From 9f84ea2c7854e35ae30c0fb5fbd63f7b7115fb41 Mon Sep 17 00:00:00 2001
From: Craig Jennings <c@cjennings.net>
Date: Thu, 28 May 2026 09:11:47 -0500
Subject: feat(sync-check): canonical/mirror drift detection + pre-commit hook

scripts/sync-check.sh diffs claude-templates/.ai/{protocols.org,
workflows,scripts} against the .ai/ mirror. Exits 0 when clean, 1 with
a diff report on drift, 2 outside a rulesets-shaped repo or git
checkout. --fix mode rsyncs canonical -> mirror and re-checks, then
prompts to re-stage.

githooks/pre-commit wraps the script. Commits abort on drift so the
issue surfaces at publish time, not at the next session's startup
rsync.

Two new Makefile targets:
- make sync-check [FIX=1] runs the script (FIX=1 passes --fix
  through).
- make install-githooks sets core.hooksPath=githooks (idempotent).

scripts/tests/sync-check.bats holds 8 tests covering clean,
drift-per-path, --fix, extra-file removal, missing canonical, and
outside-git. All eight pass.

This catches the exact drift I had to fix manually during this
morning's audit pass. The mirror's open-tasks.org PROPERTIES drawer
sat below a sub-heading because the mirror commit was older than
canonical.
---
 githooks/pre-commit | 15 +++++++++++++++
 1 file changed, 15 insertions(+)
 create mode 100755 githooks/pre-commit

(limited to 'githooks/pre-commit')

diff --git a/githooks/pre-commit b/githooks/pre-commit
new file mode 100755
index 0000000..ece0c8a
--- /dev/null
+++ b/githooks/pre-commit
@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+#
+# pre-commit hook — block commits when the canonical/mirror pair drifts.
+#
+# Enable by running: git config core.hooksPath githooks
+# (handled by make install-hooks; idempotent on re-run.)
+
+set -euo pipefail
+
+repo_root="$(git rev-parse --show-toplevel)"
+"$repo_root/scripts/sync-check.sh" || {
+    echo "" >&2
+    echo "pre-commit: canonical/mirror drift detected. Commit blocked." >&2
+    exit 1
+}
-- 
cgit v1.2.3