diff --git a/prompts/REPO_POLICIES.md b/prompts/REPO_POLICIES.md
index 9aba6b0..00fafff 100644
--- a/prompts/REPO_POLICIES.md
+++ b/prompts/REPO_POLICIES.md
@@ -1,6 +1,6 @@
 ---
 title: Repository Policies
-last_modified: 2026-08-07
+last_modified: 2026-08-20
 ---
 
 This document covers repository structure, tooling, and workflow standards. Code
@@ -69,8 +69,15 @@ style conventions are in separate documents:
   outputs the project's name. Scripts that need the name call
   `script/projectname` — e.g. `script/docker` assembles its image tag from it —
   so those scripts stay byte-identical across all repos. Repo-type-specific
-  pre-commit extras (e.g. `go mod tidy` verification in Go repos) belong in
-  `script/precommit`, not in the hook itself. Model scripts are at
+  verifications (e.g. `go mod tidy` verification in Go repos) belong in
+  `script/check`, which is the gate the other entrypoints funnel through: it
+  runs in the Dockerfile build step and therefore in CI, and `script/precommit`
+  inherits it by calling `script/check`. In `script/precommit` alone such a
+  check binds only the contributors who installed the hook, and the hook file
+  itself stays a shim that carries no checks of its own. Anything added to
+  `script/check` must be read-only, since `make check` must not modify files, so
+  use a verify or diff mode (`go mod tidy -diff`) rather than a command that
+  rewrites the tree. Model scripts are at
   `https://git.eeqj.de/sneak/prompts/raw/branch/main/script/<name>`. The README
   must document the provided scripts in an **Entrypoints** section (see the
   README requirements below).