claude-dev-env 2.3.0 → 2.4.0

package/hooks/blocking/test_volatile_path_in_post_blocker.py

@@ -41,7 +41,7 @@ def test_scan_detects_job_scratch_path_forward_slash() -> None:
 
 
 def test_scan_detects_worktree_path() -> None:
-    text = r"edited .claude\worktrees\feature\file.py"
+    text = r"edited C:\Users\me\.claude\worktrees\feature\file.py"
     assert scan_text_for_volatile_marker(text) == ".claude/worktrees/"
 
 
@@ -71,6 +71,103 @@ def test_scan_clean_body_returns_none() -> None:
     assert scan_text_for_volatile_marker(text) is None
 
 
+def test_scan_bare_backticked_worktree_mention_is_allowed() -> None:
+    text = "the `.claude/worktrees/` prefix sits in ALL_TOOLING_STATE_PREFIXES"
+    assert scan_text_for_volatile_marker(text) is None
+
+
+def test_scan_bare_start_of_text_worktree_mention_is_allowed() -> None:
+    text = ".claude/worktrees/ entries are skipped by the manifest"
+    assert scan_text_for_volatile_marker(text) is None
+
+
+def test_scan_windows_absolute_worktree_path_is_detected() -> None:
+    text = r"C:\Users\me\.claude\worktrees\wt-1\notes.md"
+    assert scan_text_for_volatile_marker(text) == ".claude/worktrees/"
+
+
+def test_scan_home_anchored_worktree_path_is_detected() -> None:
+    text = "~/.claude/worktrees/wt-2/file.py"
+    assert scan_text_for_volatile_marker(text) == ".claude/worktrees/"
+
+
+def test_scan_posix_absolute_job_scratch_path_is_detected() -> None:
+    text = "/home/me/.claude-editor/jobs/j1/log.txt"
+    assert scan_text_for_volatile_marker(text) == ".claude-editor/jobs/"
+
+
+def test_scan_bare_parenthesized_job_scratch_mention_is_allowed() -> None:
+    text = "(.claude-editor/jobs/) as a directory name in prose"
+    assert scan_text_for_volatile_marker(text) is None
+
+
+def test_scan_bare_mention_before_anchored_path_is_detected() -> None:
+    text = (
+        ".claude/worktrees/ is the manifest key; the live path is "
+        r"C:\Users\me\.claude\worktrees\wt-1\notes.md"
+    )
+    assert scan_text_for_volatile_marker(text) == ".claude/worktrees/"
+
+
+def test_scan_unchanged_bare_markers_still_detected() -> None:
+    assert scan_text_for_volatile_marker(r"saved to %TEMP%\x") == "%temp%"
+    assert scan_text_for_volatile_marker("log at /tmp/x") == "/tmp/"
+    assert (
+        scan_text_for_volatile_marker(r"C:\Users\x\AppData\Local\Temp\y")
+        == "appdata/local/temp"
+    )
+
+
+def test_scan_space_prefixed_relative_worktree_path_is_detected() -> None:
+    text = "see .claude/worktrees/wt-1/notes.md"
+    assert scan_text_for_volatile_marker(text) == ".claude/worktrees/"
+
+
+def test_scan_cd_relative_worktree_path_is_detected() -> None:
+    text = "cd .claude/worktrees/wt-199 && pytest"
+    assert scan_text_for_volatile_marker(text) == ".claude/worktrees/"
+
+
+def test_scan_start_of_text_relative_worktree_path_is_detected() -> None:
+    text = ".claude/worktrees/wt-1/notes.md"
+    assert scan_text_for_volatile_marker(text) == ".claude/worktrees/"
+
+
+def test_scan_markdown_link_relative_worktree_target_is_detected() -> None:
+    text = "[notes](.claude/worktrees/wt-1/notes.md)"
+    assert scan_text_for_volatile_marker(text) == ".claude/worktrees/"
+
+
+def test_scan_space_prefixed_relative_job_scratch_path_is_detected() -> None:
+    text = "see .claude-editor/jobs/j1/log.txt"
+    assert scan_text_for_volatile_marker(text) == ".claude-editor/jobs/"
+
+
+def test_scan_backslash_relative_worktree_path_is_detected() -> None:
+    text = r"see .claude\worktrees\wt-1\notes.md"
+    assert scan_text_for_volatile_marker(text) == ".claude/worktrees/"
+
+
+def test_scan_prose_child_token_after_marker_is_detected() -> None:
+    text = "the .claude/worktrees/wt-name pattern"
+    assert scan_text_for_volatile_marker(text) == ".claude/worktrees/"
+
+
+def test_scan_relative_worktree_path_with_hyphen_child_is_detected() -> None:
+    text = "see .claude/worktrees/-scratch/notes.md"
+    assert scan_text_for_volatile_marker(text) == ".claude/worktrees/"
+
+
+def test_scan_placeholder_child_segment_is_allowed() -> None:
+    text = "worktrees live under `.claude/worktrees/<name>`"
+    assert scan_text_for_volatile_marker(text) is None
+
+
+def test_scan_sentence_final_marker_period_is_allowed() -> None:
+    text = "the constant is `.claude/worktrees/`. Next."
+    assert scan_text_for_volatile_marker(text) is None
+
+
 def test_gh_comment_with_job_scratch_path_is_blocked() -> None:
     command = (
         'gh pr comment 669 --body "Contact sheet at '
@@ -147,7 +244,7 @@ def test_mcp_issue_comment_body_blocked() -> None:
 
