fix(hooks): commit-guard heredoc false positive, and a one-model data strip

CLAUDE.md

@@ -190,7 +190,7 @@ Requires `shellcheck`, `jq`, and `git` (the hooks need `jq` at runtime too) —
 
 ### 19.4 Current release pointers
 
-- **Live version:** v1.0.6 (annotated tag, latest on `main`).
+- **Live version:** v1.0.7 (annotated tag, latest on `main`).
 - **In flight:** none (set per session).
 - **CHANGELOG:** none — release notes are the GitHub Release body, generated from `git log` between tags.
 - **Spec / PRD:** `README.md` + `STRUCTURE.md` are canonical.

README.md

@@ -6,28 +6,28 @@ Most people publish a single `CLAUDE.md` and call it a setup. The thing that act
 
 ## What's inside
 
-| Path                                                             | What it is                                                                                                                                                                                                                                                                                                                                                                        |
-| ---------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `CLAUDE.md`                                                      | The universal spine — a lean (~220-line) always-loaded core: workflow, git rules, coding guidelines, secrets, anti-patterns. Stack-agnostic. Longer reference material lives in `docs/` and loads on demand.                                                                                                                                                                      |
-| `rules/{web,android,ios,compute}.md`                             | Platform rule packs. Each carries a `paths:` frontmatter glob; Claude Code loads a pack when it reads a file matching that glob (`*.kt` → android, `*.swift` → ios, `*.ts`/`*.py` → web, `*.cpp`/`*.cu` → compute). Path-triggered, so packs whose files you never touch stay out of context.                                                                                     |
-| `agents/` (15)                                                   | The default subagent roster: the four-hat chain (architect → senior-swe → code-reviewer → qa), plus specialists (security, performance, db-migration, debugger, devops, docs, design), release-engineer + tech-writer, and a delivery layer (TPM, scrum-master).                                                                                                                  |
-| `agents-android/` (7), `agents-ios/` (7), `agents-compute/` (13) | Per-stack overrides. Drop them into a repo's `.claude/agents/` and they override the generic ones of the same name with platform-brained versions.                                                                                                                                                                                                                                |
-| `hooks/guard-commit.sh`                                          | A Claude Code Bash hook (PreToolUse) that blocks the _agent_ from force-pushing, skipping git hooks with `--no-verify`, committing as a non-human, writing AI attribution into a commit message, or staging obvious secrets. Every segment of a chained command is checked on its own. It guards Claude's git commands — not a human typing `git` directly in their own terminal. |
-| `hooks/format.sh`                                                | Auto-formats edited files by extension across every stack. Missing formatter is a silent no-op, never an error.                                                                                                                                                                                                                                                                   |
-| `tests/hooks/`                                                   | Behavioral tests for both hooks: a JSON payload on stdin, an exit code out, one case per rule and per past regression. Plain bash 3.2 + `jq`. CI (`.github/workflows/gate.yml`) runs them with the rest of the quality gate on every PR.                                                                                                                                          |
-| `skills/new-repo/`                                               | A scaffolder skill: spins up a new repo with the right `CLAUDE.md`, `.gitignore`, quality gate, and release workflow. Scaffolds **web + Android**; iOS and compute ship as rule + agent packs (no scaffolder for them yet).                                                                                                                                                       |
-| `docs/`                                                          | On-demand reference the spine points to (full roster tables, the Phase-3 review checklist, the error-recovery table, PR template, scaling notes). Installed to `~/.claude/docs/`; loaded only when a stub references it.                                                                                                                                                          |
-| `templates/`                                                     | Blank project `CLAUDE.md` templates (generic + compute) to copy into a new repo and fill in.                                                                                                                                                                                                                                                                                      |
-| `examples/CLAUDE.example-web.md`                                 | A filled-in example so you can see what "done" looks like before you write your own.                                                                                                                                                                                                                                                                                              |
-| `STRUCTURE.md`                                                   | The full layout, install steps, and how the two-settings-file swap works. **Read this first.**                                                                                                                                                                                                                                                                                    |
+| Path                                                             | What it is                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| ---------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `CLAUDE.md`                                                      | The universal spine — a lean (~220-line) always-loaded core: workflow, git rules, coding guidelines, secrets, anti-patterns. Stack-agnostic. Longer reference material lives in `docs/` and loads on demand.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| `rules/{web,android,ios,compute}.md`                             | Platform rule packs. Each carries a `paths:` frontmatter glob; Claude Code loads a pack when it reads a file matching that glob (`*.kt` → android, `*.swift` → ios, `*.ts`/`*.py` → web, `*.cpp`/`*.cu` → compute). Path-triggered, so packs whose files you never touch stay out of context.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+| `agents/` (15)                                                   | The default subagent roster: the four-hat chain (architect → senior-swe → code-reviewer → qa), plus specialists (security, performance, db-migration, debugger, devops, docs, design), release-engineer + tech-writer, and a delivery layer (TPM, scrum-master).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| `agents-android/` (7), `agents-ios/` (7), `agents-compute/` (13) | Per-stack overrides. Drop them into a repo's `.claude/agents/` and they override the generic ones of the same name with platform-brained versions.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
+| `hooks/guard-commit.sh`                                          | A Claude Code Bash hook (PreToolUse) that blocks the _agent_ from force-pushing, skipping git hooks with `--no-verify`, committing as a non-human, writing AI attribution into a commit message, or staging obvious secrets. Every segment of a chained command is checked on its own. Quoted text, heredoc bodies, substitutions, and arithmetic are stripped as data first, so a commit message or a file body that merely mentions a blocked flag never trips it; a shape the check cannot classify (a shell wrapper of any form, a substitution inside `${...}`, an unquoted pattern in a commit or push, git config passed through the environment) is refused rather than guessed. It guards Claude's git commands — not a human typing `git` directly in their own terminal. |
+| `hooks/format.sh`                                                | Auto-formats edited files by extension across every stack. Missing formatter is a silent no-op, never an error.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
+| `tests/hooks/`                                                   | Behavioral tests for both hooks: a JSON payload on stdin, an exit code out, one case per rule and per past regression. Plain bash 3.2 + `jq`. CI (`.github/workflows/gate.yml`) runs them with the rest of the quality gate on every PR.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
+| `skills/new-repo/`                                               | A scaffolder skill: spins up a new repo with the right `CLAUDE.md`, `.gitignore`, quality gate, and release workflow. Scaffolds **web + Android**; iOS and compute ship as rule + agent packs (no scaffolder for them yet).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+| `docs/`                                                          | On-demand reference the spine points to (full roster tables, the Phase-3 review checklist, the error-recovery table, PR template, scaling notes). Installed to `~/.claude/docs/`; loaded only when a stub references it.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
+| `templates/`                                                     | Blank project `CLAUDE.md` templates (generic + compute) to copy into a new repo and fill in.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| `examples/CLAUDE.example-web.md`                                 | A filled-in example so you can see what "done" looks like before you write your own.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| `STRUCTURE.md`                                                   | The full layout, install steps, and how the two-settings-file swap works. **Read this first.**                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
 
