th-22d257: attest-push-hint must block, not ask

[brentrager]

Problem

The attestation system works. Nothing uses it.

last 15 merged smooai PRs  →  0 ci-attest statuses (all merged 2026-08-08)
18 transcripts that pushed today
 7 had attest-push-hint FIRE (its stderr is in the transcript)
 0 ran attest.sh
 0 used the attest:ack bypass

Agents read the warning and pushed anyway, so every one of those PRs paid full CI —
including Rust Checks at 38 minutes, which attests in ~6 seconds.

Cause

exit 1 is an ask, and an agent running in auto mode approves its own asks. The
hook's comment argued for 1 on the grounds that attesting is often the wrong call
and the agent needs to be able to say no. That reasoning holds; the mechanism
didn't. Saying no was the silent default rather than a choice.

Fix

exit 2 — a hard block whose stderr goes back to the model. Declining is unchanged
and still one appended comment: # attest:ack reason=....

Also commits a 17-case test suite. This hook shipped broken twice (.cwd resolution
in #338, the -C flag eating the push token) and the first of those had a passing
suite — it passed because the payloads were hand-written with the cwd the fix
expected instead of the shape Claude Code emits. Every payload here is built in the
real wire shape, and the cases that matter set cwd to a different repo than the
push target.

Verification

bash claude-plugins/smooth-agent/hooks/attest-push-hint.test.sh → 17 passed, 0 failed.

Not affected: this repo has no scripts/ci/attest.sh, so the hook stays silent here.

🤖 Generated with Claude Code

https://claude.ai/code/session_01L2aEsrK7js72NqYVGHh7s5

[changeset-bot]

🦋 Changeset detected

Latest commit: a4e67fb

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@smooai/smooth	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR