[brujack]

Summary

• scripts/pre-push now loads ai-config's shared push-content gate for every push to master or main. This is PR4 of ai-config spec 2026-10-30-shared-push-content-gate-design.md (ADR-0091).
  • The canonical wiring block is pasted byte for byte.
  • The shebang is #!/usr/bin/env -S bash -p.
  • The hook's own loop reads ${_pcg_refs}.
• The hook had no tests. A new tests/pre_push.bats (16 tests, no network) runs in make test through a new test-hooks target, and in two new steps of CI's existing test job. auto-merge's needs: is unchanged, because test is already in it.

Changes

• scripts/pre-push:
  • The wiring block, pinned by sha256 d556979b… from ai-config 34cf3bee, and the bash -p shebang.
  • The loop reads ${_pcg_refs} behind a non-empty check.
  • The trigger gains ^scripts/, so a change to the hook or to scripts/*.py now runs make test.
  • A file-wide # shellcheck disable=SC2249,SC2310,SC2311, explained in a comment. This repo's .shellcheckrc sets enable=all, and the byte-identical block trips those three info-level checks. A directive placed just above the block does not reach its later commands: measured, 7 findings remain. Editing the block would break the pin.
• tests/pre_push.bats: a throwaway git repo per test, with HOME/XDG_CONFIG_HOME redirected and gh/make stubbed first on PATH. It covers:
  • each trigger alternative, and two negatives;
  • a new-branch push, and a docs-only new branch on top of origin/main;
  • a deletion push;
  • the existing fail-closed path for an unresolvable range;
  • the REPO_ROOT fallback, with the hook run from .git;
  • a main push the gate cannot load, and main on a later ref line;
  • stubbed awk and cat on PATH;
  • unreadable stdin, under a 30s process-group watchdog;
  • the shebang and the pinned hash;
  • make test-hooks itself, with the tools missing, both with and without CI.
• Makefile: test: lint test-hooks. test-hooks runs shellcheck on the suite at warning level, then bats; make lint already shellchecks the hook. A missing tool prints its remedy and skips locally, and fails under CI.
• .github/workflows/ci.yml: in the test job, Install bats (apt) and Run hook tests (make test-hooks). The pinned shellcheck install already precedes them.
• CLAUDE.md and README.md: the trigger-gap note, the pre-push line, the make test and make test-hooks entries, the CI table row, and the prerequisites. Also the plan.

Test Plan

• make test </dev/null at 4340578: lint and shellcheck OK, bats 16/16, nextest 1185/1185, pytest 197 passed.
• Each of these mutation controls turns the suite red:
  • each of the five trigger alternatives, dropped;
  • ^Cargo, unanchored;
  • the deletion continue, changed;
  • the all-zero branch, never taken;
  • the _diff_rc fail-closed branch, disabled;
  • the stdin refusal, changed to || :;
  • the loop here-string, removed;
  • the early exit, removed;
  • the make -C, removed;
  • the REPO_ROOT fallback, broken;
  • the merge-base, removed;
  • the Makefile CI check, removed;
  • the Makefile message accumulation, removed;
  • -n changed to -z on the _pcg_refs guard.
• After merge, run V1 on a throwaway clone, with only scripts/pre-push installed and pushing to a local bare remote. Expected: code to main is refused with [file rule R2], docs to main is permitted, and a feature push is permitted.

Risk

• A push to main now refuses when GitHub or gh auth is unavailable. Feature pushes make no network call.
• SC2249, SC2310 and SC2311 are now off for the whole hook, not only the block. Making the template clean under enable=all is the real fix, and is an ai-config Backlog row.

Code review

reviewed-sha: 4340578
diff-hash: a8f16b273038420e748789a7dc262d5d6e2e93f1695c003bddb45f9d642cd31f
reviewers: 5/5

The lenses read the diff at 6f768a1. Lenses 3 (history) and 4 (earlier PRs) ran inline:

• the hook's last change, fix(ci): gate all four tracked shell files, fix a fail-open hook #125, made it fail closed on an unresolvable range, and that path is kept and now pinned by a test;
• fix(ci): gate all four tracked shell files, fix a fail-open hook #125 has no comments or reviews.

Lens 2 found no bug.

Lens 5 found four stale docs, all fixed in 4340578:

• the CLAUDE.md make test line;
• the CI table row;
• the README make test line and prerequisites;
• the detached SC2034 comment.
  It also found the ai-config knowledge note on the trigger gap stale. That note is updated after merge, as an ai-config docs commit.

Lens 1 raised one finding, kept: the file-wide shellcheck disable also covers the hook's own code. The narrower form it suggested, a directive just above the block, was measured and leaves 7 findings. Fixing it needs the template made clean under enable=all, which is an ai-config Backlog row.

test-quality-review held on cycle 1 and passed on cycle 2 after 4340578. The session took the CLAUDE.md paths and the summary itself. Findings were not scored. The fix commit was verified by test-quality-review and by make test at 4340578, not by a new 5-lens round.

Required

Informational

Kept

• scripts/pre-push: a file-wide # shellcheck disable=SC2249,SC2310,SC2311 covers the hook's own logic too. Kept because the scoped alternative leaves 7 findings and the block is hash-pinned (lens 1).

RESOLVED: 4 fixed, 1 kept

Spec alignment

SKIP: the spec lives in ai-config, and the tooling reads only a spec in the same repo (operator decision, 2026-10-31). R13 as amended on 2026-10-31 is copied into the plan. The plan-time non-goal check found N1–N6 CLEAR.

🤖 Generated with Claude Code

https://claude.ai/code/session_01RMRWKJ7P5L99pNgDqK3B8t