#!/bin/sh
# create-cmp pre-push gate — the human checkpoint before code leaves the machine.
#
# The committed evidence receipt (qa/evidence/latest.json) must attest HEAD.
# This is the SAME check CI runs (qa/receipt-check.mjs), moved earlier so an
# unverified push is caught locally. It is the CHEAP predicate — a hash
# comparison — not the full lane, so it never rebuilds anything.
#
# Enable once with `node qa/setup-hooks.mjs`. Bypass in a pinch with
# `git push --no-verify`; CI still enforces the same check.

if [ ! -f qa/receipt-check.mjs ]; then
  exit 0 # not a create-cmp project layout — nothing to gate
fi

# First the half nothing else checks: the receipt must be IN the commit being
# pushed, not merely on disk. receipt-check reads the working tree by hash and
# has no opinion about git; this line is what makes "committed receipt" true.
if ! git ls-files --error-unmatch qa/evidence/latest.json >/dev/null 2>&1 || ! git diff --quiet HEAD -- qa/evidence/latest.json; then
  echo ""
  echo "✗ pre-push blocked — qa/evidence/latest.json is not committed (or differs from HEAD)."
  echo "  Commit the receipt with your change, then push again."
  exit 1
fi
if node qa/receipt-check.mjs; then
  exit 0
fi

echo ""
echo "✗ pre-push blocked — the committed receipt does not attest HEAD."
echo "  Run:  node qa/verify.mjs   then commit qa/evidence/latest.json, and push again."
echo "  Bypass this local gate with: git push --no-verify  (CI still checks)."
exit 1