v1.5.0: manifest-driven PreToolUse + PostToolUse hooks (Tier 1, 10 rules)

[lapc506]

Goal

Ship 10 deterministic, manifest-driven PreToolUse + PostToolUse hooks in v1.5.0 that enforce common dev-discipline rules across all repos where the plugin is enabled.

Tier 1 ruleset

#	Rule ID	Tool	Action
1	ssh-db-mutation	Bash	block
2	gcloud-missing-project	Bash	warn
3	prod-ops-no-approval	Bash	block
4	destructive-db-ops	Bash	block
5	manual-edge-fn-deploy	Bash	block
6	minified-build-output	Edit/Write/MultiEdit	block
7	secrets-hardcoded	Edit/Write/MultiEdit	block
8	slack-unicode-bullets	Slack	warn
9	slack-tables-no-codeblock	Slack	warn
10	slack-spanish-tildes	Slack	warn

Architecture

• Single source of truth: hooks/rules/rules.yaml
• Generic evaluator: hooks/lib/eval-rule.sh (no rule-specific logic in shell)
• Build pipeline: scripts/build-rules.mjs compiles YAML → JSON, validates schema, runs IP-leak guard

Status

• PR chore: genericize toolkit examples (v1.4.1) #8 — chore: genericize toolkit examples (v1.4.1) — must merge first
• PR feat: manifest-driven PreToolUse + PostToolUse hooks (v1.5.0) #9 — feat: hooks (v1.5.0) — depends on chore: genericize toolkit examples (v1.4.1) #8

Closes

PR #9 closes this issue.

Related

• See hooks/rules/README.md (in PR feat: manifest-driven PreToolUse + PostToolUse hooks (v1.5.0) #9) for the schema and the T1-T7 decomposition techniques planned for Tier 2.

[lapc506]

Closed — all 10 Tier 1 rules shipped in v1.5.0 (PR #9, commit ac48799). Verified present in hooks/rules/rules.yaml: ssh-db-mutation, gcloud-missing-project, prod-ops-no-approval, destructive-db-ops, manual-edge-fn-deploy, minified-build-output, secrets-hardcoded, slack-unicode-bullets, slack-tables-no-codeblock, slack-spanish-tildes.

Closed retroactively 2026-05-14 after audit subagent confirmed all 10 rule IDs are present in the manifest.

🤖 Created by Claude Code (Opus 4.7) on behalf of @andres