fix(pro): check now enforces the doctrine it prints

An agent used the tool for real and found check exits 0 on detected
drift by default. With stock defaults neither the permissive branch nor
the strict branch fired, so it printed DNA DRIFT DETECTED and fell
through to exit 0. A CI job running plain check passed on a drifting
repository — the exact failure a fail-closed governance tool exists to
prevent, and the opposite of the module's own Law 3.

Fail-closed is now the default. Permissive (CHRONOLITH_MODE=permissive)
is the only escape, and the message names it correctly; the old message
told users to set CHRONOLITH_MODE=strict, which was already the default
and changed nothing.

Making the default strict exposed a second bug: report[security]
collapsed any finding into danger, so check halted on the untracked
sovereign keys sovereign-init creates. The tool told you to make a key
and then failed you for having one. Severity is now respected — only a
tracked key in the index is danger.

Also: the pre-push hook wrote a bare python and a frozen absolute path,
unusable under git-bash on Windows; it now calls sys.executable -m. And
the status panel printed Status: Status: OK above the halt check,
announcing OK on a halting run; the verdict is computed first and the
word matches the exit code.

Regression tests cover fail-closed default, --accept, permissive, the
hook, and the panel.

Author: SteveBlackbeard

CHANGELOG.md

@@ -2,6 +2,31 @@
 
 All notable changes to the Chronolith ecosystem will be documented in this file.
 
+## [Unreleased]
+### The tool did not enforce its own doctrine
+- **`check` now fails closed by default.** With stock defaults — not permissive,
+  no `--strict` — the old exit logic printed the drift and then fell through to
+  exit 0. A CI job running plain `chronolith-pro check` passed on a drifting
+  repository, the exact failure the tool exists to catch and the opposite of its
+  own Law 3. Safety is now opt-out: `CHRONOLITH_MODE=permissive` is the only way
+  past an inconsistency. `--strict` is a deprecated no-op. Found by an agent
+  running the tool for real, not by reading it.
+- **Severity is respected.** A finding of any kind was collapsed into a security
+  failure, so `check` halted on the very sovereign keys `sovereign-init` creates
+  — it told you to make a key, then condemned you for having it. Only a
+  danger-level finding (a tracked key in the index) now fails the run; an
+  untracked local key is a warning.
+- **The pre-push hook is portable.** It wrote a bare `python` and a hardcoded
+  absolute site-packages path; under git-bash on Windows `python` is often not
+  on PATH, so the hook died with "command not found" and blocked every push
+  regardless of DNA state. It now invokes `sys.executable -m` the module.
+- **The status panel cannot lie.** It printed a hardcoded `Status: Status: OK`
+  above the fail-closed check, announcing OK on a run about to halt. The verdict
+  is computed first; the panel says OK or INCONSISTENT to match the exit code.
+- Regression tests cover all of the above, including the reproduction that
+  exposed the exit-0 bug.
+
+
 ## [3.2.1] - 2026-07-18
 ### Commands that never ran, and checks that never passed
 - **`chain` worked for the first time.** It rendered the transparency chain

chronolith-pro/chronolith_pro/chronolith/run_chronolith_cycle.py

@@ -228,7 +228,20 @@ def init(
     if not no_hook:
         hook_path = root / ".git" / "hooks" / "pre-push"
         hook_path.parent.mkdir(parents=True, exist_ok=True)
-        hook_content = f"#!/bin/sh\n# Chronolith Pro Evolution Hook\necho '[*] Guarding Pro DNA...'\npython \"{Path(__file__).resolve()}\" check --strict || exit 1\n"
+        # Invoke through this interpreter, as a module. The old hook wrote a
+        # bare `python` and a hardcoded absolute site-packages path: under
+        # git-bash on Windows `python` is often not on PATH, so the hook died
+        # with "command not found" and blocked every push regardless of DNA
+        # state — fail-closed by accident, and unusable. sys.executable is the
+        # interpreter that installed the package; -m avoids the frozen path.
+        # `--strict` is dropped: check fails closed by default now.
+        py = Path(sys.executable).as_posix()
+        hook_content = (
+            "#!/bin/sh\n"
+            "# Chronolith Pro Evolution Hook\n"
+            "echo '[*] Guarding Pro DNA...'\n"
+            f'"{py}" -m chronolith_pro.chronolith.run_chronolith_cycle check || exit 1\n'
+        )
         hook_path.write_text(hook_content, encoding="utf-8")
         if os.name != "nt": os.chmod(hook_path, 0o755)
         console.log(f"[bold green][✔][/bold green] Pro Push Hook installed.")
@@ -237,7 +250,7 @@ def init(
 @app.command()
 def check(
     repo_root: Path = typer.Option(".", "--repo-root", help="Project root directory."),
-    strict: bool = typer.Option(False, "--strict", help="Fail with exit code 1 if drift detected."),
+    strict: bool = typer.Option(False, "--strict", help="Deprecated no-op: check now fails closed by default. Set CHRONOLITH_MODE=permissive to continue past inconsistencies instead."),
     scan_source: bool = typer.Option(True, "--scan-source/--no-scan-source", help="Scan source code files alongside documentation."),
     accept: bool = typer.Option(False, "--accept", help="Accept the current content as the new canonical baseline (like `git commit`): advances the signed baseline and appends a transparency-chain entry even though the root changed. Without this, an intentional edit is reported as drift and the baseline is NOT advanced."),
 ):
@@ -371,7 +384,14 @@ def check(
         "doc_files": len(doc_files),
         "source_files": len(source_files),
         "doc_parity": doc_parity["status"],
-        "security": "ok" if not secret_scan["findings"] else "danger",
+        # Respect severity. The scanner separates a tracked key in the index
+        # (danger — an actual leak) from an untracked local key (warning — where
+        # keys are supposed to live). Collapsing both into "danger" made the
+        # tool halt on the very sovereign keys `sovereign-init` creates: it
+        # tells you to make a key, then condemns you for having it. Only a
+        # danger-level finding is a security failure.
+        "security": "danger" if any(f.get("status") == "danger" for f in secret_scan["findings"])
+                    else ("warning" if secret_scan["findings"] else "ok"),
         "findings": len(secret_scan["findings"]),
         "dna_drift": dna_drift,
         "signature_tampered": signature_tampered,
@@ -386,27 +406,41 @@ def check(
     report_path.write_text(json.dumps(report, indent=2), encoding="utf-8")
     logger.info("Cycle complete", extra={"merkle_root": merkle_root})
 
