APEX Commit

Every commit goes through the OMEGA flow. No exceptions, no --no-verify.

OMEGA Flow (5 Steps)

1. PURGE    — Clear build artifacts
2. AUDIT    — Run all verification gates
3. ATOMIC   — Stage only related files
4. SECURITY — Scan for secrets
5. RELEASE  — Commit with Conventional format

Step 1: PURGE

Clear stale artifacts before auditing:

# Web (Next.js / Vite)
rm -rf .next node_modules/.cache .turbo dist

# Flutter
flutter clean

Step 2: AUDIT — Verification Gates

All gates must pass before committing. A failing gate is a hard stop.

Run all gates:

pnpm typecheck && pnpm lint && pnpm test --run

Step 3: ATOMIC — Stage related files only

Stage only the files related to this commit's purpose. Never git add . in a single commit if the changes span multiple concerns.

# Correct: targeted staging
git add src/components/auth/ src/lib/session.ts

# Wrong: everything at once (breaks bisect, bloats PRs)
git add .

Each commit should answer: "If I revert this commit, what exactly is undone?" If the answer involves more than one concern, split into two commits.

Step 4: SECURITY — Secret scan

Before staging:

# Scan for secrets in staged files
git diff --cached | grep -E \
  "(sk-[a-zA-Z0-9]{20,}|pk_live_[a-zA-Z0-9]+|AKIA[0-9A-Z]{16}|ghp_[a-zA-Z0-9]{36}|xoxb-[0-9]+-[a-zA-Z0-9-]+)" \
  && echo "SECRET DETECTED — abort" && exit 1 \
  || echo "Secret scan: clean"

# Scan for RTL violations
git diff --cached -- "*.tsx" "*.jsx" | grep "^+" | \
  grep -E "\b(ml-|mr-|pl-|pr-|text-left|text-right)" | \
  grep -v "rtl-ok" \
  && echo "RTL VIOLATION — fix before committing" \
  || echo "RTL scan: clean"

Step 5: RELEASE — Conventional Commits

Commit message format:

<type>(<scope>): <imperative description>

[optional body — explain WHY, not WHAT]
[optional footer — Breaking changes, issue refs]

Type reference

Breaking changes: append ! to the type: feat!: remove deprecated API

Examples

# Feature
git commit -m "feat(auth): add magic link login flow"

# Bug fix with body
git commit -m "fix(dashboard): prevent double-submit on slow connections

Debounce was applied to the button but not the underlying mutation.
The mutation now tracks in-flight state and guards re-entry."

# Breaking change
git commit -m "feat!(api): rename /users endpoint to /accounts

BREAKING CHANGE: All clients must update base path from /users to /accounts.
Migration guide: docs/migration/v2.md"

Branch naming

Push rules

# Never push directly to main
# This must be enforced by branch protection, not just convention

# Before pushing any branch
git log origin/main..HEAD --oneline   # review what you're pushing
git diff origin/main...HEAD --stat    # review file scope

If the diff is unexpectedly large, stop and investigate before pushing.

PR format

## Summary
- What changed (1-3 bullets, imperative tense)

## Why
One paragraph explaining the motivation — link to issue or describe the problem.

## Changes
- `src/components/auth/` — new magic link components
- `src/lib/session.ts` — session token handling

## Test plan
- [ ] Unit tests added for session token validation
- [ ] E2E test covers the full magic link flow
- [ ] Tested locally in Chrome, Firefox, mobile viewport

## Checklist
- [ ] typecheck: 0 errors
- [ ] lint: 0 errors
- [ ] tests: all pass
- [ ] No console.log in production code
- [ ] No hardcoded secrets

Anti-patterns

• Never git commit --amend on pushed commits — rewrites public history.
• Never git push --force to main or protected branches — always blocked.
• Never --no-verify — if a hook fails, fix the underlying issue.
• Never commit generated files (.next/, dist/, build/) — add to .gitignore.
• Never mix formatting changes with logic changes in the same commit — makes review and bisect impossible.