One small invariant, with escape hatches where real repositories need them.

locguard works without configuration. These guides cover the full-tree CI check, optional repository policy, exact legacy exemptions, explicit scopes, and the threshold-scanning performance model.