03-core-git-guards-block-and-redirect-on-commit-and-pushlisted

# Git Guards — Block & Redirect on Commit + Push (CORE, Tier-A) **Why:** Git correctness — no leaked secrets, no mega-files, right repo, right account, right branch, forward-only history, gates green, no credential popup — is too important to leave to a rule the AI can skip. These are physical `exit 1` gates that block the wrong action and print the fix. They ride the path of least resistance so the correct push is the easy one. **Where the machinery lives (source of truth):** hook internals + the installer are in the provisioning tree, NOT here — this skill is the behavioral map. Hook logic: `agent-provisioning-toolkit/git-hooks/` (`pre-commit`, `pre-push`). Installer: `agent-provisioning-toolkit/steps/install_git_guards.py`. It sets `git config --global core.hooksPath` to a `git-global-hooks` dir next to wherever the toolkit repo is cloned (macOS/Linux: `~/git-global-hooks`; Windows: the same idea under the user profile) — so EVERY repo on the machine is gated with nothing to remember per-repo, on any OS. The installer resolves the path; never hardcode it. ## KNOW THE RULES — DON'T JUST TRIP THE GATE (behavioral mirror) The gate is the backstop, NOT the plan. Operate so you never hit it: - **Always work inside an account root** — `~/work-your-org-io/<repo>` or `~/personal-<your-name>/<repo>` (the two OWNED-repo roots, rule 7; a repo the user does NOT own goes under `external/<owner>/<repo>` — see the external-repos section below). These are plain paths under the