@thebassclef/lite 0.1.3 → 1.0.0

package/substrate/.claude/hooks/pre-commit-gate.sh

@@ -1,451 +0,0 @@
-#!/bin/bash
-# tier: lite
-# install-class: project
-set -e
-
-# Observable failure trap — closes bassclef-upstream#1075 (silent-stderr class).
-# Under `set -e`, any command failure exits the shell without printing.
-# The harness reports "No stderr output" and the agent cannot self-diagnose.
-# This trap emits filename + line + exit code + failing command to stderr
-# BEFORE the shell exits, so the failure is observable.
-# Per .claude/rules/defensive-bash.md discipline 4 (extended for observable failure).
-trap '_ec=$?; if [ "$_ec" -ne 0 ]; then echo "pre-commit-gate.sh: FAIL at line $LINENO: exit $_ec (command: $BASH_COMMAND)" >&2; fi' ERR
-
-# Pre-Commit Gate — fires on Bash PreToolUse for git commit commands.
-# Requires visible verification evidence before committing.
-# Checks: feature branch, source files without tests, UI usability.
-
-INPUT=$(cat)
-# Malformed JSON → jq exits non-zero; fail-soft to empty COMMAND so the
-# next branch (non-commit skip) fires. Hardened under WU-2a per
-# bassclef#1101 + bassclef#1098 sufficiency rubric criterion 6
-# (stdin contract). Previously crashed harness commit calls on malformed
-# stdin (exit 5 from jq).
-COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // ""' 2>/dev/null || echo "")
-
-# Only fire on git commit commands
-if ! echo "$COMMAND" | grep -q 'git commit'; then
-  exit 0
-fi
-
-# Trace log
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-source "$SCRIPT_DIR/trace-helper.sh"
-trace_log "pre-commit" "git commit"
-
-# --- CCF-3 operator-path guard (bassclef#740) ---
-# Reject commits adding absolute paths matching /Users/<name> or /home/<name>
-# in non-exempt locations. Operator-specific paths must live in
-# .claude/settings.local.json (gitignored), not in shared substrate.
-# Per handoff spec from 2026-05-23 cold-adopter run (PR #735, F70).
-# Exempt: rules/hooks/skills/standards/docs/strategy/chronicle/scripts/tests
-# (places where the policy itself is documented or test fixtures live).
-# Override: SKIP_OPERATOR_PATHS=1 git commit  (logged via trace-helper)
-if [ "${SKIP_OPERATOR_PATHS:-0}" != "1" ]; then
-  STAGED_NONEXEMPT=$(git diff --cached --name-only --diff-filter=AM 2>/dev/null | \
-    grep -vE '^\.claude/(rules|hooks|skills|luminaries|agents)/' | \
-    grep -vE '^standards/' | \
-    grep -vE '^architecture/' | \
-    grep -vE '^design/' | \
-    grep -vE '^docs/' | \
-    grep -vE '^chronicle/' | \
-    grep -vE '^strategy/' | \
-    grep -vE '^scripts/tests/' || true)
-  if [ -n "$STAGED_NONEXEMPT" ]; then
-    LEAKED=""
-    while IFS= read -r f; do
-      [ -z "$f" ] && continue
-      [ ! -f "$f" ] && continue
-      MATCHES=$(grep -nE '/Users/[A-Za-z0-9_.-]+|/home/[A-Za-z0-9_.-]+' "$f" 2>/dev/null || true)
-      if [ -n "$MATCHES" ]; then
-        LEAKED="${LEAKED}
-  ${f}:
-${MATCHES}
-"
-      fi
-    done <<< "$STAGED_NONEXEMPT"
-    if [ -n "$LEAKED" ]; then
-      # Wrapped in { ...; } >&2 per bassclef-upstream#1229 cure so BLOCK
-      # message reaches the agent via Claude Code's PreToolUse error path.
-      # Matches sibling scrub-hook convention (pre-gh-pseudonym-scrub.sh
-      # L204-225, pre-gh-sibling-repo-scrub.sh L212-233).
