[denniyahh]

The repo's pre-commit hook relied on each developer's global hook for a secret scan, so a fresh clone, or a machine without that hook, committed unscanned. The hook now runs gitleaks git --pre-commit --staged --redact itself. It refuses the commit when gitleaks reports a finding or is not installed. A missing scanner fails; it is never skipped.

• tests/pre_commit_secret_scan.rs commits in a scratch repo through the real hook, using a stand-in gitleaks and with global git config nulled. A finding refuses the commit; a clean scan commits and scans only the staged diff; a missing gitleaks refuses. All three fail against the previous hook.
• CONTRIBUTING.md lists gitleaks as a prerequisite of core.hooksPath.

Server-side push protection stays the backstop for --no-verify.

🤖 Generated with Claude Code

https://claude.ai/code/session_01RGzZZbfn3r9638yptqPL47

[graphify-labs]

Graphify reviewed this change.

Code graph out of date: Health delta baseline: last indexed commit 71a5192 (diverged from this PR's base — delta is approximate). Health delta baseline was built by an older engine whose node ids do not match this review's — delta is approximate. Impact and hotspot numbers below may be wrong.

Worth a look — the grounded gate found no coupling regressions or blocking issues, but 1 advisory finding(s) below merit a look before merge.

Not checked: tests were not run; no formal proof of the changed code.

---

Graphify review — findings

Adds a mandatory gitleaks scan to the pre-commit hook that runs gitleaks git --pre-commit --staged --redact on every commit, so clones without a global scanner no longer commit unscanned. A missing gitleaks refuses the commit rather than skipping the scan, and any non-zero exit from it, including an old build lacking the git subcommand, is reported as a finding with a pointer to .gitleaksignore for false positives. Adds behavioural tests in pre_commit_secret_scan.rs that commit in scratch repos against a stand-in gitleaks, covering finding, clean, and not-installed. The not-installed case assumes no real gitleaks sits in /usr/bin or /bin, which conflicts with the install requirement CONTRIBUTING.md now documents.

Worth a look

• Missing-gitleaks test fails on machines where gitleaks is installed system-wide, as the docs now require — crates/devflow-cli/tests/pre_commit_secret_scan.rs:158 · Escalate · medium
  • NOT verified (no proof, no reproducing execution) — needs human review

Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 43 functions depend on the 43 functions this change touches.

Health — grade A; no new coupling hotspots.

Verification — 43 functions in the blast radius were not formally verified this run (proofs are advisory here).

Health delta baseline: last indexed commit 71a5192 (diverged from this PR's base — delta is approximate).

Health delta baseline was built by an older engine whose node ids do not match this review's — delta is approximate.

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

• verification_scope: 43 function(s) in the blast radius were not formally verified this run

Risky patterns (advisory)

• medium no-stderr-to-stdout in scripts/hooks/pre-commit:169: stderr redirected to stdout: if ! command -v gitleaks >/dev/null 2>&1; then

Docs that may be stale (advisory)

• ARCHITECTURE.md § Worktree model (lines 297-316): references changed symbols git
• ARCHITECTURE.md § Git and ship model (lines 317-351): references changed symbols git
• ARCHITECTURE.md § Instrumentation (lines 391-413): references changed symbols git
• CHANGELOG.md § What's new (lines 114-129): references changed symbols git
• CHANGELOG.md § 2.5.0 — 2026-08-15 (lines 207-222): references changed symbols git
• CHANGELOG.md § Fixed (lines 272-292): references changed symbols git
• CHANGELOG.md § Changed — breaking (lines 305-333): references changed symbols git
• CHANGELOG.md § Removed — breaking (lines 334-343): references changed symbols git
• CHANGELOG.md § Known Issues (lines 381-400): references changed symbols git
• CHANGELOG.md § Fixed (lines 533-539): references changed symbols git

…and 10 more.