| #!/bin/bash | |
| # SOV-KERNEL-MONSTER: ASP Enforcer — runs inside sov-git-server on every push. | |
| set -euo pipefail | |
| while read old_rev new_rev ref_name; do | |
| # 1. Verify all commits are Ed25519/GPG signed | |
| git log --pretty="%H %G?" "${old_rev}..${new_rev}" | while read commit_hash sig_status; do | |
| if [ "$sig_status" != "G" ] && [ "$sig_status" != "U" ]; then | |
| echo "[ASP VIOLATION] Unsigned commit: $commit_hash" >&2 | |
| exit 1 | |
| fi | |
| done | |
| # 2. Prolog ASP constraint verification | |
| swipl -q -f /data/gitea/custom/hooks/verify_asp.pl \ | |
| -g "verify_push('${new_rev}', '${ref_name}')" \ | |
| -t halt | |
| if [ $? -ne 0 ]; then | |
| echo "[ASP VIOLATION] Prolog verification failed. Push rejected." >&2 | |
| exit 1 | |
| fi | |
| # 3. Intercol contract breaking-change check | |
| if git diff --name-only "${old_rev}" "${new_rev}" 2>/dev/null | grep -q "^contracts/"; then | |
| echo "[INTERCOL] Contract change detected — running breaking change analysis..." >&2 | |
| # buf breaking --against ".git#branch=main" --path contracts/ | |
| echo "[INTERCOL] Passed (stub — wire buf CLI for enforcement)." >&2 | |
| fi | |
| done | |
| exit 0 | |