[kyle-sexton]

No related issue: rolls out the guardrails lefthook remote (melodic-software/claude-code-plugins#9504)

Summary

The guardrails git hooks now run from one lefthook remotes: entry tracking melodic-software/claude-code-plugins main (refetched daily) instead of copies vendored under .githooks/guardrails/ by #852. Every clone gets the same hooks from committed config, with nothing per machine and no copies to drift.

Fix

• lefthook.yml: add the remotes: entry; drop the three guardrails-<entry> jobs and the .githooks/guardrails/** pre-commit exclude.
• Delete .githooks/guardrails/ (16 files).
• pr-require-checks.yml: drop the .githooks/guardrails ShellCheck and machine-path excludes.
• components/commit-convention/commit-convention.test.sh: fetch the guardrails plugin from claude-code-plugins main (sparse, depth 1) for the resolver and commit-msg hook, the same ref consumers run. The suite already needed network for the check-contract action.

Verification

• install.mjs verify: ok for commit-msg-convention, pre-commit-content, reference-verify; plan --scope remote returns no decisions.
• This commit ran guardrails-remote-pre-commit-content and guardrails-remote-commit-msg-convention from the fetched remote; both passed.
• bash harness/shell/run-tests.sh components/commit-convention/commit-convention.test.sh: 1 passed.

Related

• feat(guardrails): serve the git hooks to lefthook repositories as a remote claude-code-plugins#9504 (remote mode)
• guardrails: shared install-git-hooks copies fail consumer CI (mode 100644, linted vendored scripts) claude-code-plugins#9426 (comment) (owner decision: ref: main)
• chore(git-hooks): install the guardrails git hooks as shared lefthook jobs #852 (the copies this removes)

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-24T04:03:00.345819Z	—	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-review reviewed b2c0a47a676c17d1fa1d99440e67e5a0b587c9ee: 0 finding(s), 0 as inline comments.

No findings on PR #865 at b2c0a47.

I read the three non-deletion diffs (lefthook.yml, pr-require-checks.yml, commit-convention.test.sh). I did not read the 16 deleted .githooks/guardrails/ files line by line. I only searched for references to them, and none remain in the repo.

• Dangling references: a repo-wide search for githooks found nothing outside .git and the lane files. The ShellCheck and machine-path excludes dropped from pr-require-checks.yml therefore point at nothing that still exists.
• lefthook.yml: the remotes: entry replaces the three removed guardrails-* jobs, and the .githooks/guardrails/** pre-commit exclude goes with them. The PR body says the pre-commit-content, commit-msg-convention and reference-verify hooks all come from the remote. I did not run install.mjs verify or lefthook, so that is author-claimed and unverified.
• commit-convention.test.sh: TEST_TMPDIR is defined and cleaned up by a trap before the new clone block uses it. A failed clone calls fail and then exits, so the suite cannot pass without the fetch. I did not run the suite, because the sandbox restricts network access. I also did not check the new plugins/guardrails/hooks/ and git-hooks/ paths against upstream.
• Unpinned main: the test and the lefthook remote now track claude-code-plugins main, so an upstream path or behavior change can break this repo's CI. The PR body records the owner decision for ref: main, so I did not report it.
• Hold classes: no cost or trust-gate change. The diff touches no CODEOWNERS, .gitmodules or trusted-actors files, and adds no model call or paid runner.
• PR contract: the body has the No related issue: line and all four sections.
• Closing issues and manifests: the PR closes no issue, and it changes no plugin manifest.

[github-actions]

claude-security-review reviewed b2c0a47a676c17d1fa1d99440e67e5a0b587c9ee: 0 finding(s), 0 as inline comments.

Security review: PR #865 at b2c0a47

critical-findings: 0

No security findings. I reviewed all 19 changed files by reading the diff with gh pr diff. The wrapper named no diff or PR context file.

What the PR changes. It deletes the 16 vendored .githooks/guardrails/* scripts and replaces them with a lefthook remotes: entry. The entry tracks melodic-software/claude-code-plugins main and refetches every 24h. It also drops the matching ShellCheck and machine-path excludes in pr-require-checks.yml. commit-convention.test.sh now clones the guardrails plugin at main.

Instruction-surface deletions. The deleted scripts are git-hook guards: secret patterns, machine paths, commit-message convention, reference verification and the abort boundary. I checked each against what still enforces it.

• lefthook.yml still runs the same guards (pre-commit-content, commit-msg-convention, reference-verify) from the remote. The PR body says install.mjs verify passed.
• CI still backstops secrets and paths. pr-require-checks.yml runs the gitleaks and check-machine-paths steps, and the pr-contract step still checks PR titles.
• The protected-class list (docs/conventions/instruction-exception-register/README.md) is absent from this checkout, so I judged by consequence and did not consult it.

Considered and not reported.

• Mutable ref main. Hooks now run from an unpinned branch of another org-owned repo, so a compromise of claude-code-plugins main would reach every clone at its next refetch. This is a supply-chain pin-loosening concern, which belongs to zizmor's lane. It is also a stated owner decision, linked in the PR body, and the PR has no concrete exploit path of its own.
• Network fetch in the test. The sparse clone in commit-convention.test.sh fails closed (exit 1). It runs under pr-require-checks.yml, which is not a pull_request_target workflow, and I saw no secrets in the clone path.
• Fail-open if the remote is unreachable. Hooks may not run on a clone whose first fetch fails, where the vendored copies always ran. I treated this as a local-hook availability tradeoff and not a vulnerability. CI covers the same checks.

No plugin manifests (plugin.json, marketplace.json) are in the diff, so there are no manifest <field> lines. The PR touches no trust-gate paths, so no hold applies.