The trust layer · adopted by every platform in the stack

One policy. Three enforcement points. Zero drift.

Verifier packages the portfolio's cross-cutting guarantees as small, self-contained pieces every platform adopts verbatim: one attribution policy enforced at the local hooks and in CI, secret scanning wired into the pre-commit hook estate-wide, and conformity scaffolding that proves itself on every push — with a drift check that fails CI the moment any vendored copy rots.

Adopt it Read the policy

$ git clone https://github.com/innotelinc/verifier.git && cd verifier && bash scripts/setup.sh

1attribution policy, shared verbatim

3enforcement points: commit-msg, pre-commit, CI

18sibling repos under the drift check

self-testCI runs the guard's failure paths

Small pieces, adopted verbatim.

Every guarantee ships as a file you vendor, not a service you depend on — so it works offline, in CI, and on every contributor's machine.

Attribution guard

One guard-lib loaded by commit-msg, pre-commit, and the CI workflow — the rules can never drift between local and CI.

Secret scanning at the hook

secret-scan.py + a pre-commit shim in every repo: credential-shaped staged lines block the commit before it is created.

Conformity scaffolding

The repository structure, guard workflows, and landing-page layout used across the portfolio — kept runnable and self-checking.

Drift enforcement

portfolio-drift.yml fails CI when any sibling's vendored copy differs from the canonical one here.

Where the guarantees fire.

The attribution policy: no one but the owner may ever be credited. The secret gate: nothing credential-shaped gets committed. Both fire at three points.

commit-msg hooklocalblocks foreign attribution trailers before the commit is written

pre-commit hooklocalscans staged added lines — attribution + secret-shape findings block

attribution-guard CIevery pushcommit messages, PR text, and every added line, on GitHub's runners

portfolio-drift CInightlyfails when any vendored copy in 18 sibling repos differs from canonical

Adopt it in one command.

Setup installs the hooks for the clone, runs the guard self-test that forces its failure paths, and proves the gate fires before you write a line.

scripts/setup.sh

Installs hooks via git config core.hooksPath .githooks and runs the self-test.

guard_selftest

Forces the guard's rejection paths — foreign trailers, AI credits, forbidden staged diffs.

docs/attribution-policy.md

The full policy text, including the allowed exceptions and what is not attribution.

# install + prove the gate fires
$ bash scripts/setup.sh
>> hooks installed (core.hooksPath=.githooks)
>> guard_selftest: 6/6 failure paths verified
$ git commit -m "docs: add walkthrough"
# a staged API key blocks the commit instead:
secret-scan: 1 finding(s) — API_KEY sk************56