 ## The idea in one paragraph
 
 Two tiers. The **global** tier (`~/.claude/CLAUDE.md` + `rules/` + `agents/` + `hooks/`) is everything that's true regardless of what you're building. The **project** tier is a short `CLAUDE.md` at the repo root that holds only what's specific to that project (§19: stack, quality gate, release pointers, compliance scope). The spine gets prompt-cached and never changes; the project file is the only thing you edit per repo. Rules specialize by path-trigger (a pack loads when Claude reads a file its `paths:` glob matches); agents specialize by name-override (a repo's `.claude/agents/<name>.md` shadows the global agent of the same name). Neither scans the repo up front. You configure once, then mostly leave it alone.
 
 ## Install
 
-Mac/Linux, with Claude Code already installed. Full steps and the per-repo install are in [`STRUCTURE.md`](./STRUCTURE.md). First install the hook prerequisite `jq` (`guard-commit.sh` fails closed without it): `brew install jq` (macOS) / `sudo apt-get install jq` (Debian/Ubuntu). Then:
+Mac/Linux, with Claude Code already installed. Full steps and the per-repo install are in [`STRUCTURE.md`](./STRUCTURE.md). First install the hook prerequisite `jq` (`guard-commit.sh` fails closed without it): `brew install jq` (macOS) / `sudo apt-get install jq` (Debian/Ubuntu); the guard also needs git 2.28 or newer. Then:
 
 ```bash
 git clone https://github.com/roadhero/claude-code-setup.git && cd claude-code-setup