Shared tasks: prek with a 7-day cooldown, shared .npmrc cooldown

.mise/tasks/refresh

@@ -13,4 +13,5 @@ mise upgrade --local
 git pull
 project_uv lock --upgrade
 project_uv sync --dev --group docs
-pre-commit autoupdate
+# 7-day cooldown on hook updates (policies/project_standards.md in rhizomatics/hq)
+prek autoupdate --cooldown-days 7

mise.toml

@@ -1,4 +1,4 @@
 [tools]
-pre-commit = "latest"
+prek = "latest"
 python = "3.14"
 uv = "latest"

pyproject.toml

@@ -11,3 +11,5 @@ docs = ["zensical>=0.0.72"]
 [tool.uv]
 package = false
 default-groups = ["docs"]
+# 7-day release cooldown (policies/project_standards.md in rhizomatics/hq)
+exclude-newer = "7 days"

scripts/sync-admin.sh

@@ -56,6 +56,11 @@ while IFS= read -r gitdir; do
       $check || { mkdir -p "$(dirname "$dest")"; cp "$tpl" "$dest"; }
     done
   fi
+  # npm repos share one .npmrc, which holds the release cooldown for npm install/update.
+  if [[ $eco == node ]] && ! cmp -s "$here/templates/node/npmrc" "$repo/.npmrc"; then
+    changes+=("update .npmrc")
+    $check || cp "$here/templates/node/npmrc" "$repo/.npmrc"
+  fi
   # The .github repo holds the shared labels.yml at its root, so .github/labels.yml is still legacy there.
   for f in "${legacy[@]}"; do
     [[ -e $repo/$f ]] || continue

templates/README.md

@@ -31,9 +31,10 @@ repo's `.mise/tasks/`, replacing the old `refresh-deps.sh` (which it removes):
 
 | Repos | Task | What it does |
 |---|---|---|
-| Python (`uv.lock`) | `mise run refresh` | Upgrades mise tools, pulls bot PRs, re-locks and syncs with `uv`, runs `pre-commit autoupdate` |
+| Python (`uv.lock`) | `mise run refresh` | Upgrades mise tools, pulls bot PRs, re-locks and syncs with `uv`, runs `prek autoupdate --cooldown-days 7` |
 | Python (`uv.lock`) | `mise run clean` | Removes build, test and lint caches and recreates an empty `.venv` |
-| Node (`package-lock.json`) | `mise run refresh` | Pulls bot PRs, runs `pre-commit autoupdate`, upgrades mise tools, runs `npm update` |
+| Node (`package-lock.json`) | `mise run refresh` | Pulls bot PRs, runs `prek autoupdate --cooldown-days 7`, upgrades mise tools, runs `npm update` |
+| Node (`package-lock.json`) | `.npmrc` (not a task) | `min-release-age=7`, so `npm install`/`npm update` skip versions under 7 days old; `@rhizomatics/*` is exempt |
 
 The Python `refresh` hides the user-level `~/.config/uv/uv.toml` from `uv` (`XDG_CONFIG_HOME=/dev/null`)
 so personal settings never reach a committed `uv.lock`, while the project's own `[tool.uv]` still applies.
@@ -42,6 +43,22 @@ A file task shadows a `mise.toml` task of the same name, so a repo that needs it
 (supernotify's `clean` also tears down its Docker preview) defines it in `mise.toml`, and
 `sync-admin.sh` then leaves the shared one out.
 
+## Cooldowns
+
+Every automatic update waits 7 days after a release (`policies/project_standards.md` in
+`rhizomatics/hq`), so a compromised or broken release has time to be pulled first:
+
+| Updater | Where the cooldown lives |
+|---|---|
+| Dependabot | `cooldown: default-days: 7` on each ecosystem |
+| uv | `exclude-newer = "7 days"` in `[tool.uv]`; per-package exceptions in `exclude-newer-package` |
+| npm | shared `.npmrc` (`min-release-age=7`) |
+| prek hooks | `prek autoupdate --cooldown-days 7` in the shared `refresh` task |
+
+Own packages may go to 0 days, and trusted, widely used ones (Home Assistant, astral) to 2.
+Repos use `prek` (from `mise.toml`) rather than `pre-commit`; it reads the same
+`.pre-commit-config.yaml`.
+
 ## Dependabot
 
 `dependabot.yml` can't be shared, so each repo has its own with a common shape per ecosystem:

templates/node/npmrc

@@ -0,0 +1,5 @@
+# Shared copy, kept in step by rhizomatics/.github scripts/sync-admin.sh: change it there, not here.
+# 7-day cooldown for npm install/update (policies/project_standards.md in rhizomatics/hq).
+# Rhizomatics' own packages are exempt.
+min-release-age=7
+min-release-age-exclude[]=@rhizomatics/*

templates/node/tasks/refresh

@@ -4,6 +4,7 @@
 set -euo pipefail
 
 git pull
-pre-commit autoupdate
+# 7-day cooldown on hook updates (policies/project_standards.md in rhizomatics/hq)
+prek autoupdate --cooldown-days 7
 mise upgrade --local
 npm update

templates/python/tasks/refresh

@@ -13,4 +13,5 @@ mise upgrade --local
 git pull
 project_uv lock --upgrade
 project_uv sync --dev --group docs
-pre-commit autoupdate
+# 7-day cooldown on hook updates (policies/project_standards.md in rhizomatics/hq)
+prek autoupdate --cooldown-days 7