[melodic-automation-lanes]

Closes #7966

Summary

Opened by the work-resolve-issue lane. The run's own summary:

The guardrails commit-msg convention hook now exits 0 for subjects starting Merge or Revert " before the pattern check, as it already did for the autosquash forms. Every other subject is still checked and a violation still exits 1 with the existing fix text.

Not verified

• The new test cases were not run: Bash in this lane allows only the named wrappers, so commit-msg-convention.test.sh could not be executed. The PR's CI test-bash job is the check.
• Changes are left uncommitted in the working tree, as the runner instructs.
• The hook's v2 sentinel on line 2 was left unchanged; it is a convention-inference marker, not a behavior version.

Fix

• plugins/guardrails/git-hooks/commit-msg-convention.sh: the exempt-subject case gains Merge and Revert "; the header comment lists them
• plugins/guardrails/git-hooks/commit-msg-convention.test.sh: new cases under the Conventional Commits pattern: Merge branch 'x' -> 0, Revert "feat: y" -> 0, update stuff -> 1, Mergers and acquisitions -> 1, Revert the thing -> 1; header comment updated
• .changes/guardrails/work-resolve-issue-issue-7966-3f9c2a71.md: patch fragment (written by hand because HEAD was detached and new-changelog-fragment needs a branch)

Verification

The runner ran each check from the base copy against dedc414:

• scripts/check-changelog-fragments.sh --check: passed

The run reports:

• check-changelog-fragments: all 1 fragment valid
• check-affected: 10 passed, 6 skipped, no failures
• fresh-context subagent review of the diff: no defects found (read-only, it could not run the tests)
• The lane run: https://github.com/melodic-software/claude-code-plugins/actions/runs/40088063621

Left out: the items under Not verified.

Related

#7966

[github-actions]

claude-security-review reviewed dedc414ab33b2ed43fc09fecf6754014908b8ce5: 0 finding(s), 0 as inline comments.

No security issues found in this pull request.

The change adds Merge and Revert " to the subjects the guardrails commit-msg hook lets through unchecked. The hook already did this for fixup!, squash! and amend!.

• Hook allowlist. The widened allowlist is a commit-message style convention check. It is not an authorization, secret-handling or injection control. Anyone can already skip a local commit-msg hook with --no-verify, and the hook never suggested that. A subject beginning Merge or Revert " can now skip the team's subject pattern. That only affects commit-message formatting and exposes nothing else.
• Injection. The case patterns are quoted literals, and $subject is matched, never evaluated. Nothing in the diff adds a new shell-injection path.
• Instruction-surface lens. I read the instruction exception register at docs/conventions/instruction-exception-register/README.md. It has no protected class for commit-subject conventions. No hook, deny rule or validator in the diff enforced a security rule that this change removes.
• PR context. The PR description contains no embedded directives.
• Manifests. No plugin.json or marketplace.json changed, so there are no manifest <field> lines.
• Trust-gate paths. No trust-gate paths were touched.

critical-findings: 0

[github-actions]

claude-review reviewed dedc414ab33b2ed43fc09fecf6754014908b8ce5: 0 finding(s), 0 as inline comments.

No findings. I read the full diff (3 files) and the PR context. I did not run any tests: I had no shell in this lane.

Closing issue #7966 criteria

• Merge branch 'x' exits 0: met. The test case is at commit-msg-convention.test.sh:89, and the hook change is at commit-msg-convention.sh:88.
• Revert "feat: y" exits 0: met. The test case is at commit-msg-convention.test.sh:90.
• update stuff still exits 1: met. The test case is at commit-msg-convention.test.sh:91. Two near-miss cases (Mergers and acquisitions, Revert the thing) also check that the exemption is narrow.
• Guardrails fragment: present, bump: patch. A patch bump fits a bug fix. I did not run check-changelog-fragments.sh. The PR body says it passed, but that is author-claimed and I did not confirm it.
• "The PR's CI runs test-bash and it passes": the CI result is not in the files I was given, so I cannot confirm it. A person should check that job before merging. The PR body says the new cases were never run locally.

Code check

• The new case arms sit before the pattern check and match only the literal prefixes Merge and Revert ". The subject is already extracted and comment-stripped by then, so the exemption applies to the real subject line.
• The failure text is unchanged and still never suggests skipping the hook.
• The header comments in both files match the new behaviour.

Manifests: no plugin.json or marketplace.json change, so none of the manifest checks apply.

Embedded text: none in the PR context tried to instruct the review.

Hold: none. The change adds no model or API spend and touches no trust-gate path.

[melodic-automation-lanes]

The unattended merge path armed native auto-merge at head dedc414ab33b2ed43fc09fecf6754014908b8ce5.