feat: Comprehensive CI/CD hooks and workflows implementation

.githooks/commit-msg

@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: MPL-2.0
+# Hyperpolymath Estate Commit Message Hook
+
+set -euo pipefail
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+NC='\033[0m'
+
+COMMIT_MSG_FILE="$1"
+COMMIT_MSG=$(cat "$COMMIT_MSG_FILE")
+CURRENT_BRANCH=$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo "unknown")
+ERRORS=0
+WARNINGS=0
+
+add_error() { echo -e "${RED}[commit-msg] ERROR: $1${NC}" >&2; ERRORS=$((ERRORS + 1)); }
+add_warning() { echo -e "${YELLOW}[commit-msg] WARNING: $1${NC}" >&2; WARNINGS=$((WARNINGS + 1)); }
+
+echo -e "${BLUE}[commit-msg] Validating for $CURRENT_BRANCH${NC}"
+
+# CHECK 1: Non-empty
+[ -z "$COMMIT_MSG" ] && { add_error "Commit message is empty"; exit 1; }
+
+# CHECK 2: Conventional commits format
+if ! echo "$COMMIT_MSG" | head -1 | grep -qE '^(feat|fix|docs|style|refactor|test|chore|build|ci|perf|revert)(\([a-z0-9-]+(\s*,\s*[a-z0-9-]+)*\))?:\s'; then
+  add_error "Does not follow conventional commits format"
+  echo "Expected: type(scope): description" >&2
+  echo "Types: feat, fix, docs, style, refactor, test, chore, build, ci, perf, revert" >&2
+  exit 1
+fi
+
+# CHECK 3: Issue reference (warning)
+! echo "$COMMIT_MSG" | grep -qE '(#[0-9]+|github\.com/.*/(issues|pull)/[0-9]+)' && \
+  add_warning "Should reference an issue or PR"
+
+# CHECK 4: Subject length
+SUBJECT=$(echo "$COMMIT_MSG" | head -1)
+SUBJECT_LENGTH=${#SUBJECT}
+[ $SUBJECT_LENGTH -gt 72 ] && { add_error "Subject exceeds 72 chars (${SUBJECT_LENGTH})"; exit 1; }
+[ $SUBJECT_LENGTH -gt 50 ] && add_warning "Subject exceeds 50 chars (${SUBJECT_LENGTH})"
+
+# CHECK 5: Body for non-trivial changes
+LINE_COUNT=$(echo "$COMMIT_MSG" | wc -l)
+COMMIT_TYPE=$(echo "$COMMIT_MSG" | head -1 | cut -d'(' -f1 | xargs)
+case "$COMMIT_TYPE" in
+  chore|style|docs) NEEDS_BODY=false;;
+  *) NEEDS_BODY=true;;
+esac
+echo "$COMMIT_MSG" | head -1 | grep -qE '^(Merge|Revert)' && NEEDS_BODY=false
+
+[ "$NEEDS_BODY" = true ] && [ $LINE_COUNT -eq 1 ] && \
+  add_warning "Non-trivial changes should have a commit body"
+
+# CHECK 6: Trailing whitespace
+echo "$SUBJECT" | grep -qE '[[:space:]]+$' && { add_error "Subject has trailing whitespace"; exit 1; }
+
+# CHECK 7: Lowercase type
+FIRST_WORD=$(echo "$COMMIT_MSG" | head -1 | cut -d'(' -f1 | cut -d':' -f1 | xargs)
+LOWER_FIRST=$(echo "$FIRST_WORD" | tr '[:upper:]' '[:lower:]')
+[ "$FIRST_WORD" != "$LOWER_FIRST" ] && { add_error "Type must be lowercase: '$LOWER_FIRST'" ; exit 1; }
+
+echo ""
+if [ $ERRORS -gt 0 ]; then
+  echo -e "${RED}[commit-msg] FAILED with $ERRORS error(s)${NC}" >&2
+  echo "Override with: git commit --no-verify"
+  exit 1
+else
+  [ $WARNINGS -gt 0 ] && echo -e "${YELLOW}[commit-msg] Accepted with $WARNINGS warning(s)${NC}"
+  echo -e "${GREEN}[commit-msg] ✅ Valid commit message${NC}"
+  exit 0
+fi

