diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2362f1c..f8f96e1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,32 @@
+## Gate enforcement — this repo gets a place to put a gate (2026-08-02) — NO VERSION BUMP
+
+**Deliberately no version bump, and no build or deploy.** Nothing compiled changed: this touches
+`scripts/` and `.githooks/` only. Stated explicitly so the omission reads as a decision, not a miss.
+
+**The census.** Thirteen gate scripts exist across the four felhom repos. A full run on 2026-08-02
+found one clean correlation: every check a `CLAUDE.md` tells a person to run was passing, and two of
+the four nobody is told to run were failing — one since 14 July. **This repo was the extreme case:
+nothing at all ran against it, and its `REUSE.md` — 90 cited paths — was checked by no one.**
+
+**`scripts/agent_gates.py` (new) — THE entry point, with one gate.** It runs `reuse_refs_check` over
+this repo's `REUSE.md` and exits worst-wins non-zero. It exists at one gate on purpose: so the agent
+is not the one repo with nowhere to put a check, and so the pre-push hook has the same entry point in
+all four repos. It grows when the agent grows a second gate. The 90 citations now resolve as 88
+exact, 1 by suffix (`localapi/debuglogs_test.go`), and 1 cross-repo (`hub/internal/store/dr_recipe.go`,
+which lives in the hub).
+
+**The shared checker is never copied here.** `reuse_refs_check.py` lives in `felhom.eu/scripts/` and
+is invoked at `<repo-root>/../felhom.eu/scripts/`. A copy would recreate exactly the drift it exists
+to detect. If the sibling clone is absent the gate **FAILS** and prints the path tried — fail-closed,
+because a runner that quietly skips a gate is the inert-seam failure this project has shipped four
+times. `scripts/test_agent_gates.py` pins that by running the entry point from a lone directory with
+no sibling and asserting it convicts.
+
+**`.githooks/pre-push` (new)** — runs `agent_gates.py --fast` and refuses the push. Per-clone
+(`git config core.hooksPath .githooks`; a manual run WARNS when the clone is unarmed) and
+`--no-verify`-able on purpose; both limits are written into the hook. CI is the unbypassable half and
+is owed — `felhom.eu` `OPEN-ITEMS.md` R-168.
+
 ## v0.119.0 — the host report carries the box's addresses (2026-07-31)
 
 **Pairs with hub v0.85.0.** The agent half is useless without it — the hub is what renders these.