git

A secret-scanning hook that separates findings from errors, non-blocking CI scanners, and a weekly ZAP baseline that skips gracefully.

TL;DR: gitleaks uses exit code 1 for both real leaks and scan errors, so naive hooks block commits over environment failures and get disabled. The fix: block only when exit 1 comes with a valid JSON report containing findings, warn otherwise. CI and weekly ZAP scans collect findings as reports instead of failing builds.

A hook that refuses direct commits is half a gate; a wrapper promised since Task 1 but never implemented turns security into a total lock.

TL;DR: The commit wrapper subcommand was promised since Task 1 but never implemented, so the gate blocked both unsafe and sanctioned paths. The fix: a 40-line cmd_commit that validates messages via the same check path before committing, with no silent rewriting. Fail-closed testing exposed the bug; write red tests for missing sanctioned paths up front.

A PreToolUse hook makes bare git commit from coding-agent sessions technically impossible, not merely forbidden in a document.

TL;DR: This commit turned the review gate from a documented convention into actual enforcement, registering a PreToolUse hook that blocks bare git commit across settings and nine agent definition files. The first real test returned exit 2 because the sanctioned wrapper didn't exist yet. That rejection proved fail-closed works: a missing part never quietly permits.

An audit report accused eight documentation commits of missing trailers; all eight were false positives. One filter line aligned the auditor with the gate.

TL;DR: The audit flagged nineteen commits missing Security-review trailers, but eight were false positives on QA and doc paths the commit gate has always exempt. Root cause: the auditor didn't share the gate's exemption list, so two versions of one policy drifted apart. Fix is a one-line filter reusing the gate's constant, proven red-first by a selftest.

The commit gate refuses a trailer-less message in seconds, but the configuration behind it drifts silently. A read-only sweep closes that gap.

TL;DR: The commit gate enforces a Security-review trailer but can silently vanish through a lost executable bit or a moved hooksPath. A read-only audit subcommand in review_gate.sh sweeps commits, warnings, slice-gate results, and registration, always exiting 0. The gate prevents, the audit detects; together they keep the invariant honest.

The board says Done, the commit index lacks the hash, and nothing protests. The fix removes the hand-copying.

TL;DR: The index was hand-maintained and drifted silently from reality, so Done cards referenced hashes it lacked. Fix: regenerate it mechanically from git log, lint that every Done card's hash exists in the index, and fail loudly on mismatches. Done is now a verified state rather than a trusted claim.

A commit-hook script keeps two tiers of law: broken test-marker claims block the commit, while risky surfaces like auth paths or destructive migrations only earn a logged warning.

TL;DR: The commit script has two tiers: a test marker like "characterization" hard-blocks the commit unless an exact comment line is present, while risky surfaces such as auth code, destructive migrations, or dangerouslySetInnerHTML only log a warning. Hard-blocking everything would kill velocity, and hooks can be bypassed with --no-verify. The goal is raising the cost of carelessness, not building a wall.

A bash gate turns free-text Security-review claims into three machine-tested invariants on the commit-msg hook.

TL;DR: Review claims in commit messages are usually free text nobody checks, so one repo added a bash commit-msg gate turning them into machine-tested invariants. The script enforces exactly one Security-review: trailer, a fixed position above Co-Authored-By, and substance, matching "tests only" claims against a whitelist of changed paths. It's bypassable with --no-verify, but it cheaply catches honest mistakes.

Adopting the superpowers framework turns a branching naming convention into a real isolation requirement. One worktree per task, enforced by the workflow itself.

TL;DR: The superpowers framework chains coding agents through mandatory stages—brainstorming, git worktrees, planning, TDD, code review—enforced by skills. Worktrees give each task an isolated directory and branch, making the one-branch-per-task rule functional rather than ritual. The overhead pays off only in long autonomous runs; disable telemetry if your data policies are strict.