RUL-008 — Review before every commit

Ruling

Before ANY commit: run code review, test review, and architecture review (deterministic gates — ruff, purity/isolation audits, architecture_checker.py, standards, check-deps — plus a reviewer pass for non-trivial changes), and fix every bug found, whether or not it was in the scope of the change being committed.

Evidence

• Project memory feedback-review-before-every-commit (user ruling 2026-07-08): "a commit is a quality checkpoint for the whole tree, not just the diff."

Enforcement

• hook scripts/hooks/pre-commit
• gate scripts/code-review.py --min-severity
• gate scripts/architecture_checker.py check_di_instantiation

Verification

The Enforcement line above names the TRACKED path, not .git/hooks/pre-commit. It used to name the latter, and that was only ever satisfied by out-of-band local setup: rulings_lint._check_hook resolves a .git/hooks/... directive through git rev-parse --git-path, which follows core.hooksPath — an UNVERSIONED local git config. On this workstation that config points at scripts/hooks, so the check passed; in any fresh clone it does not exist, the path resolves back to a bare .git/hooks/pre-commit, and the mechanism read as missing. Measured 2026-08-08, when CI first got the canon and the rulings-lint gate failed the whole test job before a single test ran:

RUL-008: 'hook .git/hooks/pre-commit': hook path does not exist

The tracked file exists in every clone, so the mechanism is now declared where it actually lives. Activation stays bash scripts/hooks/install-git-hooks.sh, whose only job is to set core.hooksPath.

The live local hook is the TRACKED scripts/hooks/pre-commit script, wired via core.hooksPath = scripts/hooks (not the framework-generated hook .pre-commit-config.yaml would produce, which is unreferenced dead configuration — grep-verified, nothing invokes pre-commit run or .pre-commit-config.yaml anywhere in the repo). On every local git commit it runs ruff check --fix plus code-review.py --min-severity ERROR (files under src/) and test-review.py --min-severity WARNING (files under tests//end2end/) against staged files only, and blocks the commit on any hit. architecture_checker.py --verbose, serialize_codebase_ast.py check-deps --include-tests, and serialize_codebase_ast.py standards are real gates but run in CI (.github/workflows/ci.yml) on push, and on demand via scripts/health_check.py — not on every local commit.