feat(agent): ship gate — checks run at the push, not on request

[patroza]

Why

Validation that depends on an agent remembering to run it produces both failure modes at once: skipped when it matters, and re-run repeatedly through a task when it doesn't. Neither is what you want — the goal is reliability without burning cycles re-proving the same commit.

What

The macs-scanner ship gate, minus everything that doesn't apply to a library monorepo.

• .githooks/pre-push — no-op for humans, and for draft / no-PR pushes. Full gate on ready PRs, fail-closed when PR state can't be resolved. Drafts stay free so sharing early costs nothing.
• The gate is pnpm check → pnpm lint → pnpm test — exactly what ci.yml runs, deliberately not a superset. No application to stand up, no browser suite: here the unit run (pnpm -r --no-bail test:run) is the whole gate, and is the closest analogue of the E2E stage the product repos gate on.
• Publishing is gated, not forbidden. pnpm pr:ready is explicit; plain gh pr ready reaches the same place because .tools/bin/gh runs the gate first and passes through when green.
• The validated HEAD SHA is cached in .run/agent-ship-gate.json, so one commit is validated once however often it is pushed or published. AGENT_SHIP_GATE_FORCE=1 overrides.

AGENTS.md now says plainly not to hand-run these checks as routine verification, and that narrow targeted proof while iterating is the right tool instead.

How

Two details carried over from porting this to three other repos, each of which was a real bug there:

• The gate supplies its own PATH (node_modules/.bin). pnpm and the hook both provide it, so the dependency stays invisible until something runs the gate from a bare process — which the gh shim does — and it dies with "command not found".
• The hook scrubs git's local env vars before running, so nested git commands discover their own repository rather than inheriting the outer push's GIT_DIR.

The shim is generated by install-git-hooks.mjs rather than committed, because it embeds the checkout's absolute path; .envrc puts it on PATH, so it applies only inside this repository. Run direnv allow once after cloning.

Remarks

Verified live: the shim intercepted gh pr ready, ran the gate, and correctly refused on a dirty worktree.

Same rule now stated in macs-scanner, t3code and macs-configurator.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[pkg-pr-new]

Open in StackBlitz

@effect-app/cli

npm i https://pkg.pr.new/effect-app/libs/@effect-app/cli@838

effect-app

npm i https://pkg.pr.new/effect-app/libs/effect-app@838

@effect-app/eslint-codegen-model

npm i https://pkg.pr.new/effect-app/libs/@effect-app/eslint-codegen-model@838

@effect-app/eslint-shared-config

npm i https://pkg.pr.new/effect-app/libs/@effect-app/eslint-shared-config@838

@effect-app/infra

npm i https://pkg.pr.new/effect-app/libs/@effect-app/infra@838

@effect-app/vue

npm i https://pkg.pr.new/effect-app/libs/@effect-app/vue@838

@effect-app/vue-components

npm i https://pkg.pr.new/effect-app/libs/@effect-app/vue-components@838

commit: 067f372