mrcharles
95f475c2f9
Mechanically enforces the Agent Authority policy: blocks all modifying
operations (bash, edit, write, multiedit) until an active ticket is set
via: echo '#NNN' > .crush/active-ticket
Exempts read-only tools, ticket management (redmine-cli/discourse-cli),
repo hygiene (check-rules, shellcheck), and monitoring commands.
Also: un-ignore .crush/crush.json so the hook config is tracked in git.
💘 Generated with Crush
Assisted-by: Crush:glm-5.2
79 lines
2.3 KiB
Bash
Executable File
79 lines
2.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# hooks/ticket-gate.sh — enforce ticket-first work policy
|
|
#
|
|
# Blocks modifying operations until an active ticket is established.
|
|
# The agent sets the active ticket via: echo '#NNN' > .crush/active-ticket
|
|
# And clears it when done: > .crush/active-ticket
|
|
#
|
|
# Exempts read-only and management commands (so you can create tickets,
|
|
# run audits, check status, etc.).
|
|
set -euo pipefail
|
|
|
|
TICKET_FILE="${CRUSH_PROJECT_DIR}/.crush/active-ticket"
|
|
TOOL="${CRUSH_TOOL_NAME:-}"
|
|
CMD="${CRUSH_TOOL_INPUT_COMMAND:-}"
|
|
|
|
# Read-only tools — always allowed
|
|
case "$TOOL" in
|
|
view|ls|grep|glob|agent|sourcegraph|fetch|agentic_fetch|download|lsp_diagnostics|lsp_symbols|lsp_definition|lsp_references|lsp_call_hierarchy|crush_info|crush_logs|question|todos)
|
|
exit 0
|
|
;;
|
|
esac
|
|
|
|
# For bash tool: exempt read-only and management commands
|
|
if [ "$TOOL" = "bash" ]; then
|
|
# Ticket/doc/dns management — always allowed
|
|
case "$CMD" in
|
|
*"redmine-cli"*|*"discourse-cli"*|*"dns-cli"*|*"technitium"*) exit 0 ;;
|
|
esac
|
|
# Read-only git
|
|
case "$CMD" in
|
|
*"git status"*|*"git log"*|*"git diff"*|*"git show"*|*"git branch"*) exit 0 ;;
|
|
esac
|
|
# Repo hygiene scripts
|
|
case "$CMD" in
|
|
*"check-rules"*|*"setup-hooks"*|*"shellcheck"*|*"run-tests"*) exit 0 ;;
|
|
esac
|
|
# Monitoring/probe commands
|
|
case "$CMD" in
|
|
*"tailscale status"*|*"access-matrix"*) exit 0 ;;
|
|
esac
|
|
# Setting/clearing the active ticket
|
|
case "$CMD" in
|
|
*active-ticket*) exit 0 ;;
|
|
esac
|
|
fi
|
|
|
|
# For edit/write: exempt policy/hook files (these ARE the policy)
|
|
FILE_PATH="${CRUSH_TOOL_INPUT_FILE_PATH:-}"
|
|
case "$FILE_PATH" in
|
|
*/AGENTS.md|*/check-rules.sh|*/crush.json|*/hooks/*)
|
|
if [ "$TOOL" = "write" ] || [ "$TOOL" = "edit" ] || [ "$TOOL" = "multiedit" ]; then
|
|
exit 0
|
|
fi
|
|
;;
|
|
esac
|
|
|
|
# Check for active ticket
|
|
if [ -f "$TICKET_FILE" ] && [ -s "$TICKET_FILE" ]; then
|
|
TICKET=$(cat "$TICKET_FILE")
|
|
printf '{"context":"Active ticket: %s"}\n' "$TICKET"
|
|
exit 0
|
|
fi
|
|
|
|
# No active ticket — block
|
|
cat >&2 <<'MSG'
|
|
TICKET GATE: No active ticket set.
|
|
|
|
This project requires ticket-governed work (AGENTS.md Agent Authority).
|
|
Before modifying systems or code, set the active ticket:
|
|
|
|
echo '#NNN' > .crush/active-ticket
|
|
|
|
If no ticket exists yet, create one first (redmine-cli create), then set it.
|
|
Clear the ticket when work is complete:
|
|
|
|
> .crush/active-ticket
|
|
MSG
|
|
exit 2
|