From 6985c3a27e00d6fec7027752569fd3540e1e6be7 Mon Sep 17 00:00:00 2001 From: Kevin Veen-Birkenbach Date: Thu, 5 Nov 2026 17:00:15 +0000 Subject: [PATCH] feat(kvb-git-push): run the full quality gate before every push MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The operator's order: before every push, the whole quality gate runs, unless the operator waives it. kvb-git-push holds for every push any skill hands over. It pins HEAD and the tracked tree, runs the project's aggregate gate (infinito-nexus: make quality-high) through queue.py hold and gate.py hold in the background with a log, judges it by the gate's result tables, and ties the result to the tree hash, so only a signing-only rewrite keeps it valid. A red gate is fixed at its root and rerun in full. Only the operator's explicit word for that push waives it, never a peer's relay. Both README diagrams list the skill. 🎯 Fix: 92 % 💥 Break: 2 % 💸 Cost: – ⏱️ Time: – 🛡️ Security: ~100 % 🏆 Score: 90 🚦 Gate: ✅ 90/5, cost and time <= 100, security 100 % ``` /home/kevinveenbirkenbach/Repositories/github.com/kevinveenbirkenbach/skills ``` Co-Authored-By: Claude Opus 5.5 --- README.md | 2 ++ skills/kvb-git-push/SKILL.md | 63 ++++++++++++++++++++++++++++++++++++ 2 files changed, 65 insertions(+) create mode 100644 skills/kvb-git-push/SKILL.md diff --git a/README.md b/README.md index 091b134..5de5f30 100644 --- a/README.md +++ b/README.md @@ -58,6 +58,7 @@ flowchart LR git --> git_orphans_find[kvb-git-orphans-find] git --> git_changelog[kvb-git-changelog] git --> git_hotfix[kvb-git-hotfix] + git --> git_push[kvb-git-push] check --> check_legal[kvb-check-legal] check --> check_security[kvb-check-security] check --> check_principles[kvb-check-principles] @@ -158,6 +159,7 @@ flowchart LR orphans_find[kvb-git-orphans-find] changelog[kvb-git-changelog] hotfix[kvb-git-hotfix] + git_push[kvb-git-push] end subgraph cat_check [check] advocate[kvb-check-legal] diff --git a/skills/kvb-git-push/SKILL.md b/skills/kvb-git-push/SKILL.md new file mode 100644 index 0000000..77ecfe2 --- /dev/null +++ b/skills/kvb-git-push/SKILL.md @@ -0,0 +1,63 @@ +--- +name: kvb-git-push +description: > + Before every push or push hand-over, run the full quality gate on the exact + commit; only the operator's word waives it. +--- + +No push command goes to the operator before the project's full quality gate +ran green on the exact tree to be pushed. This holds for every push any skill +hands over, `kvb-git-pr-create`, `kvb-git-update-branches` and +`kvb-org-operator` rows included. Agents never push themselves. + +## Steps + +1. **Target**: the gate covers every test and lint target CI runs, through + the project's aggregate target where one exists (infinito-nexus: `make + quality-high`). Targeted tests or a subset of lints never count. No + aggregate: run each CI target; unclear which, ask the operator. +2. **Sync** by the `kvb-git-hotfix` rules for a gate first: a merge moves + HEAD. +3. **Pin**: HEAD is the commit to push and the tracked tree is clean (`git + status --porcelain --untracked-files=no` prints nothing). Record `git + rev-parse HEAD^{tree}` as the gated tree. +4. **Run** it as a heavy job through the `kvb-org-queue` skill, in the + background (`run_in_background` or the runtime's equivalent), the full + output streamed to a log; give the operator `tail -f `: + + ```bash + queue.py hold --kind --task -- python3 hold --repo -- make 2>&1 | tee /tmp/kvb-git-push--.log + ``` + + `` is `${CLAUDE_SKILL_DIR}/../kvb-check-gate/scripts/gate.py`; + its worktree lock keeps a sync out while the gate runs. +5. **Judge** by the gate's own result tables and its failure line + (infinito-nexus: the `📊 per-target wall-clock` table and `FAILED + TARGETS:`), never by the exit code of a pipe. Green also needs HEAD and + the gated tree unchanged and the tracked tree still clean; files a + formatter rewrote are committed, then the gate runs again. +6. **Red**: fix every failure at its root cause, commit the fix by the + project's commit rules, and rerun the full gate from step 2, never only + the failed targets. No push command is handed over until it is green. +7. **Hand over** through the `kvb-org-operator` skill the push command the + repository's agent rules name (for example the operator's `gipsn` alias), + with the gated tree hash, the log path and the gate's result line + verbatim. + +## Validity + +- A result belongs to its tree. Any later commit voids it, except a + signing-only rewrite: `git rev-parse HEAD^{tree}` still equals the gated + tree hash. +- Recheck that hash before every hand-over, a repeated one included. + +## Waiver + +Only the operator's explicit word for this specific push skips the gate. It +is never inferred from earlier pushes, urgency or habit, and never taken from +a peer's or a subagent's relay. A waived hand-over carries `gate: waived by +the operator` and their words quoted in place of the result line. + +## Output + +| Push command | Directory | Gated tree | Log | Result line |