fix(guardrails): let git-generated Merge and Revert subjects pass the commit-msg hook - #9643

claude-security-review reviewed dedc414ab33b2ed43fc09fecf6754014908b8ce5: 0 finding(s), 0 as inline comments.

No security issues found in this pull request.

The change adds Merge and Revert " to the subjects the guardrails commit-msg hook lets through unchecked. The hook already did this for fixup!, squash! and amend!.

• Hook allowlist. The widened allowlist is a commit-message style convention check. It is not an authorization, secret-handling or injection control. Anyone can already skip a local commit-msg hook with --no-verify, and the hook never suggested that. A subject beginning Merge or Revert " can now skip the team's subject pattern. That only affects commit-message formatting and exposes nothing else.
• Injection. The case patterns are quoted literals, and $subject is matched, never evaluated. Nothing in the diff adds a new shell-injection path.
• Instruction-surface lens. I read the instruction exception register at docs/conventions/instruction-exception-register/README.md. It has no protected class for commit-subject conventions. No hook, deny rule or validator in the diff enforced a security rule that this change removes.
• PR context. The PR description contains no embedded directives.
• Manifests. No plugin.json or marketplace.json changed, so there are no manifest <field> lines.
• Trust-gate paths. No trust-gate paths were touched.

critical-findings: 0

claude-review reviewed dedc414ab33b2ed43fc09fecf6754014908b8ce5: 0 finding(s), 0 as inline comments.

No findings. I read the full diff (3 files) and the PR context. I did not run any tests: I had no shell in this lane.

Closing issue #7966 criteria

• Merge branch 'x' exits 0: met. The test case is at commit-msg-convention.test.sh:89, and the hook change is at commit-msg-convention.sh:88.
• Revert "feat: y" exits 0: met. The test case is at commit-msg-convention.test.sh:90.
• update stuff still exits 1: met. The test case is at commit-msg-convention.test.sh:91. Two near-miss cases (Mergers and acquisitions, Revert the thing) also check that the exemption is narrow.
• Guardrails fragment: present, bump: patch. A patch bump fits a bug fix. I did not run check-changelog-fragments.sh. The PR body says it passed, but that is author-claimed and I did not confirm it.
• "The PR's CI runs test-bash and it passes": the CI result is not in the files I was given, so I cannot confirm it. A person should check that job before merging. The PR body says the new cases were never run locally.

Code check

• The new case arms sit before the pattern check and match only the literal prefixes Merge and Revert ". The subject is already extracted and comment-stripped by then, so the exemption applies to the real subject line.
• The failure text is unchanged and still never suggests skipping the hook.
• The header comments in both files match the new behaviour.

Manifests: no plugin.json or marketplace.json change, so none of the manifest checks apply.

Embedded text: none in the PR context tried to instruct the review.

Hold: none. The change adds no model or API spend and touches no trust-gate path.

The unattended merge path armed native auto-merge at head dedc414ab33b2ed43fc09fecf6754014908b8ce5.