felhom-agent/REPORT.md

REPORT — this repo gets a place to put a gate (2026-08-02)

Overwritten per the standing rule. The prior contents (the host report carries the box's addresses, agent v0.119.0, 2026-07-31) have their durable record in CHANGELOG.md and felhom.eu/documentation/audits/host-addresses-visible-2026-07-31.md; nothing was lost.

No version bump, no build, no deploy. Nothing compiled changed — this touches scripts/ and .githooks/ only. Stated explicitly so the omission reads as a decision rather than a miss. The agent stays v0.119.0 and no binary was copied to any host.

What changed

Commit	What
054e85a	scripts/agent_gates.py + scripts/test_agent_gates.py + .githooks/pre-push + CLAUDE.md
75245a4	CHANGELOG.md

Baseline on arrival: 4663df7ff3cc, clean, HEAD == origin/main — matched the spec's anchor.

Why this repo got an entry point with exactly one gate

A census of all thirteen gate scripts across the four felhom repos on 2026-08-02 found one clean correlation: every check a CLAUDE.md tells a person to run was passing, and two of the four nobody is told to run were failing — one since 14 July. This repo was the extreme case: nothing at all ran against it, and its REUSE.md — 90 cited paths — was checked by no one.

scripts/agent_gates.py runs reuse_refs_check over this repo's REUSE.md, streams its output and exits worst-wins non-zero. One gate is the honest size of it today; the file exists so the agent is not the one repo with nowhere to put a check, and so the pre-push hook has the same entry point in all four repos. It grows when the agent grows a second gate.

The shared checker is never copied here. reuse_refs_check.py stays in felhom.eu/scripts/ and is invoked at <repo-root>/../felhom.eu/scripts/; a copy would recreate exactly the drift it detects. A missing sibling clone is a FAILURE with the path printed, never a skip — fail-closed, because a runner that quietly drops a gate is the inert-seam failure this project has shipped four times. test_agent_gates.py pins that by copying the entry point into a lone directory with no sibling and asserting it convicts.

The 90 citations now resolve as 88 exact, 1 by suffix (localapi/debuglogs_test.go → internal/localapi/debuglogs_test.go) and 1 cross-repo (hub/internal/store/dr_recipe.go, which lives in the hub), 0 failures. None of them was genuine drift — the checker was what needed fixing, not the REUSE map.

.githooks/pre-push

Runs agent_gates.py --fast and refuses the push, printing a line before and after because an absent log line is not evidence a hook ran. Limits, written into the hook itself: per-clone (core.hooksPath is local config; this clone is armed — git config --get core.hooksPath → .githooks) and git push --no-verify bypasses it on purpose, which must be stated in a session report when used. It was not used against this repo; both real pushes ran the hook and passed. The half that is neither per-clone nor skippable is CI — felhom.eu OPEN-ITEMS.md R-168.

Verification

  reuse-refs         OK            (exit 0)

all agent gates OK

python3 scripts/test_agent_gates.py → 4 tests, OK (0 before). No Go file was touched, so no Go test count changed.

Full cross-repo detail, every red-proof, the core.hooksPath probe measurements and the hub deployment: felhom.eu/REPORT.md.