# A new PR check catches commits that skipped the local safety gate

Every code commit in this repo is supposed to pass through a local pre-commit gate that runs lint, tier checks, and writes a small audit record of the decision. That gate is wired up by husky, a tool that activates git hooks when dependencies are installed. We discovered (the hard way, across three build folders in one night) that folders created with raw git commands never get that wiring — so commits sail through with zero local checks and no audit record, and nothing anywhere notices. CI still re-runs the big checks on the pull request, but the gate's own protections (tier floors, deferral detection, the audit trail) silently never happened.

The root cause in the worktree-creation command is fixed separately. This change adds the structural backstop: a pull-request check that looks at what the PR changes. If it touches gate-scoped code (src, scripts, hooks, skills) it must ALSO carry the gate's audit record — the small decision file the gate stages into every commit it evaluates. A code PR with no record means the gate never ran for those commits, and the check fails with a message that names the likely cause (a worktree without hook wiring) and the exact fix (run `npm run prepare`, then re-commit). Docs-only PRs, bot PRs, and the automated release PR are unaffected, and PRs from before the audit-format change are accepted via their old-format record. Also fixes the `.gitignore` pattern so a symlinked `node_modules` can't be accidentally committed (a slip this very investigation made once).
