fix(#577): disable in-repo git hooks inside sandbox

[fullsend-ai-coder]

Summary

Disable in-repo git hooks inside the agent sandbox by adding git config --global core.hooksPath /dev/null to both the code-implementation and fix-review skills.

Target repo git hooks (e.g., Husky's commit-msg hook with DCO sign-off) fire inside the sandbox during agent commits and inject Signed-off-by trailers. The post-scripts (post-code.sh section 3b, post-fix.sh section 1b) reject commits containing these trailers, making agents incompatible with Husky-based repositories.

Changes:

• skills/code-implementation/SKILL.md: Added hook disabling instruction to step 5 (Create branch), before any commit operations. Updated step 10 hook guidance to reference proactive disabling rather than only the reactive --no-verify fallback.
• skills/fix-review/SKILL.md: Added hook disabling as step 3.4 (Discover repo conventions), before implementation begins.

Rationale: The sandbox is ephemeral and the post-scripts already run hooks authoritatively on the runner. In-sandbox hooks are redundant and, in this case, actively harmful. Disabling via core.hooksPath covers all hook frameworks (Husky, lefthook, raw .git/hooks/), not just Husky.

Testing

• Verified make test passes (1 pre-existing failure in post-triage-test.sh unrelated to this change)
• Secret scan passed on all changed files
• Gitlint validation passed

---

Closes #577

Post-script verification

• Branch is not main/master (agent/577-disable-sandbox-hooks)
• Secret scan passed (gitleaks — 93b7178526a4dd58b8d77a3035731b6345896614..HEAD)
• PR body secret scan passed (gitleaks — no-git)
• Pre-commit hooks passed (authoritative run on runner)
• Tests ran inside sandbox

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:05 PM UTC · Completed 9:19 PM UTC
Commit: f1a0b91 · View workflow run →

[fullsend-ai-review]

Review

Findings

Medium

• [logic-error] skills/code-implementation/SKILL.md:770 — Step 10 states "Git hooks are disabled in step 5" as a blanket precondition, but step 4's existing-branch path ("Skip to step 9") bypasses step 5 entirely. When an agent reuses a branch, core.hooksPath is never set to /dev/null, making the step 10 assertion false for that code path. The --no-verify fallback is documented but framed as a rare edge case rather than the expected path.
  Remediation: Move git config --global core.hooksPath /dev/null to step 3 (always runs), or add it to the step 4 existing-branch path before skipping to step 9.

• [protected-path] skills/code-implementation/SKILL.md, skills/fix-review/SKILL.md — Both changed files are under skills/, a protected path requiring human approval. The PR links to issue Code/fix agent conflict with Husky #577 and provides clear rationale for the change. Human approval is still required for protected-path changes regardless of context.

Low

• [internal-consistency] skills/fix-review/SKILL.md:196 — fix-review's step 8 (Commit) has no mention that hooks are disabled or a --no-verify fallback, unlike code-implementation's step 10 which was explicitly updated. The missing fallback guidance means an agent has no documented recovery if hooks fire despite the disable.

• [formatting-consistency] skills/code-implementation/SKILL.md:264 — The hook-disabling prose block is inserted between the STEP 5 progress marker and the branch creation commands, placing preparatory infrastructure before the step's primary operation.

---

Labels: PR modifies skills for both the code-implementation and fix-review agents

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-review]

[medium] logic-error

Step 10 states 'Git hooks are disabled in step 5 (core.hooksPath /dev/null)' as a blanket precondition, but step 4's existing-branch path ('Skip to step 9') bypasses step 5 entirely. When an agent reuses a branch, core.hooksPath is never set to /dev/null, making the step 10 assertion false for that code path. The --no-verify fallback is documented but framed as a rare edge case rather than the expected path.

Suggested fix: Move 'git config --global core.hooksPath /dev/null' to step 3 (always runs), or add it to the step 4 existing-branch path before skipping to step 9.

[fullsend-ai-review]

[low] internal-consistency

fix-review's step 8 (Commit) has no mention that hooks are disabled or a --no-verify fallback, unlike code-implementation's step 10 which was explicitly updated. The missing fallback guidance means an agent has no documented recovery if hooks fire despite the disable.

Suggested fix: Add a brief note to fix-review step 8 analogous to code-implementation step 10: 'Hooks are disabled in step 3. If a hook fires despite this, commit with --no-verify.'

[fullsend-ai-review]

[low] formatting-consistency

The hook-disabling prose block is inserted between the STEP 5 progress marker and the branch creation commands, placing preparatory infrastructure before the step's primary operation.

Suggested fix: Move the hook-disabling section to appear after the branch creation commands or before the step marker.