[Tooling] Pre-commit hook to prevent commits to release/integration branches

[msarson]

Background

Branch-slip pattern observed twice in 2 days (2026-05-11 and 2026-05-12). Both times the slip was committing to version-0.9.7 (the integration branch) when work should have landed on a feature branch. Both recoveries succeeded via cherry-pick + reset-hard before push.

The current safeguard is human discipline — the sharpened branch-verify ritual. Discipline-based safeguards have predictable failure rates under cognitive load.

Proposed shape

Pre-commit hook that fails if the current branch is version-0.9.7 (or master / main / any other integration branch we want to protect) AND the diff includes work-in-progress feature commits.

Detection heuristic: if any source file outside an allowlist (CHANGELOG.md, package.json version bump on its own, release-tag-related files) is being committed to a protected branch, fail with an actionable error message guiding the user through the recovery.

Implementation lean

Husky — fits the existing JS toolchain; auto-installs for new clones; version-controlled at the project level.

Allowlist edges

• CHANGELOG.md edits on integration branch → FINE (audit-trail consolidation)
• Version bump in package.json → FINE (release-prep)
• Dev-environment edits (.gitignore, .vscode/launch.json) → FINE
• Anything in client/src/ or server/src/ → BLOCKED (feature work)

Estimate

~2-3 hours total (husky install + hook script + allowlist tuning + scenario testing + docs).

Relationship to release

NOT blocking 0.9.7. Discipline-aid infrastructure. Target 0.9.8 or 1.0.

Cross-reference

MultiTerminal task: 5d504de1

[msarson]

Implemented in PR #204 (merged to version-0.9.7): Husky-based protected-branch pre-commit guard with allowlist checks and actionable recovery messaging.