Codex edits in VS Code could bypass protected-branch guards when Codex session env markers were missing. This flips the default to block protected-branch commits/pushes in all contexts and keeps VS Code writes as an explicit per-repo opt-in.\n\nConstraint: Guardrails must still allow intentional local overrides for teams that want manual VS Code protected-branch operations\nRejected: Keep VS Code bypass default-on and rely on Codex env detection | Codex session markers are not always present in every integration surface\nConfidence: high\nScope-risk: moderate\nReversibility: clean\nDirective: Keep template and hydrated .githooks behavior aligned when editing guardrail hook logic\nTested: node --test test/install.test.js\nNot-tested: Live VS Code GUI commit/push flow against a real remote