I3830 — A local gate reports and CI decides: pre-commit and pre-push refuse only on integrity

○READY wave 0 · p1 · implementation profile · parallel safe

Part of ci-critical-path — The critical path from a change to its verdict, and from a merge to its verified deploy, runs under a minute warm.

Objective

Make doctor, the worktree guard, rustdoc and scripts/ci/run-plan --before-push report their findings in the pre-commit and pre-push hooks without refusing, while derive-current (scripts/pages current), the SSH permissions check, finish --check, case numbers and an uncomputable plan keep refusing; CI keeps every required check and remains the verdict.

Why

The owner's relaxation of 2026-10-21 (rule project.the-cooperation-model-is-the-owners-word v2, I3824): local gates are informative and CI holds the verdict. On 2026-10-20 a push of a rescue ref spent 3490 s in run-plan --before-push at load 70-90, and a commit hook started a cold cargo build.

Current state

.githooks/pre-commit refuses on doctor and on the worktree guard; .githooks/pre-push refuses on rustdoc (scripts/rust-check --doc) and on any failed gate or case of scripts/ci/run-plan --before-push; rule project.a-push-runs-what-ci-would-find-first v1 says a refused gate is fixed before the push.

Desired state

A red reporting gate prints its finding and lets the commit or push through; the integrity checks refuse as before; rule project.a-push-runs-what-ci-would-find-first v2 states which checks refuse and that CI decides the rest.

Scope

• .githooks
• bin/majordomus-cli
• .ai/repo/rules/project
• test/cases/1021_a_push_runs_what_ci_would_find_first.sh
• test/cases/3025_abandoned_work_in_a_worktree_is_named.sh
• test/cases/26_ci_wiring.sh
• docs/CI.md

Out of scope

• Changing which checks CI requires
• Claude Code permission settings, which are the owner's to paste

Dependencies

None. This issue is a root of the graph.

Acceptance criteria

• A fixture push whose run-plan gate fails exits 0 with a line naming the gate and saying CI holds the verdict, and CI's validate refuses the same head
• A commit that moves a canonical input without regenerating is still refused by scripts/pages current
• An uncomputable plan (exit 12), a failed finish --check and a duplicate case number still refuse the push
• doctor still finds each enforcement wired by its hook

Validation

• bash test/run.sh 1021_a_push_runs_what_ci_would_find_first 3830_a_local_gate_reports_and_ci_decides 26_ci_wiring
• bin/majordomus plan validate

Evidence required

• a_local_gate_reports_and_ci_decides_test

Evidence

None recorded. Every token above needs a command or an artifact behind it before this issue can be completed; narrative is refused.

Timeline

started

—

verified

—

completed

—

Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.

Canonical record: .ai/repo/project/issues/I3830.yaml. Read it back with majordomus plan show I3830.