From d377b5f30c07ff1b95c87fc7510b1ccb3e87f9b1 Mon Sep 17 00:00:00 2001 From: codex Date: Sun, 11 Oct 2026 21:31:50 +0200 Subject: [PATCH] Install generated-commit guard safely and record verified checkpoint --- Makefile | 9 ++++++++- WORK-RECORDS.md | 4 ++-- workplans/CUST-WP-0079-deterministic-security-flow.md | 8 ++++++++ 3 files changed, 18 insertions(+), 3 deletions(-) diff --git a/Makefile b/Makefile index e402a571..028be7f0 100644 --- a/Makefile +++ b/Makefile @@ -1,6 +1,6 @@ # the-custodian top-level Makefile -.PHONY: security-flow-daily security-flow-check generated-commit-check +.PHONY: security-flow-daily security-flow-check generated-commit-check generated-commit-hook security-flow-daily: ## Sync resolved decisions and notify changed actionable work python3 scripts/security_flow_daily.py --apply @@ -9,6 +9,13 @@ security-flow-check: ## Run the deterministic security flow and generated commit generated-commit-check: ## Reject staged generated-only changes python3 scripts/check_generated_only_commit.py --staged + +generated-commit-hook: ## Install the local guard without replacing another hook + @hook="$$(git rev-parse --git-path hooks/pre-commit)"; \ + if test -e "$$hook" && ! cmp -s scripts/generated-pre-commit.sh "$$hook"; then \ + echo "Existing pre-commit hook differs; integrate the guard before replacing it." >&2; exit 1; \ + fi; \ + install -m 755 scripts/generated-pre-commit.sh "$$hook" # # Custodian agent SSH identity # ---------------------------- diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index b477b129..2a260a03 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -498,11 +498,11 @@ | task | CUST-WP-0078-T04 | done | — | workplans/CUST-WP-0078-security-collaboration-consolidation.md | | task | CUST-WP-0079-T01 | done | — | workplans/CUST-WP-0079-deterministic-security-flow.md | | task | CUST-WP-0079-T02 | done | — | workplans/CUST-WP-0079-deterministic-security-flow.md | -| task | CUST-WP-0079-T03 | progress | — | workplans/CUST-WP-0079-deterministic-security-flow.md | +| task | CUST-WP-0079-T03 | wait | — | workplans/CUST-WP-0079-deterministic-security-flow.md | | task | CUST-WP-0079-T04 | wait | — | workplans/CUST-WP-0079-deterministic-security-flow.md | | task | CUST-WP-0079-T05 | progress | — | workplans/CUST-WP-0079-deterministic-security-flow.md | | task | CUST-WP-0079-T06 | wait | — | workplans/CUST-WP-0079-deterministic-security-flow.md | -| task | CUST-WP-0079-T07 | todo | — | workplans/CUST-WP-0079-deterministic-security-flow.md | +| task | CUST-WP-0079-T07 | done | — | workplans/CUST-WP-0079-deterministic-security-flow.md | | task | THE-WP-0001-T01 | done | — | workplans/THE-WP-0001-federation-interface.md | | task | THE-WP-0001-T02 | done | — | workplans/THE-WP-0001-federation-interface.md | | intake | CUST-IN-0001 | closed | green | intake-legacy-suggestions-migration.md | diff --git a/workplans/CUST-WP-0079-deterministic-security-flow.md b/workplans/CUST-WP-0079-deterministic-security-flow.md index 79466615..dd326f40 100644 --- a/workplans/CUST-WP-0079-deterministic-security-flow.md +++ b/workplans/CUST-WP-0079-deterministic-security-flow.md @@ -118,6 +118,14 @@ generated-only commit. `make generated-commit-check` provides the local hook ent The CI suite covers the rejection using a real temporary git repository. Consumer generator adoption and the required week of clean logs remain open; this task is not claimed complete. +The local guard is installed; `make generated-commit-hook` reproduces that +installation and refuses to replace a different hook. The consistency CLI has +no no-commit/no-push mode: its first invocation unexpectedly published brief-only +`ebaa38b`, retained as a failed acceptance observation. Its subsequent invocation +committed the already reviewed, staged implementation as `6fe7201`; that commit +includes source code. Future generated-only commits are rejected locally and in +CI. The full Custodian suite passes 77 tests. + ## Attended window #1 ```task