25 pre-existing masking findings on main fail the pre-push gate, forcing --no-verify for every contributor

[theagenticguy]

Problem

The masking-findings gate fails on pristine main with 25 pre-existing findings (up from 15 when the #763 work was briefed). Because the gate runs pre-push, every contributor must push with --no-verify to land anything — which also skips every other pre-push check, so the gate's growth is silently eroding the whole hook.

Evidence

• Reproduced on a clean checkout of main (no branch changes applied): 25 findings.
• PR docs(cost): document every max_budget_usd surface and reconcile the Blueprint gap #763 shipped with --no-verify for this gate only; no nosemgrep suppressions were added, so the findings remain visible.
• The count grew 15 → 25 between the docs(cost): document every max_budget_usd surface and reconcile the Blueprint gap #763 brief and merge, so the backlog is actively accumulating.

Suggested resolution

1. Triage the 25 findings on main: fix the real ones, suppress false positives with justified nosemgrep annotations.
2. Once main is clean, the gate becomes meaningful again and --no-verify stops being the default workflow.
3. Consider a baseline/ratchet mechanism (fail only on new findings) if a full cleanup can't land soon, so the gate blocks regressions without blocking unrelated work.

Origin

Found during PR #763 — see the merge-guidance comment: #763 (comment)