CCARF Practice Question
Correct answer: B
A: PostToolUse checks after the tool executes but still only at that single point in time. If the Dockerfile is added in a later commit by a different subagent, PostToolUse on create_service will still miss it.
B: Compliance checks should be enforced at the boundary where the precondition must hold — in this case, before deployment or merge. Checking at service creation time is too early when the workflow allows Dockerfiles to be added in subsequent steps. Moving the gate to the deployment or merge boundary ensures all required artefacts are present regardless of which subagent adds them.
C: Running a Dockerfile check on every file write is wasteful and creates unnecessary overhead. The check should happen once at the right boundary (deployment or merge), not continuously during development.
D: Adding a timeout introduces non-deterministic behaviour and race conditions. The correct fix is to move the enforcement gate to the right point in the workflow, not to add polling delays.