[tech-debt] Pre-push quality-gate runs prettier:fix/mdlint:fix repo-wide in WRITE mode — authors bypass the hook

[rucka]

Story Statement

As a contributor pushing a story branch
I want the pre-push hook to verify only what I changed (or to run in check mode)
So that I stop having to git push --no-verify, and the hook actually provides assurance again

Epic Context

Parent Epic: repo tooling / quality gates (no epic — standalone tech debt)
Status: Todo
Priority: P1 (Should-Have)

Problem

package.json → quality-gate (run by the husky pre-push hook) contains:

turbo ts:check test lint && turbo prettier:fix mdlint:fix && ./tools/markdownlint-config/bin/markdownlint-fix.sh '*.md' && pnpm hygiene:check && pnpm docs:staleness && pnpm skills:conformance && pnpm dup:check

prettier:fix / mdlint:fix run repo-wide in WRITE mode. On any branch whose baseline is not already fully formatted, the hook rewrites files unrelated to the change, so the author either sweeps foreign reformats into the commit or bypasses the hook. Observed repeatedly, most recently on PR #388 (pushed with --no-verify; the hook had reformatted two unrelated pair-cli test files). Once bypassing is routine the hook provides no assurance at all.

Likely In Scope

• Scope fix-mode formatting to staged files (lint-staged or equivalent), or
• Run check mode in the hook and keep :fix as an explicit developer command (pnpm format)
• Keep the rest of the gate set as-is (ts:check / test / lint / hygiene / staleness / conformance / dup)
• Verify a push on a branch with an unformatted baseline elsewhere no longer touches unrelated files

Likely Out of Scope

• Changing which gates run (tier gate matrix, pair-capability-verify-quality integrated with the gate matrix (local = CI) #259)
• CI workflow changes

Classification

risk:yellow · cost:green · coupling: green (no domain artifacts; the new dependency on the repo .gitignore degrades gracefully)

Recorded post-hoc. This story was implemented straight from Draft: it never went through /pair-process-refine-story, so it carried no risk:* label and its criteria stayed headed "(draft)" while PR #412 was reviewed — the same history as #407. The block below is the classification of record for the review floor, written during review round 4 of #412 and matching the reviewer's independent review-time read (no drift). Tech-debt stories on this project may skip refinement (see #401, #407); the classification is then recorded here rather than inherited implicitly from the PR body.

Matrix — per dimension

Dimension	Tier	Source	Note
Service/domain criticality	yellow	KB default	The pre-push gate is the delivery guard every contributor crosses; no product surface. A broken gate blocks every push.
Change/diff risk	yellow	story scope	~21 files on the push path of every contributor (root package.json gate composition, both formatter wrapper pairs, turbo.json cache inputs); behaviour-sensitive but tooling-only.
Business impact	green	subdomain class	Internal DX / repo tooling; no user-facing change.
Security relevance	green	path heuristic	No auth/PII/input surface; the only new runtime artifact is an mktemp ignore file removed on EXIT. gitleaks green.
Coupling balance	green	absent	Dev tooling; the new read of the repo's .gitignore no-ops when git rev-parse fails.

Overall risk:yellow — floored by KB-default criticality and by the blast radius (every push); not red: no production runtime, no data, human gates merge, and the failure mode is a blocked or noisy push. cost computed but not projected as a tag (risk-matrix Tag Projection: Active: risk).

Acceptance Criteria

Kept as authored (they were never refined into Given-When-Then). Treated as the criteria of record for the review of PR #412; see the Classification note above.

• Pushing a branch never modifies a file the branch did not change
• A formatting violation in a changed file still fails/fixes before push
• --no-verify is no longer needed for a normally formatted change

Notes

Raised as a review finding on PR #388 (repo-tooling scope, deliberately not fixed inside that story). Every gate the hook would have run was re-run manually and green there.