Charles Wiltgen 980ae18486 fix(gate): report a scanner failure as a failure, and make the block-scalar guard able to fire ...

Two P3 guards in the content gate could not do the job they were written for.

`pre-commit-axiom.sh` captured the scanner's output and then filtered it to
`^  ✗|error(s)`. When the scanner crashed rather than reported, that filter
discarded its entire message and the hook still asserted "private data in shipped
content" — a confident diagnosis the run had produced no evidence for. The hook now
branches on whether a `✗` line exists: findings are printed and the failure says so,
and their absence means the scanner failed, which gets its own wording and the raw
output. Verified in a sandbox against a scanner that throws and one that reports.

`always-on-footprint.test.ts` asserted the absence of a block scalar against
`String(matter(file).data.description).trim()`. gray-matter resolves `description: |`
to its content, so that assertion could only fire on a description whose literal text
was `|` — the byte count the test sums changes for exactly the case it was meant to
catch. The shape is now asserted against the frontmatter region of the file text, and
fires on `|` and `>-` while leaving a quoted "|" alone.

Also drops an SC2181 in the same hook. pre-deploy check 11 shellchecks only the
plugin's own hooks/ directory, so scripts/git-hooks/ — this gate's machinery — has
never been linted.

Verified: 518/518 unit tests, 14/14 installer tests, shellcheck clean, and both hook
branches exercised end to end.

2026-09-16 08:10:22 -07:00

..

pre-commit-axiom.sh

fix(gate): report a scanner failure as a failure, and make the block-scalar guard able to fire

2026-09-16 08:10:22 -07:00