# REPORT — gate enforcement: the `-v` allowlist, one entry point, a pre-push hook (2026-08-02)

**Overwritten** per the standing rule. The prior contents (D5, controller v0.188.0, 2026-07-30) have
their durable record in `CHANGELOG.md`; nothing was lost by this overwrite.

**No version bump, no image build, no deploy.** Nothing compiled changed — this touches
`controller/scripts/` and `.githooks/` only, so no behaviour on any box moved. Stated explicitly so
the omission reads as a decision rather than a miss. Controller stays **v0.188.0**; guest 9201 was
not touched.

## What changed

| Commit | What |
|---|---|
| `c432f70` | **the ALLOWLIST entry, alone in its own reviewed diff** |
| `8cb3d7a` | `controller/scripts/controller_gates.py` + `controller/scripts/test_controller_gates.py` + `.githooks/pre-push` + `CLAUDE.md` |
| `7c32c74` | `CHANGELOG.md` + `controller/README.md` |

Baseline on arrival: `4115e88f688b`, clean, `HEAD == origin/main` — matched the spec's anchor.

### 1. `docker_run_volume_path_gate.py` — one allowlist entry (R-29 leg (a), now CLOSED)

The gate was **RED**, flagging `internal/appexport/estimate.go:179`. The finding is benign and was
reviewed rather than suppressed: `realVolumeSize` mounts a **named Docker volume** read-only into a
throwaway `alpine` to `du` it from a container view. No host path is involved — the daemon resolves
the volume name daemon-side — which makes it structurally identical to the already-allowlisted
`internal/backup/backup.go` entry `'"-v", volName+":/vol:ro"'`. The entry carries its WHY in the
voice of its neighbours.

`realVolumeSize` was **not** rewritten: the code is correct, the allowlist was incomplete. The diff
is alone in its commit because burying an allowlist widening inside a feature commit is how an
allowlist stops meaning anything.

**Red-proof:** renaming the new entry's suffix to a non-existent file returns the gate to **exit 1**,
naming `estimate.go:179`; restored → **exit 0**.

### 2. `controller_gates.py` — THE entry point

Runs all seven local gates plus `reuse_refs_check` on the repo root, streams each gate's own output,
exits worst-wins non-zero, and reports exit 2 distinctly as INCONCLUSIVE. `--fast` selects the gates
that touch no network and no container runtime — today all eight. **A missing gate script is a
FAILURE with the path printed, never a skip.**

Why a runner at all: the 2026-08-02 census across the four repos found that **every gate a
`CLAUDE.md` names was green, and the ones nobody names were where the red was.** This repo had seven
gates and `CLAUDE.md` named two; four more lived behind a line in `REUSE.md`, and the docker-`-v`
gate behind one line in `REUSE.md` — while red. The canonical shape is
`app-catalog-felhom.eu/scripts/catalog_gates.py` (R-161).

**The shared checker is never copied here.** `reuse_refs_check.py` stays in `felhom.eu/scripts/` and
is invoked at `<repo-root>/../felhom.eu/scripts/`; a copy would recreate exactly the drift it detects.
It now resolves this repo's REUSE map cleanly: **133 cited paths — 126 exact, 6 by suffix, 1
cross-repo** (`wgsync/reconciler.go`, which lives in the hub), 0 failures.

### 3. `.githooks/pre-push`

Runs `controller_gates.py --fast` and refuses the push. It prints a line before and after, because an
absent log line is not evidence a hook ran. Its limits are written into the hook itself: **per-clone**
(`core.hooksPath` is local config; this clone is armed — `git config --get core.hooksPath` →
`.githooks`) and **`git push --no-verify` bypasses it on purpose**, which must be stated in a session
report when used. It was **not** used against this repo; both real pushes ran the hook and passed.

### 4. `test_controller_gates.py` — a seam test, not a smoke test

Asserts each member gate's **own distinctive stdout**, never the runner's summary line, which an
inert runner prints while calling nothing. **Red-proof:** replacing `run_gate`'s body with `return 0`
still prints `all controller gates OK` and exits 0 — and turns the seam test red. It also pins that
`reuse_refs_check.py` has not been copied into this repo.

## Verification

```
  template-id        OK   (exit 0)      app-row-dedup      OK   (exit 0)
  emoji              OK   (exit 0)      mojibake           OK   (exit 0)
  native-confirm     OK   (exit 0)      docker-v           OK   (exit 0)
  offbox-rename      OK   (exit 0)      reuse-refs         OK   (exit 0)

all controller gates OK
```

`python3 scripts/test_controller_gates.py` → **4 tests, OK** (0 before). No Go test count changed; no
Go file was touched.

Full cross-repo detail, every red-proof, the `core.hooksPath` probe measurements and the hub
deployment: `felhom.eu/REPORT.md`.