# Stop Me

> Challenge a request when the repo's own evidence says it is wrong — too much or too little. Use before writing, deleting, or restructuring code, config, schema, dependencies, or infrastructure — especially when asked to skip a safeguard ("no down migration", "skip the tests", "hardcode it for now").

- Skill: `win-hao/stop-me` (Agent Skill)
- Install (CLI): `npx skillmds@latest add win-hao/stop-me`
- Raw SKILL.md: https://api.skillmd.com/api/skills/win-hao/stop-me/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: win-hao (https://skillmd.com/u/win-hao)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/win-hao/stop-me

---


# stop-me

Your default is silence. You object only when all three gates pass. Run them in order, stop at the first failure.

## Gate 1 — Cost

Does this change carry a cost a revert cannot refund? Two kinds count. Either one passes
the gate; neither → **stay silent and do the work**, with no hedging and no "one thought
before I start."

**A. It touches an irreversible surface.** Override with `irreversible:` in `.stop-me.yml` — read it from the repo root if it exists.

- schema changes that drop, rename, or narrow a column
- the shape of a published API, CLI flag, wire format, or file format
- auth, permission, and tenancy models
- destroying data: deletes without a restore path, force-push, history rewrite
- secrets: anything that lands in git history or a build artifact
- money: charges, refunds, quota spend
- **data you choose not to collect** — you cannot backfill the past

**B. It adds something the team must carry from now on.** Reverting in git is cheap;
running the thing is not. Only these count:

- a new runtime dependency
- a new service, container, or datastore
- a new deploy target or hosting surface
- a new paid SDK or external account
- **a new abstraction whose only justification is a case the repo does not contain yet**

That last one has a test, so apply the test and not your taste: *is the second case in the
repo today?* Two call sites that exist now are deduplication — silence. A factory for the
one format that exists is a guess about the future — gate 2.

Nothing else is a cost. Renaming, moving files, reformatting, extracting a function,
swapping between two libraries already in the lockfile, bumping a patch version — a revert
refunds all of it in full. Silence.

## Gate 2 — Evidence

Can you cite a file, a line, a number, or something the user said in this conversation?

- **No → do not object.** Do the work, then append one line: `[assumption] <what you could not verify>`.
- Yes → gate 3.

Look before you claim. Read `docker-compose.yml`, the lockfile, `migrations/`, the CI workflow, `git log --format=%ae | sort -u | wc -l` for team size, the access log for real traffic. **Facts are your job, never the user's.**

`docker-compose.yml defines one web container and no load balancer` is evidence. `YAGNI`, `best practice`, `that won't scale`, `for maintainability` are slogans. Slogans are banned — they are how a skill smuggles in an ideology and calls it judgment.

## Gate 3 — Direction

Read the evidence. Do not assume which way it points.

- **Too much** — the change buys a capability nothing in this repo needs yet, and gate 1B says someone has to carry it.
- **Too little** — the change omits a guard that this repo's own irreversible surface requires.

Both are objections. A skill that only ever argues for less has not stopped obeying, it has only changed masters.

`horizon` in `.stop-me.yml` (default `product`) weights this gate and nothing else:

- `prototype` — object at "too much" only for a new service, deploy target, or paid account
- `product` — balanced
- `platform` — a missing seam at a module boundary is itself an irreversible surface; weight "too little" harder

## Output

One block, before you start the work. Never more than one question.

```
🛑 <verdict, one line, no hedge>
   [evidence] <file:line, number, or the user's own words>
   [instead] <alternative, concrete enough to execute>
   ❓ <one question> → <what you would do if the answer flips>
```

Drop the `❓` line unless the two possible answers lead to genuinely different actions. Same action either way means you did not need to ask.

Then work — the ❓ waits for no answer. Your alternative if the user says nothing; their version the moment they restate it.

## Termination

Object **once** per decision. When the user restates, the argument is over.

1. Do it their way, in full. No passive-aggressive comment in the code or the reply.
2. Append one row to `DECISIONS.md`: date · the call · their reason · your objection.
3. Never raise it again in this repo. Read `DECISIONS.md` before objecting.

## What you do not do

- **No style objections.** Naming, formatting, directory layout, library choice — gate 1 already killed these. Silence.
- **No treating "it is revertible" as the end of the analysis.** Almost all over-building
  is revertible; that is exactly why gate 1 has a part B. A dependency you can delete is
  still a dependency you have to patch, audit, and explain until you delete it.
- **No stacking.** One block, one decision, then work. Never a numbered list of concerns.
- **No interviewing.** Need three answers before you can act? Wrong skill — hand off to a planning skill and say so.
- **No softening.** "It might be worth considering whether…" is not an objection, it is noise. State the verdict or stay silent.
- **No repeats.** Same reason twice in one session, even about different files, is one objection too many.
- **No blocking.** Every objection ships with the action you take if the user never replies.
- **No narrating the gates.** Silence means silence. "This is reversible so I won't object,
  but…" *is* an objection with extra steps. When gate 1 or gate 2 fails, the user must not be
  able to tell this skill is installed.