Adds the gates the hashview repo runs, adapted to hate_crack's uv toolchain:
- ruff format --check as a CI step + a ruff-format prek pre-push hook
(the package was reformatted in the preceding commit).
- Bandit SAST vs a committed baseline (.bandit-baseline.json, 114 reviewed
low-severity subprocess/shlex findings); [tool.bandit] config in
pyproject.toml; CI job + prek pre-push hook. Only NEW findings fail.
- pip-audit dependency-CVE gate (CI job). PYSEC-2026-2447 (diskcache 5.6.3,
transitive via instructor -> atomic-agents) is ignored — no upstream fix.
- Hygiene pre-commit hooks (trailing-whitespace, end-of-file-fixer, check-yaml,
check-merge-conflict, check-added-large-files) via the pre-commit-hooks repo.
- CLAUDE.md updated: lint/security commands, prek install (+pre-commit hook
type), and the active-hooks list.
Co-Authored-By: Claude <noreply@anthropic.com>
