@bongos/core 1.19.6 → 1.19.7

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.6",
-  "core_contract": "1.19.6",
-  "source_commit": "ec82ce238fe1cf51269e6300752c294fcdff6a8d",
+  "core_version": "1.19.7",
+  "core_contract": "1.19.7",
+  "source_commit": "4c4a86f4d9e8987627774c5a8e5060f3f61b0bc0",
   "source_ref": "HEAD",
-  "built_at": "2026-08-08T20:35:28.636Z",
+  "built_at": "2026-08-08T20:39:12.129Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 284,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1202,
+    "functional_verbatim": 1203,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1507,
-  "tree_sha256": "a96a50569de6c81659dff0c6bc5efb47052af5b5efe9a7ad8d96c2205a9e5339",
+  "file_count": 1508,
+  "tree_sha256": "1ae72bc6a69eda4c6cf29ec3a5e9ba8598b43a5b73aba6abe44bbd7da45dfdbc",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -287,7 +287,7 @@
     {
       "path": ".gitattributes",
       "mode": "0000644",
-      "sha256": "b1d775aa60944df06acad586311295763956c8cc3a151c0426f83dcc48509b2b"
+      "sha256": "106e3a8a087cf1a9dd932513115d16c387cfeebea0e22ed269a672f95efdac1e"
     },
     {
       "path": "CLAUDE.md",
@@ -322,7 +322,7 @@
     {
       "path": "README.md",
       "mode": "0000644",
-      "sha256": "efd9807a539e2eb478a3a56f5280103cd92e1cf8de97fe995a6fbcb5cb7a4b49"
+      "sha256": "f0358ea7bfffc17c7f1e4ead3bb223117787ba6f88c1ae357150e4f6a59e70a8"
     },
     {
       "path": "bin/bongos.js",
@@ -627,7 +627,7 @@
     {
       "path": "docs/adr/0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md",
       "mode": "0000644",
-      "sha256": "5ca47d7e3e7ea7e4afeb45427c7d53aa3ae83cb4291fadaaca11cf2f85e278cf"
+      "sha256": "9feebaa2a6e1133f6eae91e3e8d9bf85fd1e9b3bc276fb862b9097f72fc57621"
     },
     {
       "path": "docs/adr/0044-mediterranean-palette-replacement.md",
@@ -1297,7 +1297,7 @@
     {
       "path": "docs/canonical-permissions.md",
       "mode": "0000644",
-      "sha256": "cecb0aba0f0276831422a82e42a8c8473479ad6a59dcb180e38795c91f22d6e2"
+      "sha256": "f57f118f5b863a82895129c70311a7c87e5424e22a793b82c637db2ee7e345a0"
     },
     {
       "path": "docs/design-contract.md",
@@ -3997,12 +3997,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "2579115bea6d4593a73a28da83fece764ba14bcd519ac1d6fd97ed44cff77fdd"
+      "sha256": "5dca6505b577478929f260ec88895fe954a8ad3dd4ceb3a065d21fa1edaa60e1"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "04e91b126a9662c0d91bdc0994e5fefe2a49310367b153f151b909de33067ac7"
+      "sha256": "e70c0d0d826a15558627693fdb4d75b18e6c418ec4f0e7d65bd7847c1a17a7bf"
     },
     {
       "path": "public-docs/index.html",
@@ -4772,7 +4772,7 @@
     {
       "path": "scripts/gds/hooks/pre-push.js",
       "mode": "0000644",
-      "sha256": "b1e3df447dfb41e2b826c68f3824c8c037baae7dd357e63b47335da834673116"
+      "sha256": "605b6551ca630222b671b74c08fa1b69d487614359fad327a93c2ac17e8a2021"
     },
     {
       "path": "scripts/gds/http-api-client.js",
@@ -4787,7 +4787,7 @@
     {
       "path": "scripts/gds/install-git-hooks.js",
       "mode": "0000644",
-      "sha256": "b5f64bf41bb2b83b2008cef0ce06f4be349060c607aab2825b60f596b418ae05"
+      "sha256": "668d97543e863394527bad2a629037bfc81eea2f8244f53eb5e79fd43f7485c0"
     },
     {
       "path": "scripts/gds/key-card.js",
@@ -5182,7 +5182,7 @@
     {
       "path": "scripts/gds/setup.js",
       "mode": "0000644",
