feat(#1169): wire ship:pre security gate via render-hooks (ADR-857 phase 6)

Part of the ADR-857 phase-6 migration (#1169, epic #857) — not a shipped bug fix. The capability system (registry, render-hooks, gates, capability-state) lives only on next / 1.5.0-rc; npm latest is 1.4.5 and contains none of it, so no released user can hit this.

The security capability declares a blocking gates@ship:pre hook (when=workflow.security_enforcement, predicate SECURITY.md.threats_open==0), but ship.md never called `loop render-hooks ship:pre` and had no inline fallback, so the declared gate never fired. Wire it into ship.md preflight_checks via the render-hooks idiom — fail-closed: the ship blocks unless threats_open is exactly 0.

Add a phase-6 conformance assertion that every declared hook point has a render-hooks call site; execute:wave:post (ui_safety_gate) stays in KNOWN_UNWIRED pending its unimplemented ui.safety-gate check.

Part of #1169. Refs #857.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/phase6-capstone-conformance.test.cjs

@@ -105,4 +105,44 @@ describe('ADR-857 Phase 6 capstone conformance (#1139)', () => {
       assert.ok(baseline[fileName] > 0, `${fileName} baseline must be positive`);
     }
   });
+
+  test('every declared capability hook point has a render-hooks call site in the host loop (#1169)', () => {
+    // Points whose host call site is intentionally not yet wired, mapped to the
+    // issue tracking the gap. execute:wave:post (ui.gates / ui_safety_gate) also
+    // needs its `ui.safety-gate` check implemented before it can be wired — #1169.
+    const KNOWN_UNWIRED = { 'execute:wave:post': '#1169' };
+
+    const declaredPoints = new Set();
+    for (const cap of Object.values(registry.capabilities)) {
+      for (const group of ['steps', 'gates', 'contributions']) {
+        for (const hook of cap[group] || []) {
+          if (hook.point) declaredPoints.add(hook.point);
+        }
+      }
+    }
+
+    // Scan only the host loop files (not every workflow): a `render-hooks`
+    // mention in a non-host workflow must not mask a lost host call site.
+    const callSites = new Set();
+    const reCall = /loop render-hooks\s+([a-z:]+)/g;
+    for (const relativePath of HOST_LOOP_FILES) {
+      const content = readRepoFile(relativePath);
+      let m;
+      while ((m = reCall.exec(content))) callSites.add(m[1]);
+    }
+
+    for (const point of [...declaredPoints].sort()) {
+      if (point in KNOWN_UNWIRED) {
+        assert.ok(
+          !callSites.has(point),
+          `${point} is listed in KNOWN_UNWIRED (${KNOWN_UNWIRED[point]}) but now HAS a render-hooks call site — remove it from the allowlist.`,
+        );
+        continue;
+      }
+      assert.ok(
+        callSites.has(point),
+        `Capability hooks declare point "${point}" but no workflow calls \`gsd_run loop render-hooks ${point}\` — hooks at that point can never fire (#1169). Wire a call site or add the point to KNOWN_UNWIRED with its tracking issue.`,
+      );
+    }
+  });
 });

tests/workflow-size-baseline.json

@@ -69,7 +69,7 @@
   "settings-advanced.md": 39621,
   "settings-integrations.md": 15801,
   "settings.md": 32133,
-  "ship.md": 20896,
+  "ship.md": 22534,
   "sketch-wrap-up.md": 14223,
   "sketch.md": 19960,
   "spec-phase.md": 23094,