-      {
-        echo ""
-        echo "============================================"
-        echo "BLOCKED: operator path in committed file (CCF-3)"
-        echo "============================================"
-        echo "$LEAKED"
-        echo ""
-        echo "Operator-specific paths (/Users/<name>, /home/<name>) must NOT ship"
-        echo "in shared substrate. Move to .claude/settings.local.json (gitignored)."
-        echo "Policy: standards/two-layer-config.md (bassclef#740)"
-        echo ""
-        echo "Override: SKIP_OPERATOR_PATHS=1 git commit  (logged, use sparingly)"
-        echo "Silence is not deferral — see .claude/rules/blocked-items.md"
-        echo "============================================"
-      } >&2
-      exit 2
-    fi
-  fi
-fi
-
-# --- Testing-tier enforcement (bassclef#1037) ---
-# Per-path tier check: Tier 0 BLOCKs when sibling test mtime did not advance
-# with the source. Tier 1 WARNs. Tier 2/3 silent. Allowlist grace baseline
-# at .claude/hooks/testing-tier-enforce-allowlist.txt covers existing untested
-# bassclef surfaces for 60d. Override: SKIP_TESTING_TIER_ENFORCE=1.
-if [ -x "$SCRIPT_DIR/testing-tier-enforce.sh" ]; then
-  if ! "$SCRIPT_DIR/testing-tier-enforce.sh"; then
-    # Hook BLOCKed with structured stderr message. Propagate exit.
-    exit 1
-  fi
-fi
-
-# --- Cold-adopter harness fast-path (bassclef-upstream#350, bet 25h WU-2) ---
-# When staged changes touch substrate-affecting paths per
-# .claude/rules/cold-adopter-harness-discipline.md § "When this rule fires",
-# run the cold-adopter harness in fast mode (structural-only) to catch
-# adopter-observable regressions at commit time. The PR-CI job (bet 25g WU-2)
-# remains the required PR-time enforcement; this hook is the operator-side
-# fast-fail layer per Saltzer-Schroeder complete mediation.
-#
-# Override: SKIP_COLD_ADOPTER_HARNESS=1 git commit (logged via trace-helper)
-if [ "${SKIP_COLD_ADOPTER_HARNESS:-0}" != "1" ]; then
-  # The 12-pattern matcher mirrors .claude/rules/cold-adopter-harness-discipline.md
-  # § "When this rule fires". Keep these patterns in sync; a future WU may
-  # centralize the list via a sourced library function.
-  STAGED_SUBSTRATE=$(git diff --cached --name-only --diff-filter=AM 2>/dev/null | grep -E \
-    -e '^\.claude/hooks/[^/]+\.sh$' \
-    -e '^\.claude/skills/[^/]+/SKILL\.md$' \
-    -e '^\.claude/rules/[^/]+\.md$' \
-    -e '^\.claude/agents/[^/]+\.md$' \
-    -e '^\.claude/luminaries/[^/]+\.md$' \
-    -e '^lib/[^/]+\.sh$' \
-    -e '^standards/[^/]+\.md$' \
-    -e '^standards/state-spine/schemas/[^/]+\.json$' \
-    -e '^presence/install/bassclef-sync\..*\.sh$' \
-    -e '^architecture/decisions/ADR-.*\.md$' \
-    -e '^\.github/workflows/bassclef-.*\.yml$' \
-    -e '^scripts/[^/]+\.sh$' \
-    || true)
-  if [ -n "$STAGED_SUBSTRATE" ]; then
-    # Default to scripts/cold-adopter-harness-sync.sh relative to this hook's
-    # location; tests override via BASSCLEF_HARNESS_PATH env var.
-    HARNESS_PATH="${BASSCLEF_HARNESS_PATH:-$SCRIPT_DIR/../../scripts/cold-adopter-harness-sync.sh}"
-    if [ -x "$HARNESS_PATH" ]; then
-      trace_log "pre-commit" "cold-adopter harness fast-path firing"
-      HARNESS_RC=0
-      bash "$HARNESS_PATH" --mode structural --target . >/dev/null 2>&1 || HARNESS_RC=$?