-      "sha256": "2665eafc6ba5e37ffa6526f893aa967ddf656f383c4dd04601868e25c71b1939"
+      "sha256": "8e512a07ed885666722a216951dfad7f57fbfd92923bdf5079ce1c6f7b5c0abc"
     },
     {
       "path": "scripts/gds/shell.js",
@@ -5622,7 +5622,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "2edb31fa7cb85cba84a757cc80b9e0ef333166b4d21c23884637313ed7eb4e46"
+      "sha256": "c60cd1bedb3f71a544c913e8859082a392e2e96e17927cff8c6aa928805634a1"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -7034,6 +7034,11 @@
       "mode": "0000644",
       "sha256": "c9604d5184f2f1243c4bfab594e3f0e2c04060aadc2d726c923e72d38e276577"
     },
+    {
+      "path": "tests/pre_push_hook.mjs",
+      "mode": "0000644",
+      "sha256": "cdd47e5e709590d1f8bb604b9ad98b13857d0efc196c8ab63728f00f62b999b5"
+    },
     {
       "path": "tests/preflight_checks.mjs",
       "mode": "0000644",

package/.gitattributes

@@ -17,6 +17,7 @@
 *.sh           text eol=lf
 *.bash         text eol=lf
 .husky/pre-commit text eol=lf
+.husky/pre-push   text eol=lf
 
 # Node / Python sources: keep LF everywhere too. Node tolerates CRLF, but LF
 # keeps diffs clean and avoids surprises when these are sourced or piped.

package/README.md

@@ -48,7 +48,7 @@ When it finishes, open Claude Code and run `/builder-start` to see what tasks ar
 
 ## Secrets scanning
 
-We keep secrets (`.env` files, API keys, private keys) out of the repo with two layers. Both are **instance topology** — the git hook (`.husky/`) and CI (`.github/`) are provided when you stand up an instance and are not shipped in the portable core; the pattern below is the recommended posture:
+We keep secrets (`.env` files, API keys, private keys) out of the repo with two layers. Both are **instance topology** — the git hooks (`.husky/`) and CI (`.github/`) are excluded from the published core artifact, and a secrets pre-commit hook is an instance addition (nothing provisions one automatically). This repo tracks `.husky/pre-push` — the ADR 0043 permission gate, a separate wall from secrets scanning. The pattern below is the recommended posture:
 
 - **Pre-commit hook** (`.husky/pre-commit`) — scans your *staged* changes before each commit and aborts if it finds a secret. On an instance that ships `.husky/`, activate it **once per clone**:
 
@@ -56,7 +56,7 @@ We keep secrets (`.env` files, API keys, private keys) out of the repo with two
   node scripts/gds/install-git-hooks.js
   ```
 
-  Prefer that over setting `core.hooksPath` by hand: it no-ops cleanly on a checkout without a `.husky/` (the portable core), whereas pointing `core.hooksPath` at a directory that isn't there leaves git with a dangling hooks path and no gate. `node scripts/gds/doctor.js` reports which case you're in.
+  Prefer that over setting `core.hooksPath` by hand: it no-ops cleanly on a checkout without a `.husky/` (e.g. a scaffolded instance that hasn't added hooks), whereas pointing `core.hooksPath` at a directory that isn't there leaves git with a dangling hooks path and no gate. `node scripts/gds/doctor.js` reports which case you're in.
 
   It always runs a built-in guard (blocks `.env`, `*.pem`, credential files, obvious key patterns). If [TruffleHog](https://github.com/trufflesecurity/trufflehog) is installed (`brew install trufflehog` on macOS; `scoop install trufflehog` / `choco install trufflehog` or the GitHub release on Windows) it also runs a deep scan; if not, it warns and lets the commit through — CI is the real gate.
