diff --git a/.githooks/pre-commit b/.githooks/pre-commit
new file mode 100755
index 0000000..0ddeefc
--- /dev/null
+++ b/.githooks/pre-commit
@@ -0,0 +1,23 @@
+#!/bin/sh
+# gitflow pre-commit — generated by gitflow_init. Do not hand-edit.
+# Mirrors gitflow_protected_base (lib/gitflow.sh). Drift caught by T10.
+gd=$(git rev-parse --git-dir)
+br=$(git symbolic-ref --short -q HEAD 2>/dev/null)
+
+git rev-parse --verify -q HEAD >/dev/null 2>&1 || exit 0   # root commit — allow
+[ -f "$gd/MERGE_HEAD" ] && exit 0                          # merge in progress — allow
+
+case "$br" in
+  main|develop) ;;                        # protected — keep checking
+  *) exit 0 ;;                                              # working branch — allow
+esac
+
+# whitelist: all-staged-under-.claude/ (memory/doc/deploy helpers) — allow
+if [ -z "$(git diff --cached --name-only | grep -v '^\.claude/' | head -1)" ]; then
+  exit 0
+fi
+
+echo "gitflow pre-commit: BLOCKED — direct commit on '$br'." >&2
+echo "  Branch from the right base (feature/bugfix->develop, hotfix->main), or merge." >&2
+echo "  (.claude/** memory commits are exempt; --no-verify bypasses locally.)" >&2
+exit 1
diff --git a/.gitignore b/.gitignore
index 888c976..d40d5fb 100644
--- a/.gitignore
+++ b/.gitignore
@@ -15,3 +15,21 @@ Oldconfig/
 
 # Claude local settings (machine-specific)
 .claude/settings.local.json
+
+# ── gitflow standard socle (added by gitflow_init; additive, safe to edit) ──
+.env
+.env.*
+!.env.example
+.vscode/
+.idea/
+*.log
+.claude/*
+!.claude/memory/
+!.claude/tasks/
+!.claude/audits/
+!.claude/settings.json
+!.claude/deploy/
+.claude/agent-memory/
+.claude/gstack/
+.claude/deploy/PENDING.json
+.claude/deploy/NEXT.sh