docs(git-hooks): reframe away from the secret-gate narrative Pre-existing working-tree change, not authored this session: drops the two-gates framing, host setup, and traps sections, leaving the generic hook-resolution guide. _Sidebar.md link text updated to match. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
docs(git-hooks): ship hook logic, not wiring — pre-commit is one option, not a requirement The guide now states the policy (a recipe ships a SCRIPT; wiring is the user's choice; harness hooks cover the agent) and gives three wirings for the same two scripts: a plain git-hook shim, a pre-commit repo: local entry, or lefthook/husky. Also: the 'tracked file' hazard generalized — a hook pointing at a tracked script or config breaks every commit on a branch that predates it, whether that is a bare exec ("not found") or pre-commit ("No .pre-commit-config.yaml file was found"). Same cure both ways: no-op when the target is absent.
docs: add git hooks guide; pulumi guide; init contract env; persist $HOME note guides/git-hooks.md (new) — how git resolves hooks and why tools collide there: - core.hooksPath (local OR global) makes .git/hooks be IGNORED, not merged - worktrees share ONE hooks dir ($(git rev-parse --git-common-dir)/hooks) - pre-commit refuses to install while core.hooksPath is set, and `bd init` sets a local one - --allow-missing-config is required: the hooks dir is shared across worktrees but .pre-commit-config.yaml is a tracked file, so a branch predating it fails EVERY commit - the traps that make a secret gate worse than useless: `id: gitleaks-system` fails OPEN (no pass_filenames: false -> the filename is eaten as the repo-path arg -> "Passed" on a live token); a staged-only scan cannot see --no-verify/rebase history; a stage-less hook "Passes" over 0 bytes at push; conflating a leak with a broken scanner trains you to ignore it - the two gates: git hooks stop YOU (bypassable with --no-verify); the harness PreToolUse deny stops the AGENT (not a git hook, so --no-verify cannot reach it) Also landing work that was sitting uncommitted in the wiki: - guides/pulumi.md — forwarding the host Pulumi login into the pod - guides/container-filesystem.md — path-preserving mounts are not $HOME-relative; use $HOST_HOME - guides/recipe-authoring.md — the init.run contract env table - _Sidebar.md — link both new guides