34-build.md:191-193 says the pick's record commit is made 'with hooks off'. pickcommit.go:18-21 and commands/build.md:216-219 say the repository's hooks and signing run (iss-2610111729399920, resolved without updating the brief).

Frontmatter

.abcd/work/issues/open/iss-2610252214338467-34-build-md-191-193-says-the-pick-s.md
open on GitHub ↗ · commit history ↗

mentions1

• iss-2610111729399920Several hardenings shipped in v0.13.4 switch a repository's own git settings off for abcd's commands, and need re-assessing against the security scope rule adopted on 2026-10-11 (principle abcd-fixes-what-it-adds: abcd never changes how a repository works on its own, and prevents an existing risk only where it can do so without such a change). Known instances: a sync's merge makes every configured merge driver git's built-in merge (gitutil.MergeDriverOverrides), so a repository's own lockfile or union-style driver is ignored on abcd's sync; the pick commit runs with commit.gpgsign=false and hooks off (gitutil.ExecPins via pickGit), so it is unsigned where the repository requires signed commits; the toplevel check refuses a checkout whose core.worktree names an ancestor, which refuses a deliberately configured layout. Reads that blank content filters (gitutil.FilterOverrides) change no repository behaviour and are likely fine.