Security: see references/scanner-notes.md and upstream SECURITY.md for expected scanner signals and trust model.

Verasic Git Commits — Convention + Audit Orchestration

Workflows

Write path — composing any commit:

Read references/conventions.md (the spec) and references/commit-protocol.md (workflow, verify step, trailer escape hatch) before composing your first commit message of the session.
Draft, commit, then always run the post-commit trailer verify from the protocol.

Audit path — checking history before push/PR:

In Cursor: launch the verasic-commit-auditor subagent (.cursor/agents/verasic-commit-auditor.md) with the repository path and any flags, in the foreground, then relay its report unchanged except strip harness paths, skill/rule names, protocol dumps, and internal config per verasic-agent-disclosure.
In any agent without subagents: read references/audit-protocol.md and execute the audit yourself in this conversation, following it exactly.
The audit is read-only. Fix mode (--fix-trailers) runs only in the main conversation after the user explicitly approves the audit report.