 

package/docs/adr/0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md

@@ -93,6 +93,44 @@ enforcement**, not a redundant second net. Option B (blocker
 Treat this as the freshness stamp: re-run the probes above before asserting the claim has changed —
 a plan upgrade or a new ruleset would flip it, and this section is what a future sweep should update.
 
+## G-2/G-17 resolution: Layer 1 delivered; the "path bug" refuted (2026-08-08, task 1002608)
+
+The 2026-08-06 rank choke-point map (`docs/governance/<redacted>.md` §6) filed
+two findings against Layer 1. Re-verified empirically before acting, per the map's own rule:
+
+**G-17 — "the hook could not work even if it were installed" — is REFUTED.** The claim was that
+`pre-push.js:30`'s `path.join(__dirname, '..', '..', '..', 'src', 'bongos', …)` resolves one
+directory *above* the repo root. It does not: `__dirname` is `<root>/scripts/gds/hooks`, and three
+`..` segments land exactly at `<root>` (hooks → gds → scripts → root). Verified live: the require
+resolves and loads (all 15 exports), and the hook fed a `refs/heads/main` line on stdin blocks with
+exit 1. The finding's fail-open claim is also inverted for this failure class: a module-scope
+`require` throw is **not** caught by the `run().catch` crash handler (it wraps `run()` only) — node
+would exit nonzero before any handler installs, and git **aborts** the push. Fail *closed*. The
+runtime crash handler does fail open **by design**, documented in place: Layer 1 is cooperative and
+bypassable (`--no-verify`) regardless, so bricking every push on an unrelated runtime bug buys no
+security — Layer 3 is the net.
+
+**G-2 — "no delivery path, and never did" — was real and is now fixed.** `.husky/` had never been
+tracked on any branch, so `install-git-hooks.js` (wired into `/builder-setup` since #863) always
+no-opped with `no-husky-dir`, and `pre-push.js`'s header claimed a `.git/hooks/` install that no
+code performed. The repo now tracks `.husky/pre-push`, a two-line wrapper exec'ing
+`scripts/gds/hooks/pre-push.js` — so the existing activation path (`core.hooksPath=.husky`, set
+per-clone by `/builder-setup` or a standalone `node scripts/gds/install-git-hooks.js`) finally has
+something to activate. This follows the `.github/` precedent from tasks 1002610–1002612: README
+calls both instance topology, and both stay excluded from the **published core artifact**
+(`publish-manifest.js` `PROTECTED_TOPOLOGY_EXCLUDE`, test-asserted) — but this repo is itself the
+live reference instance where the Builder 25 incident happened, so it carries its own walls.
+
+**Honest limits, unchanged and new:**
+- Activation is per-clone and best-effort. A clone that never runs `/builder-setup` or
+  `install-git-hooks.js` has no Layer 1; whether the operator's own clone is activated cannot be
+  settled from the repo.
+- Standalone instances scaffolded from the published core still receive no `.husky/` — README
+  §"Secrets scanning" says hooks are "provided when you stand up an instance," but no provisioning
+  code materializes them. Captured for the post-wave bug phase (idea inbox) rather than fixed here.
+- The layer table above stands: Layer 1 is still not a trust boundary; the post-push main audit —
+  since task 1002612 a CI job on every push to `main` — remains the authoritative layer.
+
 ## Notes
 
 We did **not** take immediate action against Builder 25 — Lars was overseeing the session and the change itself was a legitimate bug fix. The point of this ADR is the *mechanism*, not the person: the system must make the bypass hard and visible regardless of intent.

package/docs/canonical-permissions.md

@@ -260,7 +260,9 @@ for the probes. `main-audit.js` is therefore still the *authoritative* layer, no
   rank/authz machinery, the ship/grade/deploy pipeline, DB `migrations/`, `infra/`, and the
   trust-boundary docs. The protected set is the glob list in
   [`src/bongos/permission-path-check.js`](../src/bongos/permission-path-check.js) (source of truth).
