git:20261020.bec061a to git:20261027.f0f1a5a

- > Gated interactive commit. A commit only lands if simplify → review → lint → targeted-test all pass; the gate writes `.commit-gate/attestation.json` bound to `sha256(git diff HEAD)`. The commit goes through `evolve ship --class manual`, which **hard-verifies that attestation at this repo's real commit chokepoint** — ship-gate forbids bare `git commit`, and ship commits internally, so this Go-side check (`go/internal/phases/ship/commitgate.go`) is the single enforcement point. This skill is the intelligent driver — the gate itself is `evolve commit-gate run` (Go; `go/internal/commitgate/`).

- Follow in order. **Do not edit any file between step 4 and step 5** — that would make the attestation stale and ship will refuse.

- 3. **Review chain** — invoke via the **Agent tool** on the staged diff. Apply every CRITICAL/HIGH finding, re-stage (`git add -A`), and re-run until clean. Record the names you actually ran. Two reviewers are required, except for a proven comment removal and a docs-only change (see the contract below). A docs-only change, where every changed path ends in `.md`, runs the `docs-review` skill instead:

- 4. **Scan for secrets, then run the gate**: first `"$CLAUDE_PROJECT_DIR/go/bin/evolve" scan secrets --staged`, then `"$CLAUDE_PROJECT_DIR/go/bin/evolve" commit-gate run --reviewers "<comma-list of what you ran>"`.

- - The scan is read-only and deterministic: it checks the staged diff's added lines and prints each finding as `<file>:<line>: <rule>: <masked match>` (raw secrets are never printed). **exit 0** → run the gate; **exit 1** → remove the secret, re-stage, return to step 3; **exit 2** → git failed (not a repo, bad revision); stop and report.

- - **exit 3** → a required tool is missing/could not be installed; surface the printed manual install command to the user and stop.

- 5. **Commit + push** via the sanctioned path (handles both, on the current branch):

- - `--class manual` re-stages (`git add -A`, a no-op after step 1), **verifies the commit-gate attestation matches the staged tree** (the Go-side hard gate), commits to the current branch, and pushes `origin/<branch>`.

- - `evolve ci watch --sha "$(git rev-parse HEAD)"` on main (a red files one fix-forward inbox item), or `evolve ci watch --pr <n>` on a PR branch (files nothing). Exit 0 = green, 1 = red (the output carries the `ci classify` verdict), 2 = the run could not be observed (gh failure or the `ci_watch.timeout_s` policy timeout).

- **A proven comment removal needs no reviewer.** The runner checks this itself. At least one changed Go file must be comment-only against `HEAD`, by the same check as `commentaudit verify`. Every other changed file must be a regular Markdown file under `docs/`. When both hold, pass `--reviewers ""`. The attestation records no reviewer and `review_waiver: "comment-only"`, so the commit carries a `Review-waived: comment-only` trailer instead of `Reviewed-by:`. A code or test change, a rename, a symlink, a deletion, a `testdata/` fixture still needs both reviewers. A docs-only change needs the docs review instead (above) ([code comments](../../docs/conventions/code-comments.md)).

- **A removed history comment must be recorded.** When the change removes a comment group that carries history (a cycle, wave, batch or round number, a date, a PR number, a SHA, an incident), the runner refuses it until the change adds the group to its package's page under `docs/history/code-comments/`. Run the command the refusal names, stage the pages it writes, and re-run the gate. The archive only grows: a change that deletes or rewrites an archive page (other than the generated `README.md` index) is refused, even when it is a waived comment removal.

- The attestation format (`.commit-gate/attestation.json` bound to `sha256(git diff HEAD)`) is self-contained. In **this** repo the gate is `evolve commit-gate run` (Go) and enforcement lives in `evolve ship --class manual` because ship-gate already forbids bare `git commit`. To vendor the gate into a repo with no ship-gate, add a thin PreToolUse hook that re-checks `.commit-gate/attestation.json` against `sha256(git diff HEAD)` on bare `git commit` — the attestation is just JSON, so the check needs no `evolve` binary even though producing it does.