diff --git a/TODO.md b/TODO.md
index 9a6ec82..7615374 100644
--- a/TODO.md
+++ b/TODO.md
@@ -44,7 +44,5 @@
 
 # Known hazards
 
-- Pre-push hook on the shared repo
-  Agents share the repo's `.git` across worktrees and run fully permissive, so they can push, check out other branches, delete snapshot refs, or run `git gc` or `git worktree prune`. Session guidance already forbids this; add a pre-push hook on the shared repo that blocks pushes not made by byre, and periodically verify that snapshot refs survive.
 - Consider moving large event payloads into blobs
   Stream-json is verbose and tool outputs are large, so the event log grows fast. SSE resume and scrubbing need efficient queries; storing large payloads as blobs is one option.