From 111d5ef552c8dd549794b6236820e2db97c3a2a7 Mon Sep 17 00:00:00 2001
From: Dave Thompson <dave.thompson@3leaps.net>
Date: Mon, 22 Jun 2026 15:01:12 -0400
Subject: [PATCH] chore(ci): drop guardian browser intercept from git hooks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Regenerated the pre-commit/pre-push hooks without --with-guardian and
removed the residual guardian comment lines. sfetch is moving to a
standard branch/PR workflow, so the local guardian browser-approval
intercept on commit/push is no longer needed.

🎯 Changes:
- goneat hooks generate (without --with-guardian)
- goneat hooks install
- manually removed leftover "Guardian enforcement ..." comments

The manifest-driven goneat assess (format/lint on pre-commit;
format/lint/security on pre-push) and the crucible-clean pre-push check
are unchanged.

Generated by Claude Opus 4.8 (1M context) (https://anthropic.com) as foxtrot-devlead running Claude Code (https://claude.com/claude-code) under supervision of [@3leapsdave](https://github.com/3leapsdave)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@3leaps.net>
Committer-of-Record: Dave Thompson <dave@3leaps.net> [@3leapsdave]
---
 .goneat/hooks/pre-commit | 33 -------------------------
 .goneat/hooks/pre-push   | 53 ----------------------------------------
 2 files changed, 86 deletions(-)

diff --git a/.goneat/hooks/pre-commit b/.goneat/hooks/pre-commit
index f1abc7b..b0e7766 100755
--- a/.goneat/hooks/pre-commit
+++ b/.goneat/hooks/pre-commit
@@ -71,39 +71,6 @@ if [ -z "$GONEAT_BIN" ]; then
   fi
 fi
 
-# Guardian enforcement for protected git commit operations
-CURRENT_BRANCH=$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo "")
-GUARDIAN_SCOPE="git"
-GUARDIAN_OPERATION="commit"
-
-GUARDIAN_ARGS=("$GONEAT_BIN" guardian check "$GUARDIAN_SCOPE" "$GUARDIAN_OPERATION")
-if [ -n "$CURRENT_BRANCH" ]; then
-  GUARDIAN_ARGS+=("--branch" "$CURRENT_BRANCH")
-fi
-
-# Note: pre-commit hook runs before commit message is available
-# Just pass generic commit indicator since message doesn't exist yet
-GUARDIAN_ARGS+=("--" "-m" "<pending commit message>")
-
-if ! "${GUARDIAN_ARGS[@]}"; then
-  echo ""
-  echo "❌ Operation blocked by guardian"
-  echo "🔐 Approval required for: ${GUARDIAN_SCOPE} ${GUARDIAN_OPERATION}"
-  if [ -n "$CURRENT_BRANCH" ]; then
-    echo "   • Branch: $CURRENT_BRANCH"
-  fi
-  echo "   • Risk level: high"
-  echo "   • Method: browser"
-  echo "   • Approval expires in: 10m0s"
-  echo ""
-  echo "Wrap your git commit with guardian approval to continue:"
-  echo "  $GONEAT_BIN guardian approve $GUARDIAN_SCOPE $GUARDIAN_OPERATION -- git commit"
-  echo "  # add your usual commit arguments after git commit"
-  exit 1
-fi
-
-echo "✅ Guardian approval satisfied"
-
 # Use goneat's orchestrated assessment (manifest-driven)
 "$GONEAT_BIN" assess --hook pre-commit --hook-manifest "$REPO_ROOT/.goneat/hooks.yaml" --package-mode
 
diff --git a/.goneat/hooks/pre-push b/.goneat/hooks/pre-push
index 0232a23..1e7c220 100755
--- a/.goneat/hooks/pre-push
+++ b/.goneat/hooks/pre-push
@@ -69,59 +69,6 @@ if [ -z "$GONEAT_BIN" ]; then
   fi
 fi
 
-# Guardian enforcement for protected git push operations
-REMOTE_NAME="${1:-}"
-REMOTE_URL="${2:-}"
-CURRENT_BRANCH=$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo "")
-GUARDIAN_SCOPE="git"
-GUARDIAN_OPERATION="push"
-
-GUARDIAN_ARGS=("$GONEAT_BIN" guardian check "$GUARDIAN_SCOPE" "$GUARDIAN_OPERATION")
-if [ -n "$CURRENT_BRANCH" ]; then
-  GUARDIAN_ARGS+=("--branch" "$CURRENT_BRANCH")
-fi
-if [ -n "$REMOTE_NAME" ]; then
-  GUARDIAN_ARGS+=("--remote" "$REMOTE_NAME")
-elif [ -n "$REMOTE_URL" ]; then
-  GUARDIAN_ARGS+=("--remote" "$REMOTE_URL")
-fi
-
-# Pass push context for display
-if [ -n "$REMOTE_NAME" ] && [ -n "$CURRENT_BRANCH" ]; then
-  GUARDIAN_ARGS+=("--" "$REMOTE_NAME" "$CURRENT_BRANCH")
-else
-  GUARDIAN_ARGS+=("--" "<remote>" "<branch>")
-fi
-
-if ! "${GUARDIAN_ARGS[@]}"; then
-  echo ""
-  echo "❌ Operation blocked by guardian"
-  echo "🔐 Approval required for: ${GUARDIAN_SCOPE} ${GUARDIAN_OPERATION}"
-  if [ -n "$CURRENT_BRANCH" ]; then
-    echo "   • Branch: $CURRENT_BRANCH"
-  fi
-  if [ -n "$REMOTE_NAME" ]; then
-    echo "   • Remote: $REMOTE_NAME"
-  elif [ -n "$REMOTE_URL" ]; then
-    echo "   • Remote URL: $REMOTE_URL"
-  fi
-  echo "   • Risk level: critical"
-  echo "   • Method: browser"
-  echo "   • Approval expires in: 15m0s"
-  echo "📝 A reason is required when approving this operation."
-  echo ""
-  echo "Wrap your git push with guardian approval to proceed:"
-  if [ -n "$REMOTE_NAME" ] && [ -n "$CURRENT_BRANCH" ]; then
-    echo "  $GONEAT_BIN guardian approve $GUARDIAN_SCOPE $GUARDIAN_OPERATION -- git push \"$REMOTE_NAME\" \"$CURRENT_BRANCH\""
-  else
-    echo "  $GONEAT_BIN guardian approve $GUARDIAN_SCOPE $GUARDIAN_OPERATION -- git push <remote> <branch>"
-  fi
-  echo "Once approved, the push runs automatically under guardian supervision."
-  exit 1
-fi
-
-echo "✅ Guardian approval satisfied"
-
 # Verify crucible sources are clean before pushing
 if [ -f "$REPO_ROOT/scripts/verify-crucible-clean.sh" ]; then
   if ! "$REPO_ROOT/scripts/verify-crucible-clean.sh"; then