pre-commit

#!/usr/bin/env bash
# Root pre-commit guard for ai-coding-kit.
#
# Enforces that any change to skills-engineering/ios-engineer/SKILL.md or
# skills-engineering/ios-engineer/references/*.md is bound to a staged
# evolution proposal whose approval record is staged or already committed.
#
# Bypass: SKILL_BYPASS=1 in the environment for emergencies. Bypass usage
# should be documented in the commit message; reflog plus the SKILL_BYPASS
# string in the parent shell history is the audit trail.

set -uo pipefail

if [ "${SKILL_BYPASS:-0}" = "1" ]; then
  exit 0
fi

PREFIX="skills-engineering/ios-engineer"

changed_files="$(git diff --cached --name-only --diff-filter=ACMR)"

guarded="$(printf '%s\n' "$changed_files" | grep -E "^${PREFIX}/(SKILL\.md|references/.+\.md)$" || true)"

if [ -z "$guarded" ]; then
  exit 0
fi

staged_proposals="$(printf '%s\n' "$changed_files" | grep -E "^${PREFIX}/evolution/proposals/[0-9]{8}-[0-9]{6}-[A-Za-z0-9_-]+\.md$" || true)"

if [ -z "$staged_proposals" ]; then
  {
    echo "skill-evolution pre-commit: SKILL.md or references/ changed without a staged evolution proposal."
    echo "Guarded changes:"
    printf '%s\n' "$guarded" | sed 's/^/  - /'
    echo ""
    echo "Stage an approved evolution proposal in the same commit, or set SKILL_BYPASS=1 to bypass (emergencies only)."
  } >&2
  exit 1
fi

missing_approvals=""
while IFS= read -r proposal; do
  [ -z "$proposal" ] && continue
  proposal_id="$(basename "$proposal" .md)"
  approval_path="${PREFIX}/evolution/approvals/${proposal_id}.json"

  if printf '%s\n' "$changed_files" | grep -qx "$approval_path"; then
    continue
  fi

  if git ls-files --error-unmatch "$approval_path" >/dev/null 2>&1; then
    continue
  fi

  missing_approvals="${missing_approvals}${approval_path}
"
done <<EOF
$staged_proposals
EOF

if [ -n "${missing_approvals%$'\n'}" ]; then
  {
    echo "skill-evolution pre-commit: staged proposals lack approval records."
    printf '%s' "$missing_approvals" | sed 's/^/  - /'
    echo ""
    echo "Run bash ${PREFIX}/scripts/approve_skill_promotion.sh and stage the resulting approval JSON,"
    echo "or set SKILL_BYPASS=1 to bypass (emergencies only)."
  } >&2
  exit 1
fi

exit 0