Walkthrough: implementing a pre-commit hook that checks AI suggestions against your standards

In our ongoing efforts to establish reproducible and high-quality code generation workflows, I've observed a critical gap: the lack of automated, pre-merge validation for AI-generated code suggestions. While we meticulously benchmark database throughput and query latency, we often treat AI-assisted code as a black box, accepting it on faith. This is antithetical to our principles of measurement and standardization.

I propose a concrete, implementable pre-commit hook that acts as a "linting suite" for AI-suggested code blocks. The goal is not to reject all AI code, but to ensure it adheres to our team's established coding standards, security baselines, and dependency policies *before* it enters the codebase. This transforms a subjective review process into a reproducible, automated check.

The core of the hook is a Python script that leverages existing linting and analysis tools, triggered specifically on files or diffs containing markers of AI origin (e.g., specific tags in comments). Below is a foundational implementation.

```python
#!/usr/bin/env python3
"""
pre-commit-ai-standards.py
A pre-commit hook to run standards checks on AI-suggested code.
Detects files with common AI attribution comments and runs a targeted battery of linters.
"""

import subprocess
import sys
import os

# Patterns in source that suggest AI-origin (customize this list)
AI_INDICATOR_PATTERNS = [
"Generated by",
"AI-assisted",
"@assist",
"# AI_SUGGESTION"
]

def file_contains_ai_indicator(filepath):
"""Heuristic check if file contains markers of AI-generated code."""
try:
with open(filepath, 'r') as f:
content = f.read()
for pattern in AI_INDICATOR_PATTERNS:
if pattern in content:
return True
except Exception:
pass
return False

def run_linter(command, filepath):
"""Run a linter command and return success status."""
try:
result = subprocess.run(
command + [filepath],
capture_output=True,
text=True
)
if result.returncode != 0:
print(f"FAIL: {command[0]} on {filepath}")
print(result.stdout)
print(result.stderr)
return False
return True
except FileNotFoundError:
print(f"WARN: Linter {command[0]} not installed.")
return True # Skip if linter missing

def main():
staged_files = sys.argv[1:] # Files passed by pre-commit
all_passed = True

for file in staged_files:
if not file_contains_ai_indicator(file):
continue # Skip files without AI markers

print(f"n🔍 AI-assisted code detected in {file}. Running standards checks...")

# Define your linter battery. These must be installed in your environment.
linters = [
["black", "--check"], # Code formatting
["ruff", "check"], # Python style & errors
["bandit", "-ll"], # Security linting
["vulture"], # Dead code detection (useful for hallucinated functions)
]

for linter in linters:
if not run_linter(linter, file):
all_passed = False

if not all_passed:
print("n❌ AI standards check failed. Please address linter warnings before committing.")
sys.exit(1)
else:
print("n✅ All AI standards checks passed.")
sys.exit(0)

if __name__ == "__main__":
main()
```

To integrate this into your pre-commit framework (`.pre-commit-config.yaml`), add the following entry:

```yaml
repos:
- repo: local
hooks:
- id: ai-standards-check
name: AI-Assisted Code Standards
entry: python3 ./scripts/pre-commit-ai-standards.py
language: system
types: [python] # Extend to [python, javascript, ...] as needed
args: [--files]
```

Key considerations and benchmark-like metrics to track:

* **False Positive Rate:** Tune your `AI_INDICATOR_PATTERNS` to minimize human-written code being flagged. Start broad and narrow down.
* **Check Latency:** The hook should complete in under 2-3 seconds to not disrupt workflow. Profile your linter battery.
* **Critical Rules:** The hook should enforce non-negotiable standards (e.g., no hardcoded credentials, approved license headers). These are "fail fast" conditions.
* **Advisory Rules:** Warnings for style deviations can be logged but should not necessarily block commits, depending on team policy.

This approach provides a measurable, repeatable process. The next step is to gather empirical data on its efficacy: how many potential issues are caught pre-merge versus discovered in later review or, worse, in production. I am currently running a longitudinal study on our team's repositories and will share the latency and catch-rate statistics in a follow-up post.

-- bb42