cleanup phase 7

docs/rules/shared/git-and-gates.md

@@ -2,7 +2,7 @@
 
 What must pass before work is done, and what the repo refuses to let you commit.
 
-> Last verified: 2026-07-30 against commit `d3ec723`.
+> Last verified: 2026-08-02 against commit `51e86a1`.
 
 ---
 
@@ -63,40 +63,15 @@ A change that doesn't pass its own gate is **not done**, regardless of how compl
 
 ---
 
-## 3. The pre-commit secret scan
+## 3. No pre-commit secret scan (for now)
 
-Repo-managed hooks live in `.githooks/` (in version control, unlike `.git/hooks`). **Enable them once per
-clone:**
-
-```bash
-git config core.hooksPath .githooks
-```
-
-`pre-commit` is a fast, dependency-free backstop against a credential leaking into a file that shouldn't
-hold one. It scans **only staged additions**, so it is quick. It rejects a commit that stages:
-
-- the retired hardcoded admin password `qw123321`, anywhere;
-- private-key material or an AWS access-key id, anywhere;
-- the deployment's SQL Server host `87.107.152.16` **outside the declared config files**;
-- a **real** connection-string password in any `appsettings*.json` **outside the declared config files**
-  (elsewhere only the `SET_VIA_USER_SECRETS_OR_ENV` placeholder is allowed).
-
-### The declared-config allow-list
-
-The pre-launch demo deployment configures itself from committed files rather than a secret store (see
-[`DEPLOY.md`](../../../DEPLOY.md)), so a short allow-list is exempt from the last two checks:
-
-`appsettings.Development.json` · `docker-compose.yml` · `telegram-otp-bot/.env.example` · `DEPLOY.md`
-
-It is maintained in the `declared_config` function in the hook, and it is **the honest record of where
-this repo's secrets are**. **Shrink it, never grow it.** Once real users exist, those values must be
-rotated and moved out of git.
-
-### Limits
-
-This is the local first line of defence, **not** a replacement for a full scanner (gitleaks, trufflehog)
-in CI. Bypass a false positive with `git commit --no-verify` — sparingly, and only when you are certain
-the flagged line is not a secret.
+There is no git hook enforcing anything in this repo — `.githooks/` was removed in phase 7 as an
+MVP-stage call: this is a pre-launch demo project and the mechanical backstop wasn't worth the overhead
+yet. The underlying rule is unchanged — **never commit a real secret** — it's just unenforced by tooling.
+Root [CLAUDE.md](../../../CLAUDE.md) §6 already documents the repo's actual trade: config lives in
+committed files, including live credentials, until real users exist (see
+[DEPLOY.md](../../../DEPLOY.md) "Going to Production" for the rotation step that unblocks that). Revisit
+adding a hook — or a CI scanner (gitleaks, trufflehog) — if that trade changes before this one does.
 
 ---