.githooks/install.sh

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: MPL-2.0
+# Hyperpolymath Estate Git Hooks Installer
+
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+
+if ! git -C "$ROOT" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+  echo "ERROR: Not a git repository: $ROOT" >&2
+  exit 1
+fi
+
+GITDIR="$(git -C "$ROOT" rev-parse --git-common-dir 2>/dev/null || git -C "$ROOT" rev-parse --git-dir 2>/dev/null)"
+case "$GITDIR" in /*) ;; *) GITDIR="$ROOT/$GITDIR" ;; esac
+
+[ -d "$ROOT/.githooks" ] || { echo "ERROR: .githooks directory not found" >&2; exit 1; }
+
+CURRENT_HOOKS_PATH=$(git -C "$ROOT" config core.hooksPath 2>/dev/null || echo "")
+
+if [ "$CURRENT_HOOKS_PATH" = ".githooks" ]; then
+  echo "✅ Hooks already installed"
+  ls -la "$ROOT/.githooks/" | grep -E '\.sh$|^d' | tail -n +2 | while read -r line; do
+    [ -x "$ROOT/.githooks/$(echo $line | awk '{print $NF}')" ] && echo "  ✅ $(echo $line | awk '{print $NF}')"
+  done
+  exit 0
+fi
+
+echo "Installing git hooks for $ROOT..."
+git -C "$ROOT" config core.hooksPath .githooks
+chmod +x "$ROOT"/.githooks/*
+
+if [ "$(git -C "$ROOT" config core.hooksPath)" = ".githooks" ]; then
+  echo "✅ Hooks installed successfully"
+  echo "Test with: echo 'test' > test.txt && git add test.txt && git commit -m 'test'"
+  exit 0
+else
+  echo "❌ Installation failed" >&2
+  exit 1
+fi

.githooks/post-checkout

@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: MPL-2.0
+# Hyperpolymath Estate Post-checkout Hook
+
+set -euo pipefail
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+CYAN='\033[0;36m'
+NC='\033[0m'
+
+REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
+CHECKOUT_FLAG="${3:-0}"
+
+# Only run on branch checkouts
+[ "$CHECKOUT_FLAG" != "1" ] && exit 0
+
+echo -e "${CYAN}============================================${NC}"
+echo -e "${CYAN}  Hyperpolymath Post-checkout Hook${NC}"
+echo -e "${CYAN}============================================${NC}"
+
+CURRENT_BRANCH=$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo "unknown")
+echo -e "${BLUE}[post-checkout]${NC} Checked out: $CURRENT_BRANCH"
+
+# Branch-specific setup
+BRANCH_SETUP="$REPO_ROOT/scripts/setup-${CURRENT_BRANCH//\//-}.sh"
+[ -f "$BRANCH_SETUP" ] && [ -x "$BRANCH_SETUP" ] && {
+  echo -e "${BLUE}[post-checkout]${NC} Running branch setup..."
+  bash "$BRANCH_SETUP" 2>&1 && echo "✅ Branch setup completed" || echo "⚠️  Branch setup failed" >&2
+}
+
+# Virtualenv
+[ -d "$REPO_ROOT/.venv" ] && echo -e "${YELLOW}[post-checkout]${NC} Activate: source .venv/bin/activate${NC}"
+[ -d "$REPO_ROOT/venv" ] && echo -e "${YELLOW}[post-checkout]${NC} Activate: source venv/bin/activate${NC}"
+[ -f "$REPO_ROOT/pyproject.toml" ] && [ ! -d "$REPO_ROOT/.venv" ] && [ ! -d "$REPO_ROOT/venv" ] && \
+  echo -e "${YELLOW}[post-checkout]${NC} Setup: python -m venv .venv && source .venv/bin/activate${NC}"
+
+# Node.js
+[ -f "$REPO_ROOT/package.json" ] && [ ! -d "$REPO_ROOT/node_modules" ] && \
+  echo -e "${YELLOW}[post-checkout]${NC} Install: bun install or npm install${NC}"
+
+# Rust
+[ -f "$REPO_ROOT/Cargo.toml" ] && echo -e "${YELLOW}[post-checkout]${NC} Build: cargo build${NC}"
+
+# Submodules
+[ -f "$REPO_ROOT/.gitmodules" ] && git submodule status 2>/dev/null | grep -q '^[-+]' && \
+  echo -e "${YELLOW}[post-checkout]${NC} Update submodules: git submodule update --init --recursive${NC}"
+
+# Hooks check
+CURRENT_HOOKS=$(git config core.hooksPath 2>/dev/null || echo "")
+[ -z "$CURRENT_HOOKS" ] && [ -d "$REPO_ROOT/.githooks" ] && \
+  echo -e "${YELLOW}[post-checkout]${NC} Install hooks: git config core.hooksPath .githooks${NC}"
+
+# Protected branch warning
+for branch in main master develop release production staging; do
+  [ "$CURRENT_BRANCH" = "$branch" ] && {
+    echo -e "${YELLOW}[post-checkout]${NC} ⚠️  Protected branch: $branch - use PRs${NC}"
+    break
+  }
+done
+
+# Last commit
+LAST_COMMIT=$(git log -1 --pretty=format:"%h - %an, %ar : %s" 2>/dev/null || echo "")
+[ -n "$LAST_COMMIT" ] && echo -e "${BLUE}[post-checkout]${NC} Last: $LAST_COMMIT"
+
+echo ""
+echo -e "${GREEN}[post-checkout] ✅ All actions completed${NC}"
+exit 0

