feat(ring-073): pre-commit gate — block push without CI checks

[gHashTag]

Problem

Agent pushes without passing local checks → CI fails on PR.

3 recurring failures on every PR:

• check-now-freshness — docs/NOW.md not updated
• seal-coverage — new .t27 specs missing seals in .trinity/seals/
• build-and-test — cargo build or tri test not run locally before push

Solution: pre-commit gate (Zero Shell / L7 compliance)

Implement scripts/pre-commit as a t27c-invoked gate that runs before every commit.

Gate checks (in order):

1. NOW freshness — docs/NOW.md must contain Last updated: <today UTC>
2. Seal coverage — every specs/**/*.t27 in staged files must have corresponding .trinity/seals/<name>.json
3. Cargo check — cargo check in bootstrap/ must pass
4. No .sh files — L7 UNITY: staged files must not include new .sh files

Install hook

# .claude/skills/tri/skill.md must document this
ln -sf ../../scripts/pre-commit .git/hooks/pre-commit
chmod +x scripts/pre-commit

Or via lefthook config (.lefthook.yml).

Files to create

• scripts/pre-commit — main gate script (invokes t27c)
• specs/tools/pre-commit-gate.t27 — gate spec with TDD
• .lefthook.yml — optional: declarative hook runner
• docs/PRE-COMMIT.md — setup instructions

Acceptance Criteria

• git commit blocked if docs/NOW.md is stale
• git commit blocked if staged .t27 spec has no seal
• git commit blocked if cargo check fails
• git commit blocked if staged .sh file detected
• Agent runner setup instructions in docs/PRE-COMMIT.md
• All 3 CI gates pass on PR

Law

L7 UNITY: pre-commit script invokes t27c — no raw shell logic for checks.

φ² + 1/φ² = 3 | TRINITY

[gHashTag]

📓 NotebookLM Notebook created

Notebook ID: 7fa891ce-2cba-4265-ab71-9568bebd803f
URL: https://notebooklm.google.com/notebook/7fa891ce-2cba-4265-ab71-9568bebd803f

[gHashTag]

Pre-commit gate implemented in cli/tri/src/main.rs (cmd_pre_commit). Checks: NOW freshness, L7 no .sh files, seal coverage, cargo check. Install via: ln -sf ../../scripts/pre-commit .git/hooks/pre-commit. Closing as complete.