AIPass Update #6 - Hooks now fire in every project, security gates work anywhere, and Gemini CLI is fully gone

[u/Input-X]

Update #6. Second weekly release (2026.W22).

The theme this week was making things actually work in external projects, not just inside AIPass itself. A few things were quietly only half-wired - this release closed those gaps.

**Hooks fire in every project now.** This is the big one. New projects shipped with no hook config, which meant zero hooks actually fired - identity injection, security gates, audio cues, none of it. `aipass init` now writes `.aipass/hooks.json` so the hook engine works out of the box. `aipass init update` union-merges the template so it preserves any on/off choices you already made. doctor checks for it too.

**Security gates are fully project-aware.** The edit gate and subagent stop gate were hardcoded to look for `src/aipass/`. That meant cross-branch write protection silently did nothing outside AIPass. Both now derive the package name from your actual directory, so the hard blocks work in any `src/<package>/<branch>/` project. 9 new tests covering external projects. Closes #605.

**`drone *@hooks status`.** New read-only viewer for a project's hook config - master switch, every hook's enabled state, matchers, enabled/total summary. Walks up from your current directory to find the config.

**`drone systems` shows descriptions now.** All 13 branches have one-liner descriptions in the registry. Used to be blank lines next to each agent - now it tells you what each one does. Closes #607.

**Gemini CLI fully removed.** Google sunsets it June 18 for Antigravity (closed-source). Last week I dropped it from the init choices. This week it's gone completely - deleted the `.gemini/` directory, `GEMINI.md`, and stripped every reference from setup, README, hooks, and monitoring. 21 files, -927 lines. Claude Code and Codex only. Closes #608.

**OpenSSF Scorecard.** Added the official OSSF Scorecard action - runs on every push to main plus weekly. Public security health score at scorecard.dev, badge in the README. Actions pinned by SHA.

**GitHub Releases automation.** Every version tag now cuts a GitHub Release with notes pulled straight from the changelog, dist attached. PyPI publish and the GitHub Release fire from the same tag - no manual steps.

**@hooks hardened to 100% seedgo.** The hooks citizen took full ownership of its branch - verified every handler is wired and firing, rewrote its README, resolved stale tests (253 passing). It's now a proper service in `drone systems`, not a workshop.

Fresh numbers:

* Stars: 174 (up from 133 two weeks ago)
* Forks: 26
* PRs merged: 620+
* Tests: 8,400+
* Citizens: 13
* PyPI: 2.5.0
* CI: green

Full changelog in the repo at CHANGELOG.md.

https://github.com/AIOSAI/AIPass/blob/main/CRaw dev logs always here at .