-      if [ "$HARNESS_RC" != "0" ]; then
-        # Wrapped in { ...; } >&2 per bassclef-upstream#1229 cure so BLOCK
-        # message reaches the agent via Claude Code's PreToolUse error path.
-        {
-          echo ""
-          echo "============================================"
-          echo "BLOCKED: cold-adopter harness fast-path"
-          echo "============================================"
-          echo "Substrate-affecting paths staged:"
-          echo "$STAGED_SUBSTRATE" | sed 's/^/   /'
-          echo ""
-          echo "Cold-adopter harness exited with code $HARNESS_RC."
-          echo ""
-          echo "Run for diagnostic output:"
-          echo "   bash scripts/cold-adopter-harness-sync.sh --mode structural --target ."
-          echo ""
-          echo "Override (logged via trace-helper):"
-          echo "   SKIP_COLD_ADOPTER_HARNESS=1 git commit"
-          echo ""
-          echo "Discipline: .claude/rules/cold-adopter-harness-discipline.md"
-          echo "Standard:   \`standards/cold-adopter-harness.md\` (standard tier)"
-          echo "Silence is not deferral (see .claude/rules/blocked-items.md)."
-          echo "============================================"
-        } >&2
-        exit 2
-      fi
-    fi
-  fi
-fi
-
-# --- Lead-lens sign-off 3-marker gate (bet 24a Step 2b; closes #836) ---
-# Substrate-affecting paths staged? Require three markers before commit:
-#   state/markers/pre-mortem/<branch-slug>.marker
-#   state/markers/luminary/<branch-slug>.marker (with 'lead:' field)
-#   state/markers/lead-lens-signoff/<branch-slug>.marker
-# Discipline lives in .claude/rules/loop-discipline.md Step 0.5 + 2a + 5.5.
-# Override: SKIP_LEAD_LENS_SIGNOFF=1 git commit (logged via trace-helper)
-if [ "${SKIP_LEAD_LENS_SIGNOFF:-0}" != "1" ]; then
-  # Reuse the substrate-affecting matcher shape from cold-adopter fast-path.
-  STAGED_SUBSTRATE_LL=$(git diff --cached --name-only --diff-filter=AM 2>/dev/null | grep -E \
-    -e '^\.claude/hooks/[^/]+\.sh$' \
-    -e '^\.claude/skills/[^/]+/SKILL\.md$' \
-    -e '^\.claude/rules/[^/]+\.md$' \
-    -e '^\.claude/agents/[^/]+\.md$' \
-    -e '^\.claude/luminaries/[^/]+\.md$' \
-    -e '^lib/[^/]+\.sh$' \
-    -e '^standards/[^/]+\.md$' \
-    -e '^standards/state-spine/schemas/[^/]+\.json$' \
-    -e '^presence/install/bassclef-sync\..*\.sh$' \
-    -e '^architecture/decisions/ADR-.*\.md$' \
-    -e '^\.github/workflows/bassclef-.*\.yml$' \
-    -e '^scripts/[^/]+\.sh$' \
-    || true)
-  if [ -n "$STAGED_SUBSTRATE_LL" ]; then
-    LL_BRANCH_SLUG=$(git branch --show-current 2>/dev/null | tr '/' '-')
-    PREM_M="state/markers/pre-mortem/${LL_BRANCH_SLUG}.marker"
-    LUM_M="state/markers/luminary/${LL_BRANCH_SLUG}.marker"
-    SIGN_M="state/markers/lead-lens-signoff/${LL_BRANCH_SLUG}.marker"
-
-    LL_MISSING=""
-    if [ ! -f "$PREM_M" ]; then
-      LL_MISSING="${LL_MISSING}  - pre-mortem marker missing at $PREM_M\n"
-    fi
-    if [ ! -f "$LUM_M" ]; then
-      LL_MISSING="${LL_MISSING}  - luminary marker missing at $LUM_M\n"
-    elif ! grep -qE '^[[:space:]]*-[[:space:]]*lead[^a-zA-Z0-9_]' "$LUM_M"; then
-      # Accept: "- lead:", "- lead (goal-level):", "- lead luminary:", "- lead-luminary:"
-      # Reject: "- leader:" (word-boundary check), "- date:", any line without "lead" after dash
-      LL_MISSING="${LL_MISSING}  - luminary marker at $LUM_M missing lead field (expected line starting with dash lead followed by colon or modifier)\n"
-    fi
-    if [ ! -f "$SIGN_M" ]; then
-      LL_MISSING="${LL_MISSING}  - lead-lens sign-off marker missing at $SIGN_M\n"
-    fi
-
-    if [ -n "$LL_MISSING" ]; then
-      trace_log "pre-commit" "lead-lens 3-marker gate BLOCKED"
-      # Wrapped in { ...; } >&2 per bassclef-upstream#1229 cure so BLOCK
-      # message reaches the agent via Claude Code's PreToolUse error path.