 
 def test_mcp_review_comment_param_blocked() -> None:
-    tool_input: dict[str, object] = {"comment": r"see .claude\worktrees\x\file"}
+    tool_input: dict[str, object] = {"comment": r"see C:\Users\me\.claude\worktrees\x\file"}
     assert _body_names_volatile_path(
         "mcp__plugin_github_github__add_reply_to_pull_request_comment", tool_input
     )
@@ -177,6 +274,21 @@ def test_extract_gh_post_body_texts_returns_inline_and_file(tmp_path: pathlib.Pa
     assert "file body text" in all_texts
 
 
+def test_gh_issue_edit_quoting_bare_constant_is_allowed(tmp_path: pathlib.Path) -> None:
+    body_file = tmp_path / "issue_body.md"
+    body_file.write_text(
+        "The manifest skips these tooling-state prefixes:\n"
+        '    ".claude/worktrees/",\n'
+        '    ".claude-editor/jobs/",\n'
+        "Neither is a machine-local path.",
+        encoding="utf-8",
+    )
+    command = f"gh issue edit 134 --body-file {body_file}"
+    all_body_texts = extract_gh_post_body_texts(command)
+    assert all_body_texts
+    assert hook_module._first_volatile_marker(all_body_texts) is None
+
+
 def test_hook_subprocess_denies_volatile_gh_comment() -> None:
     payload = {
         "tool_name": "Bash",

package/hooks/blocking/verification_verdict_store.py

@@ -390,12 +390,36 @@ def verdict_directory() -> Path:
     return Path.home() / CLAUDE_HOME_DIRECTORY_NAME / VERDICT_DIRECTORY_NAME
 
 
+def root_key_for_repo(repo_root: str) -> str:
+    """Derive the shared path-key that names a work tree's store file.
+
+    ::
+
+        root_key_for_repo("/repo")  == root_key_for_repo("/repo/sub")   (same tree)
+        root_key_for_repo("/Repo")  == root_key_for_repo("/repo")        (case-folded)
+
+    The path is resolved, forward-slashed, and lowercased before hashing, so a
+    subdirectory of a work tree keys to the same file as its root and case
+    differences fold together. Both the verdict store and the code-review stamp
+    store key their per-work-tree files by this one derivation, so the two never
+    drift and an existing verdict file still resolves.
+
+    Args:
+        repo_root: The repository top-level directory.
+
+    Returns:
+        The lowercased hex path-key, truncated to ``ROOT_KEY_HEX_LENGTH`` chars.
+    """
+    normalized_root = str(Path(repo_root).resolve()).replace("\\", "/").lower()
+    return hashlib.sha256(normalized_root.encode("utf-8")).hexdigest()[:ROOT_KEY_HEX_LENGTH]
+
+
 def verdict_path_for_repo(repo_root: str) -> Path:
     """Derive the verdict file path for a repository work tree.
 
