#!/usr/bin/env bash
# check.sh — the aggregated DETERMINISTIC dev gate for security-gate itself (NOT the PREVENT gate that runs on
# the user's app repos — that is prevent/prevent.py). Runs every always-green deterministic check in one shot,
# exits non-zero on the FIRST failure. Wire as a local pre-push hook (no git remote yet → CI is moot):
#   ln -sf ../../check.sh .git/hooks/pre-push    (reversible: rm .git/hooks/pre-push)
# Gates (each is exit-coded, no LLM):
#   1. pytest            — the full deterministic suite (resolver/gate/emit/routing/registry/oracle units)
#   2. ledger.py --check — structural coverage oracle (exit 1 on any blind-spot: class 0 cells / no detector / inert ratchet)
#   3. bench.py --routing — specialist-routing recall (exit 1 on a MISS; baseline-excluded, ARCHITECTURE §10)
#   4. bench.py --solutions — SolutionAdapter conformance (exit 1 on a MISS; blind-spot classes reported, non-fatal)
#   5. recall_gate.py — measured-recall RATE gate (#5): every stored rate is k>=3 AND bound to the current
#                       detector prompt hash (exit 1 on a single-run / STALE / malformed / unknown-cell record)
#   6. recall_gate.py (precision) — anti-canary GREEN-on-safe RATE gate (#7): same binary, SECOND invocation over
#                       domains/security/recall/precision_records.json. STALE on prompt drift = the precision teeth.
set -uo pipefail
cd "$(dirname "$0")" || exit 2
fail=0
run() {  # run <label> <cmd...>
  local label="$1"; shift
  echo "── $label ──"
  if "$@"; then echo "  PASS: $label"; else echo "  FAIL: $label (exit $?)"; fail=1; fi
}
run "pytest"          python3 -m pytest -q
run "ledger --check"  python3 ledger.py --check
run "bench --routing" python3 bench.py --routing
run "bench --solutions" python3 bench.py --solutions
run "recall-gate"     python3 recall_gate.py
run "precision-gate"  python3 recall_gate.py --records domains/security/recall/precision_records.json
if [ "$fail" -ne 0 ]; then
  echo "check.sh: DEV GATE FAILED — do not push."
  exit 1
fi
echo "check.sh: all deterministic dev gates green."