# REPORT — `catalog_gates --fast` and the pre-push hook (2026-08-02)

**Overwritten** per the standing rule. The prior contents (the entry point itself, earlier the same
day) have their durable record in `CHANGELOG.md`; nothing was lost.

**Change:** `scripts/catalog_gates.py` gains `--fast`; `.githooks/pre-push` (new) runs it;
`scripts/test_catalog_gates.py` (new) pins its behaviour; `CLAUDE.md` records the hook.
**No gate logic changed, no template touched, no version** (this repo carries none).

| Commit | What |
|---|---|
| `c3e4bb1` | `scripts/catalog_gates.py` `--fast` + `scripts/test_catalog_gates.py` + `.githooks/pre-push` + `CLAUDE.md` |
| `340ff2a` | `CHANGELOG.md` |

Baseline on arrival: `fd7747d1293c`, clean, `HEAD == origin/main` — matched the spec's anchor.

## What `--fast` selects, and why the other two are excluded

`--fast` runs only gates that touch **no network and no container runtime**. Today that is gate 1,
`check-image-pins.py`. `check-image-resolvable.py` (network) and `check-volume-persistence.py`
(Docker, minutes per app) are **not** in it.

That exclusion is the point, not a compromise: **a push that pulls images and starts containers gets
bypassed within a week, and the bypass becomes the habit.** Both remain deliberate periodic runs — at
the start of a catalog campaign, before a publish train that vouches the catalog, and whenever a
template's `volumes:` block or image tag changes — on a scratch host, never a customer box.

**The skip is announced**, with its reason and with what still owes a run. A silently narrowed run
reads as "covered everything" when it did not. Default behaviour with no flag is **unchanged**: all
three gates, exactly as before.

## `.githooks/pre-push`

Runs `catalog_gates.py --fast` and refuses the push, printing a line before and after because an
absent log line is not evidence a hook ran. Limits, written into the hook: **per-clone**
(`core.hooksPath` is local config; this clone is armed — `git config --get core.hooksPath` →
`.githooks`) and **`git push --no-verify` bypasses it on purpose**. It was **not** used against this
repo; both real pushes ran the hook and passed.

This makes R-161's convention half automatic-ish, not automatic. The unbypassable half is CI, which
has no execution mechanism here yet and is now tracked as `felhom.eu` `OPEN-ITEMS.md` **R-168**.

## `test_catalog_gates.py` — pins the CONTENT, not just the exit code

Five tests: the static gate's own stdout must appear (an inert runner prints the summary while
calling nothing), the runtime gates' must **not**, the skip must be announced, and the no-flag path
must still select all three. **Red-proof:** replacing `run_gate`'s body with `return 0` turns it red.

## Verification

```
catalog_gates — static gate only  [--fast]
  --fast SKIPPED: image-resolvable, volume-persistence — …

image-pin gate OK — 53 templates, 0 unpinned images

  image-pins           OK            (exit 0)

all catalog gates OK
```

`python3 scripts/test_catalog_gates.py` → **5 tests, OK**.
`python3 scripts/test_check_volume_persistence.py` — untouched, still green.

Full cross-repo detail, every red-proof, the `core.hooksPath` probe measurements and the hub
deployment: `felhom.eu/REPORT.md`.