     Verdicts live outside the repository (under the user's Claude home) so
-    no repo accumulates untracked files, keyed by a hash of the normalized
-    work-tree path so every worktree gets its own verdict.
+    no repo accumulates untracked files, keyed by the shared
+    ``root_key_for_repo`` derivation so every worktree gets its own verdict.
 
     Args:
         repo_root: The repository top-level directory.
@@ -403,9 +427,7 @@ def verdict_path_for_repo(repo_root: str) -> Path:
     Returns:
         The verdict file path for this work tree.
     """
-    normalized_root = str(Path(repo_root).resolve()).replace("\\", "/").lower()
-    root_key = hashlib.sha256(normalized_root.encode("utf-8")).hexdigest()[:ROOT_KEY_HEX_LENGTH]
-    return verdict_directory() / f"{root_key}.json"
+    return verdict_directory() / f"{root_key_for_repo(repo_root)}.json"
 
 
 def load_valid_verdict(repo_root: str, expected_manifest_sha256: str) -> dict | None:

package/hooks/blocking/verified_commit_gate_parts/gated_invocations.py

@@ -81,14 +81,15 @@ def _resolved_option_value(
     return value_after_option(all_following_tokens, option_index)
 
 
-def gated_invocation_directory(all_following_tokens: list[str]) -> tuple[bool, str | None]:
+def gated_invocation_directory(
+    all_following_tokens: list[str],
+    all_gated_subcommands: frozenset[str] = GATED_GIT_SUBCOMMANDS,
+) -> tuple[bool, str | None]:
     """Walk the quote-stripped tokens after a ``git`` word to its subcommand.
 
-    ``git stash push`` is not gated ("push" is an argument); ``git commit -m
-    x`` is gated ("commit" sits in subcommand position).
-
-    Returns:
-        Whether the subcommand is gated, and its ``-C``/``--work-tree`` directory.
+    Args:
+        all_following_tokens: Quote-stripped tokens after the ``git`` word.
+        all_gated_subcommands: Subcommand names that gate; defaults to commit+push.
     """
     repo_directory: str | None = None
     work_tree_directory: str | None = None
@@ -108,7 +109,7 @@ def gated_invocation_directory(all_following_tokens: list[str]) -> tuple[bool, s
         if each_token.startswith("-"):
             token_index += 1
             continue
-        return each_token.lower() in GATED_GIT_SUBCOMMANDS, repo_directory or work_tree_directory
+        return each_token.lower() in all_gated_subcommands, repo_directory or work_tree_directory
     return False, repo_directory or work_tree_directory
 
 
@@ -167,11 +168,16 @@ def _apply_directory_change(
 
 
 def _target_directory_for_match(
-    command_text: str, git_word_match: re.Match[str], active_directory: str
+    command_text: str,
+    git_word_match: re.Match[str],
+    active_directory: str,
+    all_gated_subcommands: frozenset[str],
 ) -> str | None:
     """Resolve the gated directory for one ``git`` word match, or None."""
     all_following_tokens = _following_tokens(command_text, git_word_match.end())
-    is_gated, flagged_directory = gated_invocation_directory(all_following_tokens)
+    is_gated, flagged_directory = gated_invocation_directory(
+        all_following_tokens, all_gated_subcommands
+    )
     if not is_gated:
         return None
     if flagged_directory is None:
@@ -179,18 +185,22 @@ def _target_directory_for_match(
     return resolve_against(active_directory, flagged_directory)
 
 
-def gated_repo_directories(command_text: str, fallback_directory: str) -> list[str]:
-    """Collect the directories of every git commit/push found in a command.
+def gated_repo_directories(
+    command_text: str,
+    fallback_directory: str,
+    all_gated_subcommands: frozenset[str] = GATED_GIT_SUBCOMMANDS,
+) -> list[str]:
+    """Collect the directories of every gated git call found in a command.
 