.githooks/post-merge

@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: MPL-2.0
+# Hyperpolymath Estate Post-merge Hook
+
+set -euo pipefail
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+CYAN='\033[0;36m'
+NC='\033[0m'
+
+REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
+CURRENT_BRANCH=$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo "unknown")
+
+echo -e "${CYAN}============================================${NC}"
+echo -e "${CYAN}  Hyperpolymath Post-merge Hook${NC}"
+echo -e "${CYAN}  Branch: $CURRENT_BRANCH${NC}"
+echo -e "${CYAN}============================================${NC}"
+
+# Main branch auto-actions
+if ([ "$CURRENT_BRANCH" = "main" ] || [ "$CURRENT_BRANCH" = "master" ]) && [ -n "${1:-}" ]; then
+  # Check for deployment scripts
+  for script in deploy.sh scripts/post-merge.sh; do
+    [ -f "$REPO_ROOT/$script" ] && [ -x "$REPO_ROOT/$script" ] && {
+      echo -e "${BLUE}[post-merge]${NC} Running $script..."
+      bash "$REPO_ROOT/$script" 2>&1 && echo "✅ $script completed" || echo "⚠️  $script failed (non-blocking)" >&2
+    }
+  done
+
+  # Justfile support
+  [ -f "$REPO_ROOT/Justfile" ] && command -v just &>/dev/null && \
+    just --summary 2>/dev/null | grep -q "post-merge" && {
+      echo -e "${BLUE}[post-merge]${NC} Running just post-merge..."
+      just post-merge 2>&1 && echo "✅ just post-merge completed" || echo "⚠️  just failed (non-blocking)" >&2
+    }
+
+  # Makefile support
+  ([ -f "$REPO_ROOT/Makefile" ] || [ -f "$REPO_ROOT/makefile" ]) && \
+    (grep -q "post-merge:" "$REPO_ROOT/Makefile" 2>/dev/null || grep -q "post-merge:" "$REPO_ROOT/makefile" 2>/dev/null) && {
+      echo -e "${BLUE}[post-merge]${NC} Running make post-merge..."
+      make post-merge 2>&1 && echo "✅ make post-merge completed" || echo "⚠️  make failed (non-blocking)" >&2
+    }
+fi
+
+# Submodule init
+[ -f "$REPO_ROOT/.gitmodules" ] && {
+  echo -e "${BLUE}[post-merge]${NC} Initializing submodules..."
+  git submodule update --init --recursive 2>&1 && echo "✅ Submodules initialized" || \
+    echo "⚠️  Submodule init issue (non-blocking)" >&2
+}
+
+# Environment reminders
+[ -d "$REPO_ROOT/.venv" ] && echo -e "${YELLOW}[post-merge]${NC} Virtualenv: source .venv/bin/activate${NC}"
+[ -d "$REPO_ROOT/venv" ] && echo -e "${YELLOW}[post-merge]${NC} Virtualenv: source venv/bin/activate${NC}"
+[ -f "$REPO_ROOT/package.json" ] && [ ! -d "$REPO_ROOT/node_modules" ] && \
+  echo -e "${YELLOW}[post-merge]${NC} Install deps: bun install or npm install${NC}"
+
+# Hook installation check
+CURRENT_HOOKS=$(git config core.hooksPath 2>/dev/null || echo "")
+[ -z "$CURRENT_HOOKS" ] && [ -d "$REPO_ROOT/.githooks" ] && \
+  echo -e "${YELLOW}[post-merge]${NC} Install hooks: git config core.hooksPath .githooks${NC}"
+
+echo ""
+echo -e "${GREEN}[post-merge] ✅ All post-merge actions completed${NC}"
+exit 0

