adoption: qualify pinned Git hook scanner on 2604

[seathatflowsinourveins]

Scope

Prepare the approved Phase 1 Git hook recipe and qualify Gitleaks 8.30.1 through mise's aqua backend in an isolated installation and a real scratch clone. Preserve the tracked hook, rules and production guard. Read named systemd properties in the guard test instead of assuming output order.

The review repair corrects the scanner's two currency deadlines and copies the verified native binary into the guard's target, so pruning the mise installation cannot break commits. It also verifies scanner prerequisites before enabling hooks in all linked worktrees.

• Base commit: ecfa112764c664d35377dd66b8cfcb67e5a94d60
• Lane: lane:foundation
• Owned paths: adoption/git-hook-acceptance.md, the dated decision, evidence/artifacts/p1-git-hook-20261006/, its receipt, tests/test_adoption_guarded_runners.py, and the evidence registry last.
• A21 assigns the central installer bundle to P1-CLI. This PR supplies its bounded prerequisite and leaves that bundle to its owner.

SOTA sources

• Gitleaks v8.30.1, gitleaks/gitleaks@83d9cd684c87d95d656c1458ef04895a7f1cbd8e:config/config.go:19-20,config/gitleaks.toml,cmd/root.go:76.
• Betterleaks v1.9.0, betterleaks/betterleaks@81aff7a638638aae3a659845d089043e1d8fe9ac:config/config.go:22-23,config/betterleaks.toml,cmd/root.go:82. Findings default to exit 1 in both, but 222 versus 463 embedded rules and different configuration bytes fail the required equivalence condition.
• mise aqua, pinned backend, isolated directories, and pruning semantics, mise 2026.10.1.
• Gitleaks master commit, dated 2026-07-22. The separate 90-day commit deadline is 2026-10-20. The release API dates v8.30.1 to 2026-03-21; its 180-day release line lapsed on 2026-09-17. These native GETs correct this PR's original mistaken comparison; no current-release claim is made.
• systemd v259.5 property iteration/filter and named output.
• Git hooks and git-config, read 2026-10-06. Git aborts commits for any nonzero pre-commit result; a positive native findings line distinguishes detection.
• native-agent-stack@ecfa112764c664d35377dd66b8cfcb67e5a94d60:scripts/git-hooks/pre-commit:7-12,adoption/tools/gitleaks-guarded:5,adoption/tools/ecosystem-bounded-run:133,docs/secret-storage.md:353,tests/test_pre_commit_gate.py:58,docs/decisions/2026-10-04-repository-quality-rule.md:19.

Evidence-class table

Claim	Evidence class	Command / receipt
Scanner defaults differ; native backend and pruning behavior are supported	source_review	Pinned native GETs in evidence/receipts/p1-git-hook-acceptance-20261006.json
Isolated installation and guarded scratch-clone clean/finding commits executed	local_integration	Original install 0, clean 0, finding 1, unchanged HEAD and redacted output
One generated inert AWS-shaped value was rejected	synthetic	Existing fixture; actual value omitted
Native named-property containment test	local_integration	Original 33 cases passed with one Shellcheck-unavailable skip
Copied layout survives absence of its mise source	local_integration	Review repair check retained separately in the receipt
Unchanged upstream tests and host application	not_run	Co-op owns host application; local checks are not upstream acceptance
Hosted checks	observed separately	Prior review identified unrelated time-of-day validate flake and OSV advisories covered by #765

Local commands run

These are actual native integration checks; prior results remain distinct from review-repair checks.

# Original isolated acceptance, six task-private mise directories.
nice -n 19 mise install --jobs=1 aqua:gitleaks/gitleaks@8.30.1 # exit 0
mise where aqua:gitleaks/gitleaks@8.30.1 # exit 0
mise exec aqua:gitleaks/gitleaks@8.30.1 -- gitleaks version # exit 0; 8.30.1
# Guarded scratch-clone commits: clean 0; generated finding 1;
# positive native findings line, unchanged HEAD, generated value absent.
nice -n 19 python3 -m unittest tests.test_pre_commit_gate tests.test_gitleaks_config # exit 0; 40 tests
nice -n 19 python3 -m unittest tests.test_adoption_guarded_runners # exit 0; 33 tests, one skip
nice -n 19 python3 -m unittest tests.test_pre_push_gate # exit 0; 16 tests
nice -n 19 python3 scripts/validate.py # original exit 0; 10277 hashed files
nice -n 19 python3 scripts/component_matrix.py --check # exit 0
nice -n 19 python3 scripts/new_host_grand_list.py --check # exit 0
git diff --check # exit 0

Review repair: the supported task-private mise install passed; the copied binary's SHA matched and the guarded scanner stayed usable after moving away its original task-private mise source. A real scratch-clone clean commit passed and the generated-value commit failed with a positive findings count, unchanged HEAD and redacted output. The three focused modules ran 73 tests in 101.446s, exit 0 with one existing Shellcheck-unavailable skip. Final python3 scripts/validate.py passed with 69 components, four profiles, 212 receipts and 10277 hashed files; git diff --check passed. No destructive prune operation, host application or additional full-suite claim is made.