     Args:
         command_text: The raw command string from the tool payload.
-        fallback_directory: The session working directory, used as the
-            active directory until a directory-change verb changes it and
-            when the git call carries no ``-C`` flag.
+        fallback_directory: The session working directory, the active directory
+            until a directory-change verb or a ``-C`` flag overrides it.
+        all_gated_subcommands: Subcommand names that gate; defaults to commit+push.
 
     Returns:
-        One directory per detected commit/push invocation, in order; empty
-        when the command carries no gated git verb.
+        One directory per detected gated invocation, in order; empty when the
+        command carries no gated git verb.
     """
     command_text = collapse_line_continuations(command_text)
     active_directory = fallback_directory
@@ -199,7 +209,9 @@ def gated_repo_directories(command_text: str, fallback_directory: str) -> list[s
         if each_match.group().lower().strip("\"'") in DIRECTORY_CHANGE_VERBS:
             active_directory = _apply_directory_change(command_text, each_match, active_directory)
             continue
-        target_directory = _target_directory_for_match(command_text, each_match, active_directory)
+        target_directory = _target_directory_for_match(
+            command_text, each_match, active_directory, all_gated_subcommands
+        )
         if target_directory is not None:
             target_directories.append(target_directory)
     return target_directories

package/hooks/blocking/verified_commit_gate_parts/tests/test_gated_invocations.py

@@ -59,3 +59,38 @@ def test_gated_repo_directories_gates_an_empty_work_tree_against_the_session() -
     assert gated_repo_directories("git --work-tree= commit -m x", "/session") == [
         os.path.join("/session", "")
     ]
+
+
+def test_default_gated_subcommands_gates_both_commit_and_push() -> None:
+    assert gated_repo_directories("git commit -m x", "/session") == ["/session"]
+    assert gated_repo_directories("git push", "/session") == ["/session"]
+
+
+def test_push_only_subcommands_gate_push_but_not_commit() -> None:
+    push_only = frozenset({"push"})
+    assert gated_invocation_directory(["push"], push_only)[0] is True
+    assert gated_invocation_directory(["commit", "-m", "x"], push_only)[0] is False
+
+
+def test_commit_only_subcommands_gate_commit_but_not_push() -> None:
+    commit_only = frozenset({"commit"})
+    assert gated_invocation_directory(["commit", "-m", "x"], commit_only)[0] is True
+    assert gated_invocation_directory(["push"], commit_only)[0] is False
+
+
+def test_gated_repo_directories_threads_push_only_subcommands() -> None:
+    push_only = frozenset({"push"})
+    assert gated_repo_directories("git push", "/session", push_only) == ["/session"]
+    assert gated_repo_directories("git commit -m x", "/session", push_only) == []
+
+
+def test_gated_repo_directories_accepts_the_all_gated_subcommands_keyword() -> None:
+    push_only = frozenset({"push"})
+    assert gated_repo_directories(
+        "git push", "/session", all_gated_subcommands=push_only
+    ) == ["/session"]
+
+
+def test_gated_invocation_directory_accepts_the_all_gated_subcommands_keyword() -> None:
+    push_only = frozenset({"push"})
+    assert gated_invocation_directory(["push"], all_gated_subcommands=push_only)[0] is True

package/hooks/blocking/volatile_path_in_post_blocker.py

@@ -18,6 +18,15 @@ and scanned, since that content is what gets embedded in the post). The ``gh``
 command is tokenized with ``shlex.split`` and the ``gh`` word must be the first
 command token, so a ``gh pr comment`` that only appears as quoted data inside
 another argument never classifies.
+
+The marker scan runs in two tiers over the normalized body. Five bare markers
+— the system temp locations and env tokens — match as a plain substring
+anywhere. Two dot-relative directory markers, ``.claude-editor/jobs/`` and
+``.claude/worktrees/``, match when either a slash sits immediately before the
+marker or a path segment follows it. A machine-local absolute path
+(``~/.claude/worktrees/wt/f.py``) and a relative path that names a child
+(``see .claude/worktrees/wt-1/notes.md``) both count; a bare directory-name
+mention with neither anchor posts cleanly.
 """
 