-      # Prior to cure: this exact block fired 3 times in ~1 week (08-12a,
-      # 08-12d, 08-15c); agent saw "No stderr output" and bypassed via
-      # python subprocess, masking the actual discipline miss.
-      {
-        echo ""
-        echo "============================================"
-        echo "BLOCKED: lead-lens sign-off 3-marker gate (bet 24a / #836)"
-        echo "============================================"
-        echo "Substrate-affecting paths staged:"
-        echo "$STAGED_SUBSTRATE_LL" | sed 's/^/   /'
-        echo ""
-        echo "Missing:"
-        echo -e "$LL_MISSING"
-        echo "Discipline: .claude/rules/loop-discipline.md Step 0.5 + Step 2a + Step 5.5"
-        echo ""
-        echo "Cure — touch each missing marker with body content per marker-enrichment-discipline:"
-        echo "   mkdir -p state/markers/pre-mortem state/markers/luminary state/markers/lead-lens-signoff"
-        echo "   # write body content per rule Step 0.5 + 2a + 5.5"
-        echo ""
-        echo "Override (logged via trace-helper):"
-        echo "   SKIP_LEAD_LENS_SIGNOFF=1 git commit"
-        echo ""
-        echo "Silence is not deferral — see .claude/rules/blocked-items.md"
-        echo "============================================"
-      } >&2
-      exit 2
-    fi
-  fi
-fi
-
-# --- Feature branch enforcement ---
-CURRENT_BRANCH=$(git branch --show-current 2>/dev/null || echo "unknown")
-WARNINGS=""
-if [ "$CURRENT_BRANCH" = "main" ] || [ "$CURRENT_BRANCH" = "master" ]; then
-  WARNINGS="${WARNINGS}COMMITTING DIRECTLY TO MAIN — use a feature branch and PR instead.\n"
-fi
-
-# --- Check staged source files for matching test files ---
-STAGED_SOURCE_FILES=$(git diff --cached --name-only --diff-filter=AM -- 'src/lib/*.ts' 'src/agents/*.ts' 'src/app/api/**/*.ts' 2>/dev/null || true)
-if [ -n "$STAGED_SOURCE_FILES" ]; then
-  while IFS= read -r srcfile; do
-    basename=$(basename "$srcfile" .ts)
-    case "$basename" in
-      prisma|redis|queue|auth|langfuse|secrets|index) continue ;;
-    esac
-    if echo "$srcfile" | grep -q 'src/app/api/'; then
-      if [ ! -f "src/__tests__/api-routes.test.ts" ] && [ ! -f "src/__tests__/${basename}.test.ts" ]; then
-        WARNINGS="${WARNINGS}API ROUTE WITHOUT TEST: ${srcfile}\n"
-      fi
-    elif [ ! -f "src/__tests__/${basename}.test.ts" ]; then
-      WARNINGS="${WARNINGS}SOURCE FILE WITHOUT TEST: ${srcfile} → expected src/__tests__/${basename}.test.ts\n"
-    fi
-  done <<< "$STAGED_SOURCE_FILES"
-fi
-
-# --- /verify evidence check (MUST gate) ---
-# Emit BLOCKED: /verify when source files are staged without verify evidence.
-# Checks both /tmp (desktop) and state/markers/verify/ (ephemeral-safe).