+    # Compute the verdict BEFORE printing the status line, so the panel cannot
+    # say OK on a run that is about to halt. The old panel printed a hardcoded
+    # "Status: OK" (doubled label and all) above the fail-closed check, so a
+    # halting run announced OK and then aborted.
+    has_issues = report["doc_parity"] != "ok" or report["security"] == "danger" or dna_drift or signature_tampered or not chain_ok
+    status_word = "INCONSISTENT" if has_issues else "OK"
+    status_colour = "red" if has_issues else "green"
+
     console.print(Panel(
-        f"[bold magenta]Pro Status:[/bold magenta] "
-        f"Status: OK | "
+        f"[bold {status_colour}]Pro Status: {status_word}[/bold {status_colour}] | "
         f"Merkle: `{merkle_root[:16]}...` | "
         f"Nucleotides: {len(all_nucleotides)} "
         f"({len(doc_files)} docs + {len(source_files)} source) | "
         f"Entropy: {total_entropy:.2f}",
         title="Solemne Guardian", expand=False
     ))
-    
+
     if report["security"] == "danger":
         console.print(f"[bold red][!][/bold red] SECURITY ALERT: {len(secret_scan['findings'])} secrets detected in lineage!")
         for finding in secret_scan["findings"]:
             console.print(f"      [red]{finding['type']}[/red] in [italic]{finding['file']}[/italic]")
-    
-    # v3.0.3: Permissive mode — warn but do not halt
-    has_issues = report["doc_parity"] != "ok" or report["security"] == "danger" or dna_drift or signature_tampered or not chain_ok
+
+    # Fail closed by default. The module's own doctrine (Law 3) is "any
+    # inconsistency halts the pipeline with exit 1", and the earlier code did
+    # the opposite: with stock defaults — not permissive, no --strict — this
+    # branch printed the drift and then fell through to exit 0. A CI job
+    # running plain `check` passed on a drifting repository, which is the exact
+    # failure a governance tool exists to prevent.
+    #
+    # Safety is now opt-out, never opt-in: the only way to continue past an
+    # inconsistency is to ask for it explicitly with CHRONOLITH_MODE=permissive.
     if has_issues:
         if PERMISSIVE_MODE:
-            console.print("[bold yellow][!][/bold yellow] PERMISSIVE MODE: Drift detected but pipeline continues. Set CHRONOLITH_MODE=strict for fail-closed.")
-        elif strict:
+            console.print("[bold yellow][!][/bold yellow] PERMISSIVE MODE: inconsistency detected, pipeline continues (CHRONOLITH_MODE=permissive). Unset it for fail-closed.")
+        else:
             console.print("[bold red][!][/bold red] FAIL-CLOSED: Project state inconsistent. Halting.")
             raise typer.Exit(code=1)
 

chronolith-pro/tests/test_verify.py

@@ -67,6 +67,41 @@ def _fingerprint(self) -> str:
         _p, pub = ac.load_sovereign_keys(self.root)
         return sv.key_fingerprint(pub)
 
+    def test_check_fails_closed_on_drift_by_default(self):
+        """Plain `check` must exit 1 when a governed file changed.
+
+        The previous logic only halted under --strict or refused to halt under
+        permissive; with stock defaults it printed the drift and exited 0. A CI
+        job running plain `check` passed on a drifting repository — the exact
+        failure this tool exists to catch, and the opposite of its own Law 3.
+
+        Found by an agent running the tool for real, not by reading it.
+        """
+        (self.root / "DOC.md").write_text("# Canonical\nan unaccepted edit\n", encoding="utf-8")
+        result = self._run("check", "--no-scan-source")
+        self.assertEqual(result.returncode, 1, result.stdout + result.stderr)
+        self.assertIn("FAIL-CLOSED", result.stdout)
+
+    def test_check_accept_advances_baseline_and_exits_zero(self):
+        """--accept is the sanctioned way to record an intentional edit."""
+        (self.root / "DOC.md").write_text("# Canonical\nan intentional edit\n", encoding="utf-8")
+        accepted = self._run("check", "--no-scan-source", "--accept")
+        self.assertEqual(accepted.returncode, 0, accepted.stdout + accepted.stderr)
+        # And the baseline actually moved: a plain check is clean afterward.
+        after = self._run("check", "--no-scan-source")
+        self.assertEqual(after.returncode, 0, after.stdout + after.stderr)
+
+    def test_permissive_mode_is_the_only_escape_hatch(self):
+        """CHRONOLITH_MODE=permissive continues past drift; nothing else does."""
+        import os
+        (self.root / "DOC.md").write_text("# Canonical\ndrift\n", encoding="utf-8")
+        env = dict(os.environ, CHRONOLITH_MODE="permissive")
+        result = subprocess.run(
+            [sys.executable, str(SCRIPT), "check", "--no-scan-source", "--repo-root", str(self.root)],
+            capture_output=True, text=True, encoding="utf-8", errors="replace", env=env,
+        )
+        self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+
     def test_chain_command_runs(self):
         """`chain` renders the transparency chain without crashing.