 import json
@@ -42,30 +51,79 @@ from blocking._gh_body_arg_utils import (  # noqa: E402
 )
 from hooks_constants.hook_block_logger import log_hook_block  # noqa: E402
 from hooks_constants.volatile_path_in_post_blocker_constants import (  # noqa: E402
+    ALL_BARE_VOLATILE_PATH_MARKERS,
     ALL_GH_POST_SUBCOMMANDS,
     ALL_MCP_BODY_PARAM_NAMES,
-    ALL_VOLATILE_PATH_MARKERS,
+    ALL_PATH_ANCHORED_VOLATILE_PATH_MARKERS,
     BASH_TOOL_NAME,
     BODY_FILE_ENCODING,
     CORRECTIVE_MESSAGE,
     GH_COMMAND_NAME,
     MCP_GITHUB_TOOL_PREFIX,
     MINIMUM_POST_SUBCOMMAND_TOKEN_COUNT,
+    PATH_ANCHOR_CHARACTER,
+    PATH_SEGMENT_START_CHARACTERS,
     TOKEN_JOIN_SEPARATOR,
 )
 
 
+def _character_starts_path_segment(character: str) -> bool:
+    """Return whether a character can open a path segment after a marker."""
+    return bool(character) and (
+        character.isalnum() or character in PATH_SEGMENT_START_CHARACTERS
+    )
+
+
+def _text_has_anchored_marker(normalized_text: str, marker: str) -> bool:
+    """Return whether the marker appears as part of a path.
+
+    A match counts when either a slash sits immediately before the marker or a
+    path segment follows it. Every occurrence is scanned, so a bare directory
+    mention earlier in the text never masks a path occurrence later::
+
+        ok:   ".claude/worktrees/ is the manifest key"      -> False
+        flag: "path c:/users/me/.claude/worktrees/wt/f.py"  -> True
+        flag: "see .claude/worktrees/wt-1/notes.md"         -> True
+
+    Args:
+        normalized_text: The body text with backslashes folded to forward
+            slashes and lowercased.
+        marker: A dot-relative directory marker to search for.
+
+    Returns:
+        True when at least one occurrence is path-anchored.
+    """
+    search_start = 0
+    while True:
+        found_index = normalized_text.find(marker, search_start)
+        if found_index < 0:
+            return False
+        preceding_character = normalized_text[found_index - 1 : found_index]
+        following_index = found_index + len(marker)
+        following_character = normalized_text[following_index : following_index + 1]
+        is_slash_before = preceding_character == PATH_ANCHOR_CHARACTER
+        is_segment_after = _character_starts_path_segment(following_character)
+        if is_slash_before or is_segment_after:
+            return True
+        search_start = found_index + 1
+
+
 def scan_text_for_volatile_marker(text: str) -> str | None:
     """Return the first volatile-path marker found in text, or None.
 
     Backslashes normalize to forward slashes and the text lowercases before the
-    scan, so a marker matches regardless of slash direction or letter case::
+    scan. The two dot-relative directory markers count when either a slash sits
+    immediately before them or a path segment follows them; the five bare
+    markers match anywhere::
 
-        ok:   "See the log table pasted below."        -> None
-        flag: r"C:\\Users\\me\\.claude-editor\\jobs\\x" -> ".claude-editor/jobs/"
+        ok:   "the `.claude/worktrees/` manifest key"    -> None
+        flag: r"C:\\Users\\me\\.claude-editor\\jobs\\x"   -> ".claude-editor/jobs/"
+        flag: "see .claude/worktrees/wt-1/notes.md"       -> ".claude/worktrees/"
+        flag: "saved to %TEMP%\\out.txt"                  -> "%temp%"
 
-    Env-token markers such as ``%TEMP%`` and ``$CLAUDE_JOB_DIR`` match on the
-    same lowercased text.
+    A dot-relative marker with neither a slash before it nor a path segment
+    after it — start of text naming the directory, a quoted config constant,
+    or a placeholder form such as ``.claude/worktrees/<name>`` — posts cleanly.
 
