Pre-Commit Guardian & SEC Rule 15c3-5

Decouple compliance limits from strategy source code. The Guardian pre-commit hook verifies that all binary compilation manifests match air-gapped, Ed25519-signed risk policies before code is committed to remote repositories.

1. Out-of-Band Policy Signing (Compliance Team)

The CRO and risk officers sign institutional risk limits independently using isolated compliance keys:

bath-admin sign-policy \
  --policy=./risk/statutory_limits.json \
  --key=/var/secure/compliance_ed25519.key \
  --out=./risk/policy_manifest.token

2. Pre-Commit Git Hook Installation

Install the zero-trust commit interceptor in your local git repository:

pce-guardian install --pre-commit --enforce-sec-15c3-5

3. Maker-Checker Compiler Abort Diagnostic

If strategy logic violates signed exposure boundaries or attempts to override limits, compilation immediately aborts:

[ERROR] [BATH-0201] Governance Verification Failure:
    -> File: `./src/alpha_routing.cpp:42`
    -> Invariant Conflict: Requested `notional_limit = 7500000_Q` exceeds signed cap `5000000_Q`.
    -> Policy Token Hash: [0x7f3a8b41...bc91] (Authored by: cro@firm.internal)
    -> COMPILATION TERMINATED: 0 bytes emitted.