Pre-Commit Audit — File Size, Anonymity, Secrets

Three-pass safety scan before commit. Blocks pain-points: oversized commits (1.3GB parquet incident), CCS-style anonymity breaches, leaked credentials. Each pass is a hard gate; user OKs proceed.

Hard Rules

Existential — block proceed

1. Size pass blocks anything >10MB unless gitignored OR user explicitly approves. Threshold matches block-large-files.sh hook for consistency.
2. Anonymity pass runs only on paper-relevant paths: paper-*/, *.tex, *.bib, *.md inside paper directories. Scope is data-driven — we don't false-flag README authorship.
3. Secrets pass uses an entropy heuristic + known-prefix list. No regex-only matching that misses high-entropy keys. Block on confirmed secret; warn on suspicious-but-uncertain.
4. All four passes run on the same file set (default: staged for commit). Don't mix staged-only size check with all-files anonymity check.
5. The Unicode pass is the one pass that is always in scope, including infra-only commits. It is identity-blind — it reads codepoints, never names — so it cannot false-flag authorship the way the anonymity pass can.

Format — catch in review

6. Output a single consolidated table (file × pass × verdict) — not four separate reports.
7. Severity tiers: BLOCK (must fix), WARN (proceed with confirm), OK.
8. Always show the file path and line number when flagging — make it copy-paste-fixable.