Discussion blocks the edit tools (Edit, Write, MultiEdit, NotebookEdit) — Claude can read, explore, and propose, but not change source. Implementation unlocks them. Documentation allows docs-only edits — Markdown and task files — while source edits stay blocked.

Mode lives in .claude/state/daic-mode.json. A missing or corrupt file reads as discussion — the safe default. The protocol engine sets the right mode on each step entry, so you never flip it by hand.

The gate is a hook that runs before the tool, in the runtime — not an instruction in the prompt. It signals the harness through its exit code: allow or block. An agent can’t talk its way past a process that intercepts the tool call itself.

Read-only Bash commands still run in discussion mode (a separate allowlist gate), so Claude can keep investigating. Specialized subagents and the wiki get explicit whitelists so the framework never blocks its own machinery.

The DAIC gate is one layer of a four-layer stack. Hooks intercept tool calls before they run — the gate is in the runtime, not the prompt. MCP is the deterministic layer — state transitions happen through tools the agent invokes but cannot fake or skip. Protocols are the workflow rails — which step you’re on, what’s allowed, what comes next. Prompts are the knowledge layer — your conventions, your wiki, loaded when they matter. An agent can talk its way around a prompt; it can’t talk its way past the runtime.

For write tools, the same hook also checks the git branch against the task’s required prefix — blocking accidental commits to the wrong branch. The task name’s action prefix picks the branch prefix:

There are four failure modes the hook guards against: wrong branch, no branch, task missing, and branch missing. It fails open on a flaky git call but fails safe on missing task state.