-# Per bassclef#342: markers relocated from .claude/verify-markers/ to
-# state/markers/verify/ (rulebook-vs-log drawer separation).
-# blocked-items.md rule requires resolve-or-explicit-defer.
-STAGED_SOURCE=$(git diff --cached --name-only --diff-filter=AM -- 'src/**/*.ts' 'src/**/*.tsx' 'src/**/*.js' 'scripts/**/*.ts' 2>/dev/null | head -5)
-if [ -n "$STAGED_SOURCE" ]; then
-  BRANCH_SLUG=$(git branch --show-current 2>/dev/null | tr '/' '-')
-  VERIFY_MARKER_TMP="/tmp/claude-verify-${BRANCH_SLUG}"
-  VERIFY_MARKER_GIT="state/markers/verify/${BRANCH_SLUG}.marker"
-  VERIFY_RECENT=0
-  NOW=$(date +%s)
-
-  # Check desktop marker
-  if [ -f "$VERIFY_MARKER_TMP" ]; then
-    AGE=$(( NOW - $(stat -f %m "$VERIFY_MARKER_TMP" 2>/dev/null || stat -c %Y "$VERIFY_MARKER_TMP" 2>/dev/null || echo 0) ))
-    [ "$AGE" -lt 300 ] && VERIFY_RECENT=1
-  fi
-
-  # Check ephemeral-safe (git-tracked) marker
-  if [ "$VERIFY_RECENT" -eq 0 ] && [ -f "$VERIFY_MARKER_GIT" ]; then
-    AGE=$(( NOW - $(stat -f %m "$VERIFY_MARKER_GIT" 2>/dev/null || stat -c %Y "$VERIFY_MARKER_GIT" 2>/dev/null || echo 0) ))
-    [ "$AGE" -lt 300 ] && VERIFY_RECENT=1
-  fi
-
-  if [ "$VERIFY_RECENT" -eq 0 ]; then
-    WARNINGS="${WARNINGS}BLOCKED: /verify — source files staged without recent verify evidence.\n"
-    WARNINGS="${WARNINGS}   Run /verify BEFORE committing, or explicitly defer with rationale.\n"
-    WARNINGS="${WARNINGS}   Silence is not deferral (see .claude/rules/blocked-items.md).\n"
-    WARNINGS="${WARNINGS}   Checked: $VERIFY_MARKER_TMP and $VERIFY_MARKER_GIT (5-min freshness).\n"
-  fi
-fi
-
-# --- Reserved skill names check (collision with Claude Code built-ins) ---
-# See .claude/rules/reserved-skill-names.md + standards/reserved-skill-names.md
-if [ "${SKIP_RESERVED_NAMES:-0}" != "1" ]; then
-  STAGED_NEW_SKILLS=$(git diff --cached --name-only --diff-filter=A -- '.claude/skills/*/SKILL.md' 2>/dev/null || true)
-  if [ -n "$STAGED_NEW_SKILLS" ]; then
-    # Extract reserved names from the standards table (Name column values inside backticks)
-    RESERVED_LIST=""
-    if [ -f "standards/reserved-skill-names.md" ]; then
-      RESERVED_LIST=$(grep -oE '`[a-z][a-z0-9-]+`' standards/reserved-skill-names.md | tr -d '`' | sort -u)
-    fi
-    if [ -n "$RESERVED_LIST" ]; then
-      while IFS= read -r skill_path; do
-        skill_name=$(echo "$skill_path" | sed -n 's|\.claude/skills/\([^/]*\)/SKILL\.md|\1|p')
-        if [ -n "$skill_name" ] && echo "$RESERVED_LIST" | grep -qx "$skill_name"; then
-          WARNINGS="${WARNINGS}BLOCKED: reserved skill name — \`$skill_name\` collides with a Claude Code built-in.\n"
-          WARNINGS="${WARNINGS}   See standards/reserved-skill-names.md for the list.\n"
-          WARNINGS="${WARNINGS}   Rename the skill directory, OR override with SKIP_RESERVED_NAMES=1 git commit.\n"
-          WARNINGS="${WARNINGS}   Silence is not deferral (see .claude/rules/blocked-items.md).\n"
-        fi
-      done <<< "$STAGED_NEW_SKILLS"
-    fi
-  fi
-fi
-
-# --- Bassclef evolution check: methodology/config changes being committed ---
-# Catches .claude/ changes AND settings/config changes that may be global
