chore(claude): remove org-internal persona-write-guard from this public repo - #130
Merged
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Important Review skippedReview was skipped as selected files did not have any reviewable changes. 💤 Files selected but had no reviewable changes (1)
⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
…ic repo TrustScope is a public repository. It carried `.claude/settings.json` on `main`, containing our org-internal Persona-Write-Guard: a `PreToolUse` Bash hook that intercepted every Bash command, parsed it for `git push`, `gh pr create`, and `gh pr merge`, and blocked the command unless the current branch matched one of our internal persona names (`bob`, `linus`, `maschin`, and so on), failing with an error that cited an issue in a private repo. Claude Code loads project-level settings from the repository it is working in. Any contributor who cloned TrustScope and used Claude Code therefore inherited that policy: their own push was blocked because their branch did not follow a naming convention that is ours, internal, and undocumented here. The error message pointed them at an issue they cannot read. Two things were wrong with that, and the second is the reason this is a deletion rather than a fix: 1. It is a session-governance policy for our own agents. It has no bearing on TrustScope as a product and does not belong in its source tree. 2. We do not ship a hook that blocks a contributor's push on our branch names — least of all from the repository that is our public trust-and-quality product. The control itself is not being abandoned; where it should live is under review in neckarshore-ai/dev-environment#124. This commit only stops this repository from carrying it. `.claude/` held no other tracked file and is now gone. No workflow, document, or config in this repository referenced the path — verified by a repo-wide sweep — so nothing is left dangling by its removal. Finding and full analysis: neckarshore-ai/dev-environment#124 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011EbYjoRwhT2LW4UDoCdv9z
GmanFooFoo
force-pushed
the
linus/2026-07-30-pwg-public-exposure
branch
from
July 30, 2026 16:43
93e074a to
d82011a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Removes
.claude/settings.jsonfrom this public repository. One deleted file, nothing else.What the file was
An org-internal Persona-Write-Guard: a
PreToolUseBash hook that intercepted every Bash command, parsed it forgit push/gh pr create/gh pr merge, and blocked it unless the current branch matched one of our internal persona names (bob,linus,maschin, …), failing with an error citing an issue in a private repo.Why it had to go
Claude Code loads project-level settings from the repo it is working in. A contributor who cloned TrustScope and used Claude Code inherited that policy — their push was blocked by a branch-naming convention that is ours, internal, and undocumented here, with an error pointing at an issue they cannot read.
It is session governance for our own agents. It has no bearing on TrustScope as a product, and we do not ship a hook that blocks a contributor's push on our branch names — least of all from the repository that is our public trust-and-quality product.
The control is not being abandoned. Where it should live is under review in neckarshore-ai/dev-environment#124. This PR only stops this repository from carrying it.
Scope — what this does and does not fix
Fixed: a fresh clone of TrustScope no longer inherits the hook. That is the contributor-facing breakage and the reason for this PR.
Not fixed, and out of scope here:
git rmremoves the file from the tip, not from history. The hook text and the persona roster remain retrievable from earlier commits and from the PRs that introduced them. No credentials or secrets are involved — this is low-severity information residue, noted so the remediation in #124 can account for it rather than assume it is gone.Verification
.claude/held no other tracked file; the directory is now gone. No placeholder added..claudeand forpersona-write-guard|PWG|#813found no other reference — nothing is left dangling. (Thepackage-lock.jsonmatches are base64 integrity hashes, not references.)git diff --stat main...HEAD— exactly one deleted file.Finding and full analysis: neckarshore-ai/dev-environment#124
Do not auto-merge — the Founder merges this one.
🤖 Generated with Claude Code
https://claude.ai/code/session_011EbYjoRwhT2LW4UDoCdv9z