TODO: Pre-merge infra validation hooks in claude-custom

todo-pre-merge-infra-validation Todo

open todo

Project

Problem

Currently no pre-merge validation for infrastructure changes. Kustomize overlays and terraform changes are only tested after merge, creating Change Failure Rate risk. The sop-platform-tf-changes SOP documents the desired validation patterns but enforcement is manual.

Hook Spec (17a) — Pre-merge infra validation gate

Trigger

PreToolUse on mcp__forgejo__merge_approved_pr — same event as block-mcp-merge.sh but a separate check.

Logic

File

claude-custom/hooks/check-infra-validation.sh

Registration

Evidence Patterns to Match

Repo	Evidence Pattern	Where to Look
<code>pal-e-platform</code>	CI green (plan step passed)	Woodpecker API — pipeline status for PR
<code>pal-e-services</code>	<code>tofu plan</code> or <code>Plan:</code> in PR body/comments	Forgejo API — PR body + comments
<code>pal-e-deployments</code>	<code>kubectl kustomize</code> or <code>kustomize build</code> in PR body/comments	Forgejo API — PR body + comments

CI Spec (17b) — pal-e-deployments .woodpecker.yaml

Add CI validation to pal-e-deployments so kustomize overlays are checked on every PR:

SOP Updates (17c + 17d)

COMPLETED — see sop-incident-response and sop-db-migration-recovery updates.

Acceptance Criteria

pal-e-deployments has CI that validates kustomize overlays on every PR
pal-e-services has a reminder/hook that checks for tofu plan evidence before merge approval
Hook registered in hook-catalog with Layer 1 (Block) classification

sop-platform-tf-changes — updated SOP with pre-merge patterns
hook-catalog — coverage gaps table identifies this gap
block-mcp-merge.sh — existing merge gate hook (17a adds a second check on same event)
claude-custom repo — hooks live here