-STAGED_CLAUDE=$(git diff --cached --name-only -- '.claude/skills/*' '.claude/rules/*' '.claude/hooks/*' '.claude/agents/*' 2>/dev/null | grep -v 'SESSION_LOCK\|LAST_SAVE' | head -5)
-STAGED_CONFIG=$(git diff --cached --name-only -- 'settings.json' '.claude/settings.json' '*/settings.json' 'package.json' '.eslintrc*' 'tsconfig*.json' '.prettierrc*' '.env.example' 2>/dev/null | head -5)
-
-if [ -n "$STAGED_CLAUDE" ] || [ -n "$STAGED_CONFIG" ]; then
-  ALL_METHOD_FILES="${STAGED_CLAUDE}${STAGED_CONFIG}"
-  WARNINGS="${WARNINGS}BASSCLEF EVOLUTION CHECK — is this local or global?\n"
-  if [ -n "$STAGED_CLAUDE" ]; then
-    WARNINGS="${WARNINGS}   Substrate: $(echo "$STAGED_CLAUDE" | tr '\n' ', ')\n"
-  fi
-  if [ -n "$STAGED_CONFIG" ]; then
-    WARNINGS="${WARNINGS}   Config:    $(echo "$STAGED_CONFIG" | tr '\n' ', ')\n"
-  fi
-  WARNINGS="${WARNINGS}   If this applies to ANY project → run /promote before committing.\n"
-  WARNINGS="${WARNINGS}   If app-specific → proceed. If unsure → promote (cheaper to reject later).\n"
-fi
-
-# --- Chronicle Gate Evidence enforcement (MUST gate, bassclef#298) ---
-# Chronicles are the authoritative input for the 5-session gate-compliance
-# counter. A chronicle without "## Gate Evidence" reads as "no data" in the
-# counter, silencing the compliance signal (the failure mode that motivated
-# this gate). Block commits to chronicle/*.md or docs/chronicle/*.md that
-# lack the section. Override: SKIP_CHRONICLE_GATE_EVIDENCE=1 git commit.
-if [ "${SKIP_CHRONICLE_GATE_EVIDENCE:-0}" != "1" ]; then
-  STAGED_CHRONICLES=$(git diff --cached --name-only --diff-filter=AM -- 'chronicle/*.md' 'docs/chronicle/*.md' 2>/dev/null || true)
-  # Source spine accessor library when available — preferred frontmatter
-  # check route per state-spine-contract.md. Graceful fallback for repos
-  # pre-spine-v0.
-  if [ -f "lib/state.sh" ]; then
-    # shellcheck source=/dev/null
-    source "lib/state.sh" 2>/dev/null || true
-  fi
-  if [ -n "$STAGED_CHRONICLES" ]; then
-    while IFS= read -r chronicle_path; do
-      [ -z "$chronicle_path" ] && continue
-      [ ! -f "$chronicle_path" ] && continue
-      # Two acceptance paths (transitional during bassclef#298 schema rollout):
-      # 1. Frontmatter `gates_fired` populated (future-default; spine schema)
-      # 2. Markdown body section `## Gate Evidence` (legacy; current chronicles)
-      HAS_EVIDENCE=0
-      if command -v state_chronicle_gate_evidence >/dev/null 2>&1; then
-        chronicle_id=$(basename "$chronicle_path" .md)
-        gates_json=$(state_chronicle_gate_evidence "$chronicle_id" 2>/dev/null || echo "[]")
-        if [ -n "$gates_json" ] && [ "$gates_json" != "[]" ] && [ "$gates_json" != "null" ]; then
-          HAS_EVIDENCE=1
-        fi
-      fi
-      # Accept either "## Gate Evidence" or "## Gate evidence" (both forms exist historically)
-      if [ "$HAS_EVIDENCE" = "0" ] && grep -qiE "^## Gate (E|e)vidence" "$chronicle_path"; then
-        HAS_EVIDENCE=1
-      fi
-      if [ "$HAS_EVIDENCE" = "0" ]; then
-        WARNINGS="${WARNINGS}BLOCKED: chronicle missing Gate Evidence — \`${chronicle_path}\`\n"
-        WARNINGS="${WARNINGS}   Required: frontmatter \`gates_fired\` array OR \"## Gate Evidence\" body section.\n"
-        WARNINGS="${WARNINGS}   Template: templates/chronicle-template.md\n"
