Four straight answers plus one honest disqualifier list — every claim below traces to a file, a hook, or a network call you can read yourself in the repo, not a slogan.
Heimdall wires an external, falsifiable oracle to every fix, so the agent's own claim of success is never the proof — the check has to be able to go red. The evidence that ships with the change is a gate-PASS verdict: secret-scan, lint, tests, and an assertion oracle scored a perfect 1.0, not the model's word.
That's the falsify discipline: bin/falsify <domain> --assert-score 1.0 runs the domain's mutant suite and only reports PASS when every mutant is caught — not most of them. The same pre-push chokepoint that runs falsify also runs bin/secret-scan, bin/heimdall-selfscan (a full-history gitleaks pass), and bin/corpus — a regression gate that replays every failure the gates have ever caught, so a case that once broke can never quietly break again.
On top of correctness, bin/bloat-gate and bin/parallel-gate catch dead code and unsafe concurrent edits, and a Write/Edit hook blocks placeholder code outright — an unimplemented-stub marker, a bare pass-only function body, or an empty function shell never lands in the first place. None of these can be satisfied by the agent asserting success; each is a real command with a real exit code.
Install the gate hook once — hmd guard install — and every git push Claude Code issues through its own Bash tool is intercepted before it runs: secret-scan, a full-history self-scan, the falsify oracle, and the corpus regression gate all have to pass, or the push never leaves the tool call. A non-zero exit from any of them is a hard block, not a warning.
This runs as Claude Code's own PreToolUse hook on the Bash tool, matching on the git push command itself — so it is not a git hook that a --no-verify flag can skip; the gate stands between the agent and the shell, and a blocked push returns the real reason (for example "oracle gate <domain> is not falsifiable (score < 1.0)" or "corpus regression") instead of silently failing.
For pushes issued by a human outside Claude Code, hmd guard install also wires a native git pre-push hook that runs a belt-and-suspenders layer — commit-identity allowlisting plus a full-history gitleaks scan — so the same fail-closed posture holds whether the pusher is the agent or you.
Partially. The coordination ledger — collision-avoidance claims and HAID-attributed identity — already speaks MCP, so Cursor, GitHub Copilot, and any MCP-capable client can join the exact same ledger as Claude Code today; the full verification gate suite and the watchman statusline do not run outside Claude Code yet.
bin/heimdall-ledger-mcp is a real, shipped MCP server (stdio JSON-RPC) exposing six tools — read_claims, make_claim, release_claim, read_capsules, append_decision, raise_conflict_pr — over the Model Context Protocol. A connecting client declares itself at initialize (clientInfo.name: cursor, copilot, claude-code, …) and gets a HAID-attributed identity, wired via a drop-in .mcp.json.
But the gates from the two questions above — falsify, corpus, secret-scan, the pre-push chokepoint — and the statusline HUD are Claude Code hooks.json PreToolUse/PostToolUse mechanisms, which only fire inside a Claude Code session. Bringing that surface to Cursor, Codex, and Gemini is explicitly on the roadmap as "hmd everywhere" — marked COMING, not shipped.
Three things leave your machine, each opt-out or opt-in-by-use, and none of them are your source code: a presence heartbeat, your explicit rr cloud-maintainer traffic, and an unauthenticated version check. The general local-telemetry module never talks to the network at all — it writes one file on disk.
Scoped, not sloganed — the exact field list, the exact endpoint, and the exact kill switch for each:
bin/lib/telemetry.py writes only to a local NDJSON file at .heimdall/telemetry/events.ndjson. There is no network call in the module at all. Off: HEIMDALL_TELEMETRY=off.bin/heimdall-telemetry-corpus is, in its own header comment, "the local send-queue" — nothing sends anywhere from it yet. Off: hmd telemetry off; hmd telemetry purge deletes the local spool.heimdall-presence beat signs and POSTs {project, handle, verdict, file, activity_ts, nonce, ts} to the control plane, with your haid and your team secret riding as headers on every call — never file contents, never code. file is the repo-relative path of the file you last touched (e.g. src/auth/login.py), not a bare filename — it reveals tree structure, so if that matters, turn it off. Off: heimdall-presence off (this repo) or off --global (every repo); --no-files sends file:null.rr — only when you explicitly run itrr connect posts your Claude credential write-only (never read back or logged) and your GitHub App installation_id. rr "<task>" signs and posts the literal task text you typed — that's the one path where real content leaves the machine, because it's the job you asked the cloud maintainer to do.HEIMDALL_NO_AUTOUPDATE=1 or ~/.heimdall/no-autoupdate.Skip it for solo, throwaway scripts you'll run once and delete — the gate ceremony of secret-scan, falsify, and corpus regression is real overhead with no payoff on code nobody else will ever run. Skip it too if your team is entirely on Cursor, Codex, or Gemini today and wants the full gate suite, not just the shared coordination ledger — that cross-tool gate parity is roadmapped, not shipped yet.
A one-off script or a notebook you'll never re-run or share. The falsify/corpus/secret-scan ceremony buys correctness insurance nobody will collect on.
Per the question above, only the MCP coordination ledger crosses tools right now. The verification gate suite is Claude Code hook-based — "hmd everywhere" is roadmap, not shipped.
rr's cloud maintainer is BYOC by construction — every team brings its own Claude subscription and its own GitHub App install. There is no shared-key model to opt into.
The gates run as git hooks and Claude Code tool hooks on a checkout that persists between commands. A fully ephemeral, hookless CI-only path with no local push doesn't get the native pre-push chokepoint.
The isolation oracle, the 29-bug bring-up ladder, and the first autonomous PR — all with the receipts, not the claim.