health --strict: FAIL on diff-coupled staleness, not wall-clock (#30)

In strict mode, tracked files changed without a lattice update now
escalates to FAIL. Lone wall-clock staleness stays WARN — it belongs
at branch/repo altitude (CI, pre-push), not on individual commits.

Freshness threshold now configurable via config.yaml
(freshness_threshold_hours, default 72).

Fixes #30
Bump version to v0.2.3

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: gmoon

.githooks/pre-commit

@@ -0,0 +1,3 @@
+#!/bin/sh
+# Forkzero standard pre-commit gate. See docs/ENGINEERING.md in the forkzero workspace.
+make pre-commit

.githooks/pre-push

@@ -0,0 +1,3 @@
+#!/bin/sh
+# Forkzero standard pre-push gate. See docs/ENGINEERING.md in the forkzero workspace.
+make pre-push

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "lattice"
-version = "0.2.2"
+version = "0.2.3"
 edition = "2024"
 description = "A knowledge coordination protocol for human-agent collaboration"
 repository = "https://github.com/forkzero/lattice"

Cargo.toml

@@ -1,4 +1,4 @@
-.PHONY: fmt lint test test-all check build clean install docker-e2e pre-commit pre-push
+.PHONY: fmt fmt-check format format-check lint test test-all check build clean install docker-e2e pre-commit pre-push lattice-fresh hooks
 
 # Format code
 fmt:
@@ -8,6 +8,10 @@ fmt:
 fmt-check:
 	cargo fmt --check
 
+# Cross-repo verb aliases (every forkzero repo exposes format / format-check)
+format: fmt
+format-check: fmt-check
+
 # Run clippy lints
 lint:
 	cargo clippy --all-targets --all-features -- -D warnings
@@ -29,10 +33,24 @@ pre-commit: fmt-check lint
 	fi
 	@echo "Pre-commit checks passed."
 
-# Pre-push gate: full checks (format + lint + test + build)
-pre-push: pre-commit test build
+# Lattice staleness gate: hard-fail if .lattice is >72h behind code.
+# Time-based threshold lives at push/CI altitude, NOT pre-commit (see docs/ENGINEERING.md).
+lattice-fresh:
+	@if command -v lattice >/dev/null 2>&1; then \
+		lattice freshness --check || { echo "Lattice is stale (>72h behind code). Update .lattice before pushing."; exit 1; }; \
+	else \
+		echo "Note: lattice freshness skipped (lattice not installed)"; \
+	fi
+
+# Pre-push gate: full checks (format + lint + lattice freshness + test + build)
+pre-push: pre-commit lattice-fresh test build
 	@echo "Pre-push checks passed."
 
+# Install git hooks (Rust repo has no husky — wire core.hooksPath to committed .githooks/)
+hooks:
+	git config core.hooksPath .githooks
+	@echo "Git hooks installed (core.hooksPath=.githooks)."
+
 # Legacy alias
 check: fmt lint test
 	@echo "All checks passed!"

Makefile

@@ -3280,33 +3280,34 @@ fn run_command(command: Commands) {
                 (0, 0)
             };
 
-            // Compute verdict:
-            // FAIL: pressure + code/time signal together, or high pressure alone
-            // WARN: any single signal (code changed, stale, or some pressure)
-            // PASS: nothing flagged
-            let verdict = if (change_pressure > 0
-                && (tracked_files_changed > 0 || freshness_gap_hours > 72))
-                || change_pressure > 3
-            {
-                "FAIL"
-            } else if tracked_files_changed > 0 || freshness_gap_hours > 72 || change_pressure > 0 {
-                "WARN"
-            } else {
-                "PASS"
-            };
-
             // 4. Lint (strict mode only)
             let lint_issues = if strict {
                 lint_lattice(&root).issues.len()
             } else {
                 0
             };
 
-            // Escalate verdict if lint issues found in strict mode
-            let verdict = if strict && lint_issues > 0 {
+            // Read configurable threshold
+            let config = load_config(&root);
+            let threshold = config.freshness_threshold_hours.unwrap_or(72);
+
+            // Compute verdict:
+            // Strict mode: FAIL on diff-coupled staleness (bound files changed without lattice update)
+            //              and lint issues. Wall-clock staleness alone stays WARN.
+            // Normal mode: FAIL when pressure + signals combine. WARN on any single signal.
+            let verdict = if (strict && (lint_issues > 0 || tracked_files_changed > 0))
+                || (change_pressure > 0
+                    && (tracked_files_changed > 0 || freshness_gap_hours > threshold))
+                || change_pressure > 3
+            {
                 "FAIL"
+            } else if tracked_files_changed > 0
+                || freshness_gap_hours > threshold
+                || change_pressure > 0
+            {
+                "WARN"
             } else {
-                verdict
+                "PASS"
             };
 
             if is_json(&format) {

src/main.rs

@@ -124,6 +124,8 @@ pub struct LatticeConfig {
     pub api_key: Option<String>,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub schema_version: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub freshness_threshold_hours: Option<u64>,
 }
 
 /// The current schema version. Bump when .lattice/ format changes.