     Args:
         text: The post body text to scan.
@@ -73,8 +131,11 @@ def scan_text_for_volatile_marker(text: str) -> str | None:
     Returns:
         The matched marker string, or None when the text names no volatile path.
     """
-    normalized_text = text.replace("\\", "/").lower()
-    for each_marker in ALL_VOLATILE_PATH_MARKERS:
+    normalized_text = text.replace("\\", PATH_ANCHOR_CHARACTER).lower()
+    for each_marker in ALL_PATH_ANCHORED_VOLATILE_PATH_MARKERS:
+        if _text_has_anchored_marker(normalized_text, each_marker):
+            return each_marker
+    for each_marker in ALL_BARE_VOLATILE_PATH_MARKERS:
         if each_marker in normalized_text:
             return each_marker
     return None

package/hooks/git-hooks/git_hooks_constants/__init__.py

@@ -49,6 +49,12 @@ NO_PARSEABLE_STDIN_LINES_MESSAGE: str = (
 )
 NO_PARSEABLE_STDIN_LINES_SENTINEL: str = "__no_parseable_stdin_lines__"
 LOCAL_BRANCH_REFERENCE_PREFIX: str = "refs/heads/"
+CODE_REVIEW_PUSH_GATE_PATH_OVERRIDE_ENV_VAR: str = "CODE_REVIEW_PUSH_GATE_PATH"
+CODE_REVIEW_PUSH_GATE_MODULE_NAME: str = "code_review_push_gate"
+CODE_REVIEW_PUSH_GATE_SCRIPT_FILENAME: str = "code_review_push_gate.py"
+CODE_REVIEW_DENY_REASON_FUNCTION_NAME: str = "deny_reason_for_directory"
+BLOCKING_DIRECTORY_NAME: str = "blocking"
+CODE_REVIEW_STAMP_BLOCK_EXIT_CODE: int = 1
 ALL_PROTECTED_BRANCH_PUSH_NAMES: tuple[str, ...] = ("main", "master")
 PROTECTED_BRANCH_PUSH_BLOCK_EXIT_CODE: int = 1
 PROTECTED_BRANCH_PUSH_BLOCK_MESSAGE: str = (

package/hooks/git-hooks/pre_push.py

@@ -30,6 +30,8 @@ Exit codes:
 
 from __future__ import annotations
 
+import importlib.util
+import os
 import subprocess
 import sys
 from pathlib import Path
@@ -38,6 +40,12 @@ from git_hooks_constants import (
     ALL_PROTECTED_BRANCH_PUSH_NAMES,
     ALL_ZEROS_OBJECT_NAME_CHARACTER,
     BASE_REFERENCE_ARGUMENT,
+    BLOCKING_DIRECTORY_NAME,
+    CODE_REVIEW_DENY_REASON_FUNCTION_NAME,
+    CODE_REVIEW_PUSH_GATE_MODULE_NAME,
+    CODE_REVIEW_PUSH_GATE_PATH_OVERRIDE_ENV_VAR,
+    CODE_REVIEW_PUSH_GATE_SCRIPT_FILENAME,
+    CODE_REVIEW_STAMP_BLOCK_EXIT_CODE,
     DEFAULT_REMOTE_BASE_REFERENCE,
     GATE_INFRASTRUCTURE_FAILURE_EXIT_CODE,
     INVOKE_GATE_FAILURE_MESSAGE,
@@ -158,6 +166,82 @@ def invoke_gate(gate_script_path: Path, base_reference: str) -> int:
     return completion.returncode
 
