CONCERN-4 — Pin-bump cadence accountability for gitleaks

Post-merge follow-up from F-5 (#282) per Architect CONCERN-4 carry-forward (recurring maintenance).

Goal

Establish a tracked surface for gitleaks pin-bump cadence so the v8.30.1-pinned version in .pre-commit-config.yaml does not silently rot.

ADR-042 §Consequences documents the cadence policy:

Pin-bump cadence policy: bump on each gitleaks minor release with empirical re-verification — synthetic-fixture re-test per FR-013 (16-fixture rule-interaction matrix) before merging the bump.

This Issue gives that policy a recurring tracker.

Process

Each new gitleaks minor release (e.g., v8.31.0, v8.32.0, ...) opens a child Issue that:

1. Updates .pre-commit-config.yaml to the new minor release tag, then pre-commit autoupdate --freeze to pin the commit SHA
2. Runs bash tests/fixtures/gitleaks-rule-interaction/run.sh — must produce 16/16 (6 fire + 10 no-fire) PASS
3. Runs pre-commit run --all-files from a clean tachi clone — must produce zero findings (AC-4 / FR-002 baseline)
4. If either verification fails, investigates rule-ID renames / regex shifts / allow-list interactions per spec §Five-Whys-on-deviation
5. Updates .gitleaks.toml rule-ID assertion comments in fixture headers (per PM-PLAN-1) if upstream renames
6. Updates docs/architecture/02_ADRs/ADR-042-* §References with the bump entry
7. Updates docs/standards/PRECOMMIT_HOOKS.md §Known-Limitations if the new release changes any guarantee

Tasks (Issue lifecycle)

• Subscribe to gitleaks release notifications (gh api repos/gitleaks/gitleaks/releases/latest cron or RSS)
• On each minor release, open a child Issue titled chore(deps): bump gitleaks vX.Y.Z with this body referenced
• Verify + commit + re-pin within ~2 weeks of release (best-effort SLA, not contractual)

Why now

The F-5 PRECOMMIT_HOOKS.md §Known-Limitations + ADR-042 §Consequences both name the cadence policy, but without a tracked Issue the policy becomes folklore. This Issue is the single source of truth referenced by future child bumps.

References

• ADR-042: docs/architecture/02_ADRs/ADR-042-pre-commit-secret-scanning-default.md §Consequences
• Operator handbook: docs/standards/PRECOMMIT_HOOKS.md §Known-Limitations
• Fixture matrix: tests/fixtures/gitleaks-rule-interaction/run.sh
• Spec: specs/282-pre-commit-secret-scanning-defaults/spec.md Architect CONCERN-4

Metadata

• Origin: F-5 /aod.deliver T033 (Issue F-5 — Pre-commit Secret-Scanning Defaults #282 post-merge)
• Priority: P2 (recurring; security tool freshness)
• Type: maintenance (recurring)