chore(docs): keep internal references out of docs and commit messages (LAB-8003)

.pre-commit-config.yaml

@@ -0,0 +1,26 @@
+# Pre-commit hooks. Install once per clone: prek install (Python pre-commit works too).
+default_install_hook_types: [pre-commit, commit-msg]
+
+repos:
+  # Keeps internal references (ticket ids, secret-store paths, internal hosts and process
+  # names) out of user-facing docs and commit messages. The patterns are generic on purpose:
+  # a list of specific internal names would itself disclose them.
+  # Scope rule: https://docs.cachekit.io/contributing/#what-belongs-in-these-docs
+  - repo: local
+    hooks:
+      - id: no-internal-references
+        name: No internal references in docs
+        language: pygrep
+        entry: 'LAB-[0-9]+|op://|\.ts\.net|(?i:\bk3s\b[\s-]*(?:cluster|node|host))|dev\.cachekit\.io|\bStage [0-9]|\bAC-[0-9]|github\.com/cachekit(?![\w-])'
+        files: ^((packages|crates)/[^/]+/)?README[^/]*$|^docs/
+        types: [text]
+        stages: [pre-commit]
+      - id: no-internal-references-commit-msg
+        name: No internal references in commit message
+        language: pygrep
+        # Same patterns. git hands this hook the raw message, so it reads only down to the scissors
+        # line (`git commit -v` puts the staged diff below it) and skips "#" comment lines plus
+        # "Merge" and 'Revert "' subjects, which quote branch names and earlier subjects.
+        entry: '\A(?:(?!# -{24} >8 -{24}$)[^\n]*\n)*?(?!#|Merge |Revert ")[^\n]*?(?:LAB-[0-9]+|op://|\.ts\.net|(?i:\bk3s\b[\s-]*(?:cluster|node|host))|dev\.cachekit\.io|\bStage [0-9]|\bAC-[0-9]|github\.com/cachekit(?![\w-]))'
+        args: [--multiline]
+        stages: [commit-msg]

README.md

@@ -385,7 +385,7 @@ ByteStorage envelope vectors from
 both sets must decode to the exact payload bytes, while re-encode
 byte-identity is asserted against the set matching this crate's current
 writer encoding — msgpack `bin`, since the protocol 1.1 `serde_bytes`
-writer flip (LAB-866; `checksum` deliberately stays array-of-ints per the
+writer flip (`checksum` deliberately stays array-of-ints per the
 protocol's normative scope exclusion). Legacy envelopes remain readable
 forever.
 `tests/dual_decode.rs` proves both reader shapes accept both encodings,
@@ -416,6 +416,13 @@ This crate requires **Rust 1.85** or later (Edition 2024).
 
 ---
 
+## Contributing
+
+User-facing docs in this repository follow CacheKit's shared rule on what belongs in them:
+[What belongs in these docs](https://docs.cachekit.io/contributing/#what-belongs-in-these-docs).
+`prek install` (or `pre-commit install`) sets up hooks that reject internal references in README
+files, `docs/` and commit messages.
+
 ## License
 
 MIT License — see [LICENSE](LICENSE) for details.