Host apply, read-back and rollback

The co-op applies the exact recipe in adoption/git-hook-acceptance.md. First create a fresh checkpoint under the native stack's XDG state directory, save only the safe hooksPath key and three public tool paths, and export its external TMPDIR.

repo="$HOME/code/native-agent-stack"
eco="${ECO_INSTALL_ROOT:-$HOME/.local/share/codex-ecosystem}"
nice -n 19 mise install --jobs=1 aqua:gitleaks/gitleaks@8.30.1
native_dir="$(mise where aqua:gitleaks/gitleaks@8.30.1)"
install -D -m 0755 "$repo/adoption/tools/gitleaks-guarded" "$eco/bin/gitleaks"
install -D -m 0755 "$repo/adoption/tools/ecosystem-bounded-run" "$eco/bin/ecosystem-bounded-run"
mkdir -p "$eco/tools/gitleaks-8.30.1"
install -m 0755 "$native_dir/gitleaks" "$eco/tools/gitleaks-8.30.1/gitleaks"
test "$(sha256sum "$eco/tools/gitleaks-8.30.1/gitleaks" | cut -d ' ' -f 1)" = 88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509
test "$(command -v gitleaks)" = "$eco/bin/gitleaks"
test "$(gitleaks version)" = 8.30.1
command -v zizmor
git -C "$repo" config --local core.hooksPath scripts/git-hooks
test "$(git -C "$repo" config --local --get core.hooksPath)" = scripts/git-hooks

The setting covers all linked worktrees. Each client must inherit the guarded PATH; the existing pre-push gate also needs Zizmor and external TMPDIR. The recipe's real scratch clone must pass a clean commit and reject the generated value with a positive leaks found: N line, unchanged HEAD and redaction. Git returns 1 for any hook failure: refusal 78 and contention 75 remain unfinished acceptance. Retry contention after the holder finishes.

Applied change	Rollback from fresh checkpoint
hooksPath	Restore the saved safe value; if absent originally, unset and tolerate only native missing-key exit 5
Guard, runner and copied native binary	Restore each saved public file/link; remove only a newly introduced path
mise installation	Uninstall this exact version only if absent before apply

The existing vendor-archive layout is cross-referenced in the recipe. A reciprocal edit to the separate secret-storage guide is deferred to that document's consolidation owner.

Failed attempts

The original 73-case run failed because positional systemctl parsing read running as TasksCurrent. The named-property correction and subsequent passes remain distinct. Other retained preparation failures: source classifier KeyError, registry CLI help exit 2, and initial clone without nice 19. This review repair also corrected nonexistent guessed README/test/mise paths before execution. No failed condition is promoted into upstream acceptance.

Decision record

docs/decisions/2026-10-06-git-hook-scanner-pin.md records the source comparison, corrected currency dates, pruning remedy and Betterleaks qualification trigger before 2026-10-20.

Host evidence

No host-receipt or platform-status change. The co-op owns native host application and read-back. Request command-center micro-check of the new exact head; keep this PR a draft.

Checklist

• Hook, rules and production guard are unchanged; native source references supplied.
• No workflow changes; pin/permissions items are not applicable.
• No credentials printed, read or committed; generated value is private scratch only.
• No paid hosting or billing surface.
• Peer-owned paths and central bundle preserved.
• Evidence registry committed last.

[seathatflowsinourveins]

Closed with a record by the PR triage of 2026-10-07 (the command center's ruling). Not merged; the branch codex/ns2604-p1-git-20261006 stays on origin at 206cb8c.

Folded into #733 at beee52d. Of this PR's 7 changed files, 6 are byte-identical there and 1 is merged; none is lost. Registry: 6 entries added or changed by this PR are all present there, 0 of them re-registered to the merged file's hash.

Reopen trigger: none while #733 carries the content. Reopen with gh pr reopen 767.