-- **Nobody pushes `main` directly.** The pre-push hook (`.husky/pre-push`) blocks it; the graded
+- **Nobody pushes `main` directly.** The pre-push hook (`.husky/pre-push`, tracked in this repo and
+  activated per-clone by `/builder-setup` via `install-git-hooks.js` — inert on a clone that never
+  activated it; ADR 0043 §"G-2/G-17 resolution") blocks it; the graded
   pipeline pushes only via `scripts/gds/push-main.js` (which carries the `OTB_ALLOW_MAIN_PUSH`
   override). A raw push is caught and reverted by the **post-push main audit**
   (`scripts/gds/main-audit.js`) — nightly and as the `~/deploy.sh` deploy gate — which is the

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.6",
+  "version": "1.19.7",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.6",
+      "version": "1.19.7",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.6",
+  "version": "1.19.7",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/hooks/pre-push.js

@@ -1,8 +1,12 @@
 #!/usr/bin/env node
 // scripts/gds/hooks/pre-push.js — client-side push gate (SEC #863).
 //
-// Installed as .git/hooks/pre-push by scripts/gds/install-git-hooks.js (run from
-// /builder-setup). This is LAYER 1 of the #863 fix — fast, cooperative, blocks
+// Invoked via the tracked .husky/pre-push wrapper. Inert until a clone runs
+// scripts/gds/install-git-hooks.js (from /builder-setup), which points
+// core.hooksPath at .husky/ — activation is per-clone (task 1002608; ADR 0043
+// §"G-2/G-17 resolution"). The published core artifact excludes .husky/
+// (publish-manifest.js PROTECTED_TOPOLOGY_EXCLUDE) — instance topology.
+// This is LAYER 1 of the #863 fix — fast, cooperative, blocks
 // the honest builder before a bad push ever leaves the machine. It is NOT a
 // trust boundary on its own (a builder can `git push --no-verify` or delete the
 // hook); the authoritative net is the post-push main audit + the deploy-side

package/scripts/gds/install-git-hooks.js

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 // scripts/gds/install-git-hooks.js — activate the project's git hooks (SEC #863).
 //
-// The Off the Boats hooks are TRACKED, committed files under .husky/ (the same
-// pattern as .husky/pre-commit, the secrets guard). Git only runs them when the
-// clone has core.hooksPath pointed at .husky. The pre-commit hook documents
-// "Activate once per clone: git config core.hooksPath .husky" — easy to forget,
-// which means a builder could run with NO secret-scan AND NO push gate.
+// The hooks are TRACKED, committed files under .husky/ — this repo ships
+// .husky/pre-push (the ADR 0043 Layer 1 permission gate, task 1002608); an
+// instance may add more (e.g. a pre-commit secrets guard). Git only runs them
+// when the clone has core.hooksPath pointed at .husky — easy to forget, which
+// means a builder could run with NO push gate.
 //
 // This script makes activation automatic (called by /builder-setup). It does
 // NOT write any hook file — the hooks ship via git. It only ensures
-// core.hooksPath is set so .husky/pre-commit AND .husky/pre-push fire.
+// core.hooksPath is set so whatever hooks .husky/ tracks actually fire.