.githooks/pre-commit

@@ -0,0 +1,107 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: MPL-2.0
+# Hyperpolymath Estate Pre-commit Hook
+# Source: https://github.com/hyperpolymath/standards
+#
+# This hook enforces estate-wide standards BEFORE commit is finalized.
+# It runs on all staged files only (not the entire repo) for performance.
+#
+# Enable: git config core.hooksPath .githooks
+# Or run: .githooks/install.sh
+#
+# Override: git commit --no-verify
+
+set -euo pipefail
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+NC='\033[0m'
+
+ERRORS=0
+
+REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
+HOOK_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+default_validator() {
+  local pattern="$1" error_msg="$2"
+  local STAGED_FILES
+  STAGED_FILES=$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null || true)
+  [ -z "$STAGED_FILES" ] && return 0
+  local matching_files=$(echo "$STAGED_FILES" | grep -E "$pattern" || true)
+  if [ -n "$matching_files" ]; then
+    echo -e "${RED}[pre-commit] $error_msg${NC}" >&2
+    echo "$matching_files" >&2
+    ERRORS=$((ERRORS + 1))
+    return 1
+  fi
+  return 0
+}
+
+run_validator() {
+  local label="$1" script="$2" scope="$3"
+  local target_files=""
+  [ "$scope" = "staged" ] && target_files=$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null || true)
+  [ -z "$target_files" ] && [ "$scope" = "staged" ] && return 0
+  [ -f "$HOOK_DIR/$script" ] || { echo -e "${YELLOW}[pre-commit] ($label) validator missing${NC}" >&2; return 0; }
+  echo -e "${BLUE}[pre-commit]${NC} Running ${label}..."
+  if ! INPUT_PATH="$REPO_ROOT" INPUT_STAGED_FILES="$target_files" bash "$HOOK_DIR/$script"; then
+    ERRORS=$((ERRORS + 1))
+    return 1
+  fi
+  return 0
+}
+
+echo -e "${BLUE}========================================${NC}"
+echo -e "${BLUE}Hyperpolymath Pre-commit Checks${NC}"
+echo -e "${BLUE}========================================${NC}"
+
+# Language Policy
+default_validator '\.(ts|tsx)$' "TypeScript files not allowed. Use AffineScript instead."
+default_validator '\.go$' "Go files not allowed. Use Rust instead."
+default_validator '\.py$' "Python files not allowed (except Ansible). Rewrite in Rust/AffineScript."
+default_validator '(^|/)Makefile(\.|$)|\.mk$' "Makefiles not allowed. Use Mustfile/justfile instead."
+default_validator '\.(java|kt|kts)$' "Java/Kotlin files not allowed. Use Rust/Tauri/Dioxus instead."
+default_validator '\.swift$' "Swift files not allowed. Use Tauri/Dioxus instead."
+
+# A2ML + K9 + SPDX validation
+run_validator "A2ML manifests" "validate-a2ml.sh" "staged"
+run_validator "K9 contracts" "validate-k9.sh" "staged"
+run_validator "SPDX headers" "validate-spdx.sh" "staged"
+
+# Workflow validation
+run_validator "Workflow SPDX headers" "validate-spdx-workflows.sh" "staged"
+run_validator "Workflow SHA-pinning" "validate-sha-pins.sh" "staged"
+run_validator "Workflow permissions" "validate-permissions.sh" "staged"
+run_validator "CodeQL configuration" "validate-codeql.sh" "staged"
+run_validator "Bot directives" "validate-bot-directives.sh" "staged"
+
+# Registry drift guard
+if [ -f "$REPO_ROOT/scripts/build-registry.sh" ]; then
+  echo -e "${BLUE}[pre-commit]${NC} Checking registry drift..."
+  if ! bash "$REPO_ROOT/scripts/build-registry.sh" --check >/dev/null 2>&1; then
+    echo -e "${RED}[pre-commit] REGISTRY.a2ml / TOPOLOGY.adoc are stale${NC}" >&2
+    echo "  Fix: bash scripts/build-registry.sh && git add .machine_readable/REGISTRY.a2ml TOPOLOGY.adoc" >&2
+    ERRORS=$((ERRORS + 1))
+  fi
+fi
+
+# Canonical names guard
+if [ -f "$REPO_ROOT/scripts/check-canonical-names.sh" ]; then
+  echo -e "${BLUE}[pre-commit]${NC} Checking canonical names..."
+  if ! bash "$REPO_ROOT/scripts/check-canonical-names.sh" HEAD >/dev/null 2>&1; then
+    echo -e "${RED}[pre-commit] Deprecated name reintroduced${NC}" >&2
+    ERRORS=$((ERRORS + 1))
+  fi
+fi
+
+echo ""
+if [ $ERRORS -gt 0 ]; then
+  echo -e "${RED}Pre-commit check FAILED with $ERRORS error(s)${NC}"
+  echo "See: https://github.com/hyperpolymath/standards"
+  exit 1
+else
+  echo -e "${GREEN}✅ All pre-commit checks PASSED${NC}"
+  exit 0
+fi