From 885951ee2b15e81751fecc2ee583c9ed4e450637 Mon Sep 17 00:00:00 2001
From: Krzysztof kuhy Rudnicki <krzysztofrudnicki0@gmail.com>
Date: Sun, 20 Sep 2026 19:35:35 +0200
Subject: [PATCH] pre-push is a 1-second stamp check; the suites moved to the
 manual stage

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .pre-commit-config.yaml     | 20 +++++++++++++++++---
 scripts/check_gate_stamp.sh | 30 ++++++++++++++++++++++++++++++
 scripts/ci_mirror.sh        |  7 ++++---
 3 files changed, 51 insertions(+), 6 deletions(-)
 create mode 100755 scripts/check_gate_stamp.sh

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index ef0050d..b317423 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -174,7 +174,7 @@ repos:
         pass_filenames: false
         always_run: true
         require_serial: true
-        stages: [pre-push]
+        stages: [manual]
 
   - repo: https://github.com/codespell-project/codespell
     rev: v2.3.0
@@ -247,7 +247,7 @@ repos:
         files: '^stronglift_replacement/workout_app/.*\.dart$'
         pass_filenames: false
         require_serial: true
-        stages: [pre-push]
+        stages: [manual]
 
       # web/ gates. steam-backlog-enforcer, which this app was copied from, has
       # only a coverage hook -- its lint and typecheck are unenforced, so both
@@ -273,7 +273,7 @@ repos:
         files: '^web/src/'
         pass_filenames: false
         require_serial: true
-        stages: [pre-push]
+        stages: [manual]
 
       # Four markdown namespaces (README / CLAUDE* / DOCS* / TODO*), plus the
       # rule that a TODO carries "REMOVE ME AFTER FINISH" and nothing else may.
@@ -306,3 +306,17 @@ repos:
           |Cargo\.(toml|lock)|go\.(mod|sum)
           |\.fvmrc|\.nvmrc|\.python-version
           |\.github/workflows/.*\.ya?ml)$
+
+  - repo: local
+    hooks:
+      # The only pre-push hook. Everything that used to run here is now
+      # `stages: [manual]` -- run on demand with `scripts/check_gate_stamp.sh
+      # full`, and by CI on every push. finish_auto.sh stamps HEAD after its
+      # gate; a tree without that receipt cannot leave the machine.
+      - id: gate-stamp
+        name: pushed tree passed the local gate (stamp check)
+        entry: scripts/check_gate_stamp.sh check
+        language: system
+        pass_filenames: false
+        always_run: true
+        stages: [pre-push]
diff --git a/scripts/check_gate_stamp.sh b/scripts/check_gate_stamp.sh
new file mode 100755
index 0000000..b2e7c34
--- /dev/null
+++ b/scripts/check_gate_stamp.sh
@@ -0,0 +1,30 @@
+#!/bin/bash
+
+# ============================================================================
+# pre-push gate: is the pushed tree stamped as having passed the local gate?
+#
+# Thin delegate to the shared tool in ~/src/utils. The pre-push stage used to
+# re-run every suite (10+ min under the resource cap); now finish_auto.sh's
+# gate leaves a receipt (the tree hash) and this only compares against it.
+#
+# Usage:
+#   scripts/check_gate_stamp.sh check   # pre-commit's pre-push stage (~1 s)
+#   scripts/check_gate_stamp.sh full    # the old pre-push suites, then stamp
+# ============================================================================
+
+set -euo pipefail
+
+readonly SHARED_GATE="${UTILS_ROOT:-$HOME/src/utils}/scripts/gate_stamp.sh"
+
+main() {
+    if [[ ! -x "$SHARED_GATE" ]]; then
+        echo "Error: shared gate-stamp tool not found at $SHARED_GATE" >&2
+        echo "       Clone github.com/kuhyx/utils to ~/src/utils, or set" >&2
+        echo "       UTILS_ROOT to where it lives." >&2
+        exit 1
+    fi
+
+    exec bash "$SHARED_GATE" "$@"
+}
+
+main "$@"
diff --git a/scripts/ci_mirror.sh b/scripts/ci_mirror.sh
index 66c619d..4c8908a 100755
--- a/scripts/ci_mirror.sh
+++ b/scripts/ci_mirror.sh
@@ -15,8 +15,9 @@
 #   2. `pre-commit run --all-files` (mirrors the pre-commit workflow);
 #   3. `python -m pytest` inside that clean venv (mirrors Tests).
 #
-# Wired as the pre-push hook, so a red result blocks the push before CI ever
-# sees it. Escape hatch for genuine emergencies: `git push --no-verify`.
+# Runs on demand (`scripts/check_gate_stamp.sh full`, pre-commit's manual
+# stage) and in CI. It left the pre-push path on 2026-09-20: 10+ minutes
+# per push under the resource cap, for work finish_auto.sh had just done.
 # ============================================================================
 
 set -euo pipefail
@@ -37,7 +38,7 @@ log() { printf 'ci-mirror: %s\n' "$1" >&2; }
 
 fail() {
     log "FAILED — $1"
-    log "CI would be red. Fix the above, or 'git push --no-verify' to override."
+    log "CI would be red. Fix the above before pushing."
     exit 1
 }