[kyle-sexton]

No related issue: follow-up to a review finding on #211 (claude-code-plugins#9504 rollout)

Summary

Lists lefthook.yml in README's "What's here" inventory, which the tracked-file inventory rule (AGENTS.md, Code Review Rules) requires for every added file.

Fix

• README.md: new Git hooks bullet. lefthook.yml holds one remotes: entry running the guardrails hooks from claude-code-plugins, and the hook scripts are owned there.

Verification

• This commit ran the remote pre-commit-content and commit-msg-convention hooks (both pass); the push ran reference-verify.
• Addresses the Codex finding on #211.

Related

• #211: added lefthook.yml.
• claude-code-plugins#9504: the remote config.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	🔄 Running since 2026-10-24T04:11:30.231453Z	b9cc722	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-security-review needs no new review of b9cc722d2c57386f39130e0aaf14312afbd6c75f: every file in scope matches docs-only-paths.

[github-actions]

claude-review reviewed b9cc722d2c57386f39130e0aaf14312afbd6c75f: 0 finding(s), 0 as inline comments.

No findings. The PR adds one Git hooks bullet to README.md "What's here" for lefthook.yml.

• I read lefthook.yml at the head commit. It has one remotes: entry pointing at melodic-software/claude-code-plugins and the config path plugins/guardrails/git-hooks/lefthook-remote.yml. That matches what the bullet says.
• I did not fetch the remote config. The bullet's claim that it defines commit-msg, pre-commit and pre-push hooks is unverified.
• The bullet matches the style of the neighbouring entries. The PR body follows the contract: it has a No related issue: line and the four required sections.
• The PR has no closing issue, so there are no acceptance criteria to check. There are no plugin manifest changes, so no manifest lines apply.
• The diff adds no model or API spend and touches no trust-gate files, so there is no hold.
• The PR's own verification claims (the hooks that ran on commit and push) are author-claimed and unverified by me.