-        WARNINGS="${WARNINGS}   Standard: standards/sdlc-compliance.md §\"Gate Evidence Format\"\n"
-        WARNINGS="${WARNINGS}   Override: SKIP_CHRONICLE_GATE_EVIDENCE=1 git commit (logged).\n"
-        WARNINGS="${WARNINGS}   Silence is not deferral (see .claude/rules/blocked-items.md).\n"
-      fi
-    done <<< "$STAGED_CHRONICLES"
-  fi
-fi
-
-# --- UI visual review enforcement (MUST gate) ---
-STAGED_UI=$(git diff --cached --name-only -- 'src/app/**/page.tsx' 'src/components/**/*.tsx' '*.css' '*.scss' 2>/dev/null | head -5)
-if [ -n "$STAGED_UI" ]; then
-  # Check for visual review evidence
-  TODAY=$(date +%Y-%m-%d)
-  VISUAL_REVIEWS=$(git diff --cached --name-only -- 'docs/visual-reviews/*.md' 2>/dev/null || true)
-  RECENT_REVIEWS=$(find docs/visual-reviews/ -name "${TODAY}*" -type f 2>/dev/null | head -1)
-  if [ -z "$VISUAL_REVIEWS" ] && [ -z "$RECENT_REVIEWS" ]; then
-    WARNINGS="${WARNINGS}VISUAL REVIEW REQUIRED — UI change detected but no visual review report found.\n"
-    WARNINGS="${WARNINGS}   Run /visual-review on every page touched BEFORE committing.\n"
-    WARNINGS="${WARNINGS}   Report goes to: docs/visual-reviews/${TODAY}-{page-name}.md\n"
-    WARNINGS="${WARNINGS}   This is a MUST gate for UI changes. See /verify.\n"
-  fi
-  WARNINGS="${WARNINGS}UI CHANGE — usability checklist:\n"
-  WARNINGS="${WARNINGS}   Role check | Scanning distance | Jargon | Attribution | Accessibility\n"
-fi
-
-# --- Output warnings if any ---
-if [ -n "$WARNINGS" ]; then
-  echo ""
-  echo "============================================"
-  echo "TESTING CHECKS"
-  echo "============================================"
-  echo -e "$WARNINGS"
-  echo "These are WARNINGs — address before merging."
-  echo "============================================"
-  echo ""
-fi
-
-cat <<'GATE'
-============================================
-PRE-COMMIT GATE — MANDATORY BEFORE COMMITTING
-============================================
-
-STOP. Your response MUST contain a visible verification section.
-
-## Post-Build Verification (EACH task, not batched)
-- Change type: [which row applies]
-- Verification performed: [exact command(s) and output summary]
-- Tests: [file + count, or "no testable logic"]
-- Build: [passes / fails]
-- Result: [pass/fail — if fail, do not commit]
-
-| Change type                        | Minimum verification                              |
-|------------------------------------|----------------------------------------------------|
-| Pure function (scoring, parsing)   | Unit test passes for that function                 |
-| Worker / agent / queue             | Boot the worker + process at least one real job    |
-| API route                          | Hit the endpoint, verify response                  |
-| Schema migration                   | Verify column exists, Prisma client regenerated    |
-| Middleware / auth                  | Protected routes AND existing routes still work    |
-| Docs / config only                 | N/A — state "docs/config only"                     |
-
-New pure function or utility? → Write test BEFORE committing.
-"Will add tests later" is never acceptable.
-============================================
-GATE
-
-exit 0