 //
 // Idempotent and cross-platform. Runnable standalone:
 //   node scripts/gds/install-git-hooks.js
@@ -68,6 +68,8 @@ function activate() {
   // clones pick it up on any re-run of this script.
   const mergeDriver = registerMergeDriver(root);
 
+  const hooks = fs.readdirSync(huskyDir).filter((f) => !f.startsWith('.') && !f.startsWith('_'));
+
   let current = '';
   try { current = git('config --get core.hooksPath'); } catch (_) { current = ''; }
 
@@ -77,13 +79,13 @@ function activate() {
   const points = configuredHooksDir();
   const alreadyHusky = current && points && path.basename(points) === '.husky';
   if (alreadyHusky) {
-    return { status: 'already-active', hooksPath: current, dir: points, mergeDriver };
+    return { status: 'already-active', hooksPath: current, dir: points, mergeDriver, hooks };
   }
 
   // Not set (or set elsewhere): activate the project hooks. Relative '.husky'
   // is husky-standard and resolves per-worktree.
   git('config core.hooksPath .husky');
-  return { status: 'activated', hooksPath: '.husky', dir: huskyDir, mergeDriver };
+  return { status: 'activated', hooksPath: '.husky', dir: huskyDir, mergeDriver, hooks };
 }
 
 if (require.main === module) {
@@ -93,10 +95,11 @@ if (require.main === module) {
       console.error(`⚠ ${r.message}`);
       process.exit(0);
     }
+    const live = (r.hooks && r.hooks.length) ? r.hooks.join(', ') : 'none tracked';
     if (r.status === 'already-active') {
-      console.log(`✓ git hooks already active (core.hooksPath=${r.hooksPath}); pre-commit + pre-push gates live`);
+      console.log(`✓ git hooks already active (core.hooksPath=${r.hooksPath}); live hooks: ${live}`);
     } else {
-      console.log(`✓ git hooks activated (core.hooksPath=.husky); pre-commit secrets guard + pre-push permission gate now run`);
+      console.log(`✓ git hooks activated (core.hooksPath=.husky); live hooks: ${live}`);
     }
     if (r.mergeDriver && r.mergeDriver.ok) {
       console.log(`✓ merge driver '${MERGE_DRIVER_NAME}' registered; generated-file conflicts (docs/repo-map.md, nested CLAUDE.md) auto-regenerate on merge`);

package/scripts/gds/setup.js

@@ -515,14 +515,16 @@ async function promptOnboardingConsent() {
       console.log(`Total credits: ${builder.total_credits}`);
       console.log(`Session saved to ${SESSION_PATH}`);
       // SEC #863: activate the project git hooks (core.hooksPath → .husky) so
-      // the pre-commit secrets guard AND the pre-push permission gate run. Best
-      // effort — an activation hiccup must never fail an otherwise-good setup;
-      // the post-push main audit is the fail-closed net regardless.
+      // the tracked hooks run — here that's the pre-push permission gate
+      // (task 1002608); an instance may track more. Best effort — an activation
+      // hiccup must never fail an otherwise-good setup; the post-push main
+      // audit is the fail-closed net regardless.
       try {
         const { activate } = require('./install-git-hooks');
         const r = activate();
-        if (r.status === 'activated') console.log('Git hooks activated (pre-commit secrets guard + pre-push permission gate)');
-        else if (r.status === 'already-active') console.log('Git hooks already active (pre-commit + pre-push gates)');
+        const live = (r.hooks && r.hooks.length) ? r.hooks.join(', ') : 'none tracked';
+        if (r.status === 'activated') console.log(`Git hooks activated (live hooks: ${live})`);
+        else if (r.status === 'already-active') console.log(`Git hooks already active (live hooks: ${live})`);
         else console.log(`Note: ${r.message}`);
       } catch (e) {
         console.log(`Note: could not activate git hooks (${e.message}); run: git config core.hooksPath .husky`);

package/src/module-api.js

@@ -439,8 +439,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.4 with no explicit bump. run 31276103393. (task 1002620)
 //   1.19.6 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.5 with no explicit bump. run 31277243929. (task 1002620)
+//   1.19.7 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.6 with no explicit bump. run 31277387539. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.6'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.7'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/pre_push_hook.mjs

@@ -0,0 +1,77 @@
+// tests/pre_push_hook.mjs — ADR 0043 Layer 1 delivery + behavior (task 1002608, G-2/G-17).
