unslop-guardlisted

# unslop-guard ## Overview Auditing once is a snapshot. This skill installs the two guardrails that keep a codebase from re-accumulating what the audit just cleared, and provides the pre-ship gate to run before a deploy. Both guardrails default to warning rather than blocking. A gate that blocks on style is a gate people delete, and a deleted gate protects nothing. ## Pre-ship gate Run the scan, then the gate. This is the only unslop command that exits non-zero, which is what makes it usable in a deploy script: ```bash python3 skills/unslop-audit/scripts/scan.py . --out .unslop/findings.json python3 skills/unslop-audit/scripts/gate.py .unslop/findings.json --fail-on P0 ``` `--fail-on` accepts `P0` (default), `P1`, `P2`, or `P3`. `--only S1,S2,S3,S4` narrows it to a specific set of checks. ## Install the pre-commit hook ```bash cp skills/unslop-guard/assets/pre-commit .git/hooks/pre-commit chmod +x .git/hooks/pre-commit ``` The hook blocks a commit **only** when a secret is about to be committed (`S1`-`S4`). Everything else prints as advice and the commit proceeds. Bypass with `git commit --no-verify`. The hook needs to find the scanner. It looks at `$UNSLOP_SCAN` first, then the default plugin install path. Tell the user which one applies to their setup rather than guessing. ## Install the CI workflow ```bash mkdir -p .github/workflows cp skills/unslop-guard/assets/unslop-audit.yml .github/workflows/ ``` The workflow runs on pull requests and pushes to `main`, f