#!/bin/sh
# pre-push — refuse a push that carries a broken gate. (2026-08-02, R-29 leg (b) first half.)
#
# Runs this repo's ONE gate entry point in --fast mode: only checks that touch no network and no
# container runtime, so a push stays a push and never pulls images or starts containers. The slow
# gates stay deliberate periodic runs; a hook that takes minutes gets bypassed within a week and
# the bypass becomes the habit.
#
# BOTH LINES BELOW ARE DELIBERATE. An absent log line is not evidence a hook ran — a silent pass is
# equally consistent with "gates green" and "hook never fired", so a passing push says so out loud.
#
# HONEST LIMITS, stated so this is not mistaken for enforcement it cannot provide:
#   * per-clone   — core.hooksPath is local config and a clone does not carry it. Arm a clone once:
#                     git config core.hooksPath .githooks
#                   Any manual entry-point run WARNS when the clone is unarmed.
#   * skippable   — `git push --no-verify` bypasses this entirely. That is on purpose: an escape
#                   hatch that cannot be reached is one that gets removed the first time it is
#                   inconvenient. USING IT MUST BE STATED IN THE SESSION REPORT.
# The half that is neither per-clone nor skippable is CI — felhom.eu OPEN-ITEMS.md R-168.
#
# Measured 2026-08-02 (git 2.47.3): a relative core.hooksPath resolves correctly and the hook's cwd
# is the repo root whether `git push` is issued from the root or from any subdirectory. The
# explicit rev-parse below does not depend on that.
set -u

root=$(git rev-parse --show-toplevel 2>/dev/null) || {
    echo "pre-push: FAIL - cannot resolve the repo root (git rev-parse --show-toplevel)." >&2
    exit 1
}
cd "$root" || exit 1

if ! command -v python3 >/dev/null 2>&1; then
    echo "pre-push: FAIL - python3 not found, so the gates CANNOT run. This is a failure, never a" >&2
    echo "          pass by default. Install python3, or push with --no-verify and say so." >&2
    exit 1
fi

echo "pre-push [felhom-controller]: running controller/scripts/controller_gates.py --fast ..."
python3 "controller/scripts/controller_gates.py" --fast
rc=$?
if [ "$rc" -ne 0 ]; then
    echo "pre-push [felhom-controller]: PUSH REFUSED - gates exited $rc. Fix the finding above, or bypass with" >&2
    echo "          'git push --no-verify' and state that you did in the session report." >&2
else
    echo "pre-push [felhom-controller]: gates OK - push proceeding."
fi
exit $rc