+//
+// Pins three facts the 2026-08-06 choke-point map litigated:
+//   1. G-17 refutation: pre-push.js's dependency path resolves INSIDE the repo
+//      (three `..` from scripts/gds/hooks/ is the root, not one above it).
+//   2. The hook actually blocks a direct push to refs/heads/main (exit 1),
+//      and allows a branch deletion (exit 0) — both offline-deterministic.
+//   3. G-2 fix: the tracked .husky/pre-push wrapper exists, execs the real
+//      gate, and is LF + executable in the git index (CRLF or mode 100644
+//      would silently kill the hook on Unix clones).
+//
+// DB-free, no network: the main-push block fires before any API call.
+// Run:  node --test tests/pre_push_hook.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const HOOK = path.join(ROOT, 'scripts', 'gds', 'hooks', 'pre-push.js');
+const WRAPPER = path.join(ROOT, '.husky', 'pre-push');
+const SHA = 'a'.repeat(40);
+const ZEROS = '0'.repeat(40);
+
+function runHook(stdinLine) {
+  return spawnSync(process.execPath, [HOOK, 'origin', 'https://example.invalid/repo.git'], {
+    cwd: ROOT,
+    input: stdinLine,
+    encoding: 'utf8',
+    env: { ...process.env, OTB_ALLOW_MAIN_PUSH: '' },
+  });
+}
+
+test('G-17 refuted: the line-30 dependency path resolves inside the repo and loads', () => {
+  const hooksDir = path.dirname(HOOK);
+  const resolved = path.join(hooksDir, '..', '..', '..', 'src', 'bongos', 'permission-path-check.js');
+  assert.equal(path.resolve(resolved), path.join(ROOT, 'src', 'bongos', 'permission-path-check.js'));
+  assert.ok(fs.existsSync(resolved), 'permission-path-check.js must exist where pre-push.js requires it');
+  const ppc = require(resolved);
+  assert.equal(typeof ppc.checkPermissionPaths, 'function');
+});
+
+test('hook blocks a direct push to refs/heads/main with exit 1', () => {
+  const r = runHook(`refs/heads/main ${SHA} refs/heads/main ${SHA}\n`);
+  assert.equal(r.status, 1, `expected exit 1, got ${r.status}; stderr: ${r.stderr}`);
+  assert.match(r.stderr, /push blocked/i);
+  assert.match(r.stderr, /Direct pushes to `main`/);
+});
+
+test('hook allows a branch deletion (all-zero local sha) with exit 0', () => {
+  const r = runHook(`refs/heads/some-branch ${ZEROS} refs/heads/some-branch ${SHA}\n`);
+  assert.equal(r.status, 0, `expected exit 0, got ${r.status}; stderr: ${r.stderr}`);
+});
+
+test('requiring the hook as a module neither reads stdin nor exits', () => {
+  const mod = require(HOOK);
+  assert.equal(typeof mod.run, 'function');
+});
+
+test('G-2 fixed: tracked .husky/pre-push wrapper execs the real gate', () => {
+  assert.ok(fs.existsSync(WRAPPER), '.husky/pre-push must be tracked (ADR 0043 Layer 1 delivery)');
+  const body = fs.readFileSync(WRAPPER, 'utf8');
+  assert.ok(body.startsWith('#!/bin/sh'), 'wrapper must start with a sh shebang');
+  assert.match(body, /scripts\/gds\/hooks\/pre-push\.js/, 'wrapper must invoke the real gate');
+  assert.ok(!body.includes('\r'), 'wrapper must be LF-only (CRLF breaks the shebang on Unix)');
+});
+
+test('wrapper is executable (mode 100755) in the git index', () => {
+  const r = spawnSync('git', ['ls-files', '-s', '--', '.husky/pre-push'], { cwd: ROOT, encoding: 'utf8' });
+  assert.equal(r.status, 0, `git ls-files failed: ${r.stderr}`);
+  assert.match(r.stdout, /^100755 /, `expected index mode 100755, got: ${r.stdout.trim() || '(untracked)'}`);
+});