 
+def resolve_code_review_gate_path() -> tuple[Path, Path | None]:
+    """Return the code-review push gate script path and its exact-allow override.
+
+    The override environment variable, when set, names the only path the trust
+    check accepts; otherwise the gate script resolves to the ``blocking``
+    directory beside this hook's ``git-hooks`` directory, which holds in both
+    the repository layout and the installed ``~/.claude/hooks`` layout.
+
+    Returns:
+        A pair of the resolved gate script path and either the exact override
+        path (override set) or None (trust-root case).
+    """
+    override_path_raw = os.environ.get(
+        CODE_REVIEW_PUSH_GATE_PATH_OVERRIDE_ENV_VAR, ""
+    ).strip()
+    if override_path_raw:
+        exact_override = Path(override_path_raw).resolve()
+        return exact_override, exact_override
+    blocking_directory = Path(__file__).resolve().parent.parent / BLOCKING_DIRECTORY_NAME
+    return blocking_directory / CODE_REVIEW_PUSH_GATE_SCRIPT_FILENAME, None
+
+
+def load_code_review_deny_reason(gate_script_path: Path, work_tree_directory: str) -> str | None:
+    """Import the gate script and read its push deny reason for a work tree.
+
+    Any import or evaluation failure reads as no deny reason.
+
+    Args:
+        gate_script_path: The resolved code-review push gate script path.
+        work_tree_directory: The work tree the push targets.
+
+    Returns:
+        The gate's deny reason when the surface lacks a covering low stamp;
+        None when the gate allows the push or could not be evaluated.
+    """
+    try:
+        gate_specification = importlib.util.spec_from_file_location(
+            CODE_REVIEW_PUSH_GATE_MODULE_NAME, str(gate_script_path)
+        )
+        if gate_specification is None or gate_specification.loader is None:
+            return None
+        gate_module = importlib.util.module_from_spec(gate_specification)
+        gate_specification.loader.exec_module(gate_module)
+        deny_reason_function = getattr(gate_module, CODE_REVIEW_DENY_REASON_FUNCTION_NAME, None)
+        if deny_reason_function is None:
+            return None
+        deny_reason = deny_reason_function(work_tree_directory)
+    except Exception:
+        return None
+    if isinstance(deny_reason, str) and deny_reason:
+        return deny_reason
+    return None
+
+
+def code_review_stamp_block_exit_code() -> int:
+    """Block the push when no clean low code-review stamp covers the surface.
+
+    Runs the gate decision only when the gate script sits at a trusted
+    installed location (or the exact override path). When the gate is absent
+    from a trusted location, the check is skipped and the push is allowed,
+    matching the CODE_RULES gate's fail-open posture.
+
+    Returns:
+        The block exit code when a covering low stamp is missing; 0 when the
+        surface is covered or the gate is not installed at a trusted location.
+    """
+    gate_script_path, exact_allowed_path = resolve_code_review_gate_path()
+    if not is_safe_regular_file(gate_script_path, exact_allowed_path):
+        return 0
+    deny_reason = load_code_review_deny_reason(gate_script_path, os.getcwd())
+    if deny_reason is None:
+        return 0
+    sys.stderr.write(deny_reason + "\n")
+    return CODE_REVIEW_STAMP_BLOCK_EXIT_CODE
+
+
 def main() -> int:
     stdin_read_failure_message = STDIN_READ_FAILURE_MESSAGE
     gate_infrastructure_failure_exit_code = GATE_INFRASTRUCTURE_FAILURE_EXIT_CODE
@@ -191,14 +275,17 @@ def main() -> int:
             pre_push_gate_script_not_found_message.format(path=gate_script_path),
             file=sys.stderr,
         )
-        return 0
+        return code_review_stamp_block_exit_code()
     base_reference = resolve_base_reference_from_stdin(stdin_text)
     if base_reference is None:
         return 0
     if base_reference == no_parseable_stdin_lines_sentinel:
         print(no_parseable_stdin_lines_message, file=sys.stderr)
         return gate_infrastructure_failure_exit_code
-    return invoke_gate(gate_script_path, base_reference)
+    code_rules_exit_code = invoke_gate(gate_script_path, base_reference)
+    if code_rules_exit_code != 0:
+        return code_rules_exit_code
+    return code_review_stamp_block_exit_code()
 
 
 if __name__ == "__main__":