's repository, github.com/garitac/helmet-duck-bushido, somewhere permanent, copy codex/hooks.json to ~/.codex/hooks.json with $PLUGIN_ROOT replaced by that path, then run /hooks inside Codex and trust each hook. Codex runs no hook you have not reviewed. Then accept and seal as above. The plugin manifest for Codex's marketplace ships in that repository too.