The quiz hook is a Level 1 control — and the bypass is logged

A tool launched on Show HN this week that belongs in this series' taxonomy: Sphinx — a Git hook that pauses your push on protected branches and quizzes you on what the AI's code actually does. Wrong answer: you learn why and try a new scenario. Correct answer: the push proceeds. Install is npm install -g sphinx-understand, sphinx install wires it to your agents, and pushes work as usual after that.

It works with Codex, Claude Code, Cursor, OpenCode, Pi, or plain Git. It runs on minimal tokens from your existing coding agent, or any OpenAI-compatible endpoint. Your answers never reach the coding agent, and the .env files and keys are never opened. MIT licensed, Node 22.19+, macOS, Linux, or WSL.

And one flag in the docs separates it from every "AI gate" tool that shipped this year: sphinx yolo lets pushes through without the quiz — and logs every skip.

The HN debate is a rung assignment

The Show HN discussion ran the full argument in half a day, and both sides are worth reading as data, not opinions. The praise: it "slows things down and is quick to implement"; one builder of a similar tool was "positively surprised by the question quality"; and the comparison that lands hardest is to the industry's oldest reflex — never copy Stack Overflow code you didn't understand. The criticism: the quiz is trivially bypassed — paste the questions back into the agent, or just delete the hook; it doesn't catch diff-level defects — a leftover debug print or a weakened assertion passes any comprehension quiz; a commenter predicts "confirmation fatigue" and agents answering the quiz for us; and the sharpest dismissal: all of this to avoid knowing what you're doing.

Both sides are right, and the taxonomy explains why without taking sides. The quiz hook is a Level 1 control — a primitive in context, on the ladder this series has been building. It exists, it is visible, it slows people down. What it cannot do is enforce: the human can fail the quiz on good code and pass it on bad, the agent can answer for the human, and the hook can be removed. Level 1 controls are real — they slow the eighty percent who are lazy but not malicious — and they are the first thing to outgrow.

What the discussion proved without noticing: the bypass is priced and logged. sphinx yolo lets pushes through, and every skip lands in a log. That single design detail moves the tool up a half-rung — a bypass that leaves a record is no longer invisible drift, it is a decision trail. The QGIS project's failed tagging process — roughly fifty PRs tagged, forty closed, and then abandoned — had no such log.

The rung it shares with its ancestors

The Stack Overflow comparison in the thread is the deepest one, and it is twenty years old: never ship code you copied without understanding. The industry's answer then was the same rung — a human review, a production incident, eventually understanding. The AI version compresses the cycle: the code arrives faster, in larger volumes, with the confidence of fluency. The quiz hook is the modern re-skin of the oldest control in software.

What the quiz will never catch: the diff-level defects that comprehension cannot see — the leftover debug print, the weakened assertion, the subtly wrong error path. Those need the other rung: machine checks on the diff itself. What the machine checks will never catch: whether the human understands what they just shipped. Two failure modes, two controls, and a team that confuses them has neither.

The design question for any team is therefore not "should we quiz the humans" but "which failure mode are we actually defending against" — and the honest answer for most AI-assisted teams today is neither: the code ships, the comprehension gap silently grows, and the first measurement happens at the incident.

What to steal

• The logged bypass is the receipts culture in a single flag. sphinx yolo does not pretend the quiz did not happen — it records the skip. Any gate you deploy should have the same property: bypassable, but never invisibly.
• Comprehension and diff-defects are different failure modes. A quiz catches the first; linting, tests, and diff review catch the second. A team that deploys one and expects the other has bought a seatbelt for the wrong seat.
• The bypass debate is the rung assignment. If your control's criticism thread is full of "easily bypassed", you have a Level 1 control — and that is fine, as long as the docs say so and the log records the bypasses.

Run the whole post in three commands

The tool is its own demo: install it, let the quiz fire on your next AI-assisted push, then bypass it and watch the skip get logged. Three commands, and you have lived everything this post argues:

npm install -g sphinx-understand
sphinx install          # wires Git and your coding agents
git push                # your next AI-assisted push — the quiz fires

Wrong answer: you learn why and rewrite the scenario. Right answer: the push proceeds. Then bypass it, and check the trail:

sphinx yolo             # pushes pass without the quiz
git push                # passes — and the skip is logged

That logged skip is the entire debate, settled in one line of your own terminal: the control slowed you down once, the bypass was recorded anyway, and the record is now yours to audit.

Two honest limits

I did not build or run Sphinx — the audit is from the repo, the docs, and the thread. The quiz mechanics, the yolo logging, and the token claims are from the project's own materials; the HN debate is quoted with attribution. My contribution is the taxonomy placement, which anyone can dispute by running the tool — that dispute is welcome, it is the differential working.

And the tool is four days old, which means the bypass debate is the ceiling by design. A Level 1 control cannot be patched into Level 2 — the quiz cannot verify the diff, and the hook cannot verify the quiz. What can grow: the log. If the skip data ever feeds a dashboard — pushes shipped, skips logged, comprehension answered per developer over time — the tool stops being a quiz and becomes a measurement. That is the version worth waiting for.

Your turn

Sphinx is MIT, one npm command, and works with your existing agents. Run it on your next AI-assisted push and count three things: the questions you answered, the skips you logged, and the one defect the quiz could never have caught. Post the three numbers — the ratio is the state of AI-assisted development on your team, measured instead of argued.