ward container: agent commits bypass pre-commit hooks (fresh clone has none installed) #133

New issue

Closed

opened 2026-06-18 01:46:48 +00:00 by coilysiren · 0 comments

coilysiren commented

2026-06-18 01:46:48 +00:00

Owner

Problem

Autonomous container commits bypass the repo's local pre-commit hooks. A ward agent run fresh-clones the target inside the container but never runs pre-commit install, so .git/hooks/pre-commit is absent and git commit (incl. ward git commit) skips the catalog suite.

Surfaced when the ward#119 autonomous run landed cmd/ward/git_test.go with a 3-line comment block that violates the code-comments cap (max 2). It merged to main clean from inside the container; the violation only tripped a later local commit on the host (the tree-walking hook flagged it). CI / a human commit would have caught it up front.

Impact

Agent work can land lint / comment-cap / doc-layout / trufflehog violations on main that the pre-commit suite exists to prevent. The reaper + tests pass, so nothing flags it until the next host-side commit or a CI run.

Fix options

Entrypoint runs pre-commit install (and maybe pre-commit install --hook-type commit-msg) right after the clone, so the agent's commits run the same gate as a human's. Cheapest, closest to parity.
Or the agent doctrine (AGENTS.container.md) instructs running pre-commit run --all-files before committing.
Consider failing the reaper / flagging if the pushed tip doesn't pass pre-commit run --all-files.

Prefer the entrypoint pre-commit install - it makes the container match the host gate without relying on the agent remembering.

## Problem Autonomous container commits **bypass the repo's local pre-commit hooks**. A `ward agent` run fresh-clones the target inside the container but never runs `pre-commit install`, so `.git/hooks/pre-commit` is absent and `git commit` (incl. `ward git commit`) skips the catalog suite. Surfaced when the ward#119 autonomous run landed `cmd/ward/git_test.go` with a 3-line comment block that violates the `code-comments` cap (max 2). It merged to main clean from inside the container; the violation only tripped a *later* local commit on the host (the tree-walking hook flagged it). CI / a human commit would have caught it up front. ## Impact Agent work can land lint / comment-cap / doc-layout / trufflehog violations on `main` that the pre-commit suite exists to prevent. The reaper + tests pass, so nothing flags it until the next host-side commit or a CI run. ## Fix options - Entrypoint runs `pre-commit install` (and maybe `pre-commit install --hook-type commit-msg`) right after the clone, so the agent's commits run the same gate as a human's. Cheapest, closest to parity. - Or the agent doctrine (AGENTS.container.md) instructs running `pre-commit run --all-files` before committing. - Consider failing the reaper / flagging if the pushed tip doesn't pass `pre-commit run --all-files`. Prefer the entrypoint `pre-commit install` - it makes the container match the host gate without relying on the agent remembering.

coilysiren referenced this issue from a commit

2026-06-18 02:05:38 +00:00

feat(container): install pre-commit hooks after fresh clone

coilysiren closed this issue

2026-06-18 02:05:38 +00:00

coilysiren referenced this issue from a commit

2026-06-18 02:05:38 +00:00

Merge issue-133: container installs pre-commit hooks after clone (closes #133)