[yshyn-iohk]

Summary

Add repository-scoped local Git hooks that reject invalid contribution evidence before publication. Normal commits require OpenPGP signing configuration, commit messages must satisfy the Conventional Commit and exact DCO contract, and outgoing issue-branch ranges are cryptographically verified before Git transfers objects.

Scope and context

This issue-backed contribution-hooks PR is rebuilt as one signed commit on the current integration branch after its dependency PRs merged. The exact current head is 13909ea39b623b0f2bc08c3d63cc03949fdcc3ef. The hooks are installed as a complete version-checked bundle in Git-common private state; all linked worktrees share the stable bundle without loading scripts from another active worktree.

Acceptance criteria

• AC-1: Provide tracked dependency-light pre-commit, commit-msg, and pre-push dispatchers.
• AC-2: Add one explicit bootstrap command for Git-common installation and repository-local signing defaults.
• AC-3: Fail pre-commit when signing is disabled, the format is not OpenPGP, or identity/key selection is absent.
• AC-4: Reject invalid Conventional Commit subjects and missing/mismatched exact DCO trailers before commit creation.
• AC-5: Validate the complete outgoing issue-branch range and run local OpenPGP cryptographic verification before transfer.
• AC-6: Bound push parsing, support new/updated branches and HEAD, ignore deletions, and fail closed without an integration base.
• AC-7: Work from primary and linked worktrees without depending on a disposable worktree path.
• AC-8: Never edit global Git configuration, identity, keys, credentials, or GitHub state.
• AC-9: Test accepted/rejected messages, signing policy, installation, stable bundles, range planning, and unsigned commits.
• AC-10: Document setup, legal sign-off intent, bypass limitations, and continuing hosted authority.

Definition of done

• DoD-1: ./bootstrap.sh --configure-git installs a private stable bundle and refuses another hook manager.
• DoD-2: git commit -s is signed by the repository-local default and fails on invalid message/DCO evidence.
• DoD-3: A simulated pre-push of the exact final stack passes local cryptographic verification without contacting origin.
• DoD-4: An unsigned fixture and malformed message are rejected in repository tests.
• DoD-5: ./bootstrap.sh --check validates both Pi and local hooks.
• DoD-6: Hosted checks pass on this exact PR head.

Non-goals

• NG-1: Treat hooks as a security boundary or remove trusted GitHub checks.
• NG-2: Add the legal DCO attestation automatically.
• NG-3: Import, generate, or distribute OpenPGP keys.
• NG-4: Modify global Git configuration.
• NG-5: Validate GitHub PR metadata or account/key association locally.
• NG-6: Push tags, protected branches, or cross-named refs through the development hook path.

AC/DoD/non-goals matrix

Acceptance criterion	Definition of done	Explicit non-goal
AC-1	DoD-1	NG-1
AC-2	DoD-1, DoD-5	NG-3, NG-4
AC-3	DoD-2, DoD-4	NG-3
AC-4	DoD-2, DoD-4	NG-2
AC-5	DoD-3, DoD-4	NG-1, NG-5
AC-6	DoD-3, DoD-4	NG-6
AC-7	DoD-1, DoD-5	NG-4
AC-8	DoD-1	NG-3, NG-4
AC-9	DoD-4, DoD-5	NG-1
AC-10	DoD-5	NG-1, NG-2

Validation commands

• node --test tests/repository/local-git-hooks-contract.test.mjs — passed.
• node --test tests/repository/contribution-policy-contract.test.mjs — passed.
• ./run.sh repository --strict — passed.
• ./bootstrap.sh --check — Pi and hook installation passed.
• node scripts/dev-loops.mjs gates — passed.
• Local pre-push validation against origin/integration..HEAD — passed for the one signed commit during publication.
• ./scripts/check-dco.sh origin/integration HEAD — passed for the one-commit exact range.

Security and privacy

The installer writes only repository-local Git config and private Git-common hook state. It refuses a foreign core.hooksPath; it never reads or generates signing keys. The installed policy bundle is content-checked to avoid cross-worktree drift. Hooks remain bypassable local feedback, while GitHub's trusted exact-head OpenPGP gate remains authoritative.

Submission checklist

• The change is one bounded factory slice.
• Tests cover behavior and boundary failures.
• The strict repository contract passed.
• Contributor and factory documentation is updated.
• No secrets, private identifiers, local paths, key material, or generated state are committed.
• Branch, PR title, and commit follow the contribution policy.
• The commit is OpenPGP signed and has the exact DCO trailer.
• The diff was self-reviewed; a bounded Claude CLI attempt timed out without output, and hosted gates pass on the exact head.
• The final-head private metrics record and bounded closeout comment are complete.

Closes #200

[yshyn-iohk]

Factory closeout for exact head 13909ea

• Backing issue: feat(factory): enforce contribution policy with local Git hooks #200.
• Review: self-review found no merge-blocking correctness, security, credential, command-injection, or data-loss defect. A bounded Claude CLI review attempt produced no output within five minutes and was canceled; it is recorded as unavailable evidence, not a clean verdict.
• Local evidence: focused hook/policy tests passed 21/21; strict repository contract, Pi/bootstrap/package smoke, dev-loop policy, exact-range DCO/OpenPGP, and the actual pre-push hook all passed.
• Hosted evidence: every selected exact-head lane passed. Basic 101s; unit 412s; headless 309s; quality 389s; coverage 462s; Compact 201s; locked Nix 770s; optimized UI 743s; UI profiles 1078s. Exact-head CI wall time was 1090s.
• Metrics: the closed private v1 record was written and audited successfully. Peak worktree usage was 1,030,451,200 bytes. Exact non-overlapping token counters were unavailable and remain null, never zero.
• Follow-up: concurrent multi-session hook-bundle installation hardening is tracked separately in fix(factory): make hook bundle installation transactional #218; the obsolete integration merge-gate contradiction is tracked in fix(harness): align integration merge audit with delivery policy #217. Neither expands this PR.

Ready for review and exact-head integration delivery.