fix: report errors instead of silent exit in push and checkpoint

- Push now reports when no remote is configured, no data exists, or
  no new checkpoints to export instead of silently exiting 0
- Checkpoint validates DB health on open and surfaces checkpoint_state
  query errors instead of discarding them

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: Frank Guo

cmd/rekal/cli/checkpoint.go

@@ -63,6 +63,11 @@ func runCheckpoint(cmd *cobra.Command, gitRoot string) error {
 	}
 	defer dataDB.Close()
 
+	// Verify DB is healthy by running a simple query.
+	if _, err := dataDB.Exec("SELECT 1"); err != nil {
+		return fmt.Errorf("data DB is corrupt or unreadable: %w", err)
+	}
+
 	email := gitConfigValue("user.email")
 	entropy := rand.New(rand.NewSource(time.Now().UnixNano())) //nolint:gosec
 	newID := func() string {
@@ -90,7 +95,10 @@ func runCheckpoint(cmd *cobra.Command, gitRoot string) error {
 		hash := sha256Hex(data)
 
 		// Check cached state — skip if size + hash match.
-		cachedSize, cachedHash, found, _ := db.GetCheckpointState(dataDB, f)
+		cachedSize, cachedHash, found, csErr := db.GetCheckpointState(dataDB, f)
+		if csErr != nil {
+			return fmt.Errorf("check checkpoint state: %w", csErr)
+		}
 		if found && cachedSize == info.Size() && cachedHash == hash {
 			continue
 		}

cmd/rekal/cli/integration_test/checkpoint_e2e_test.go

@@ -459,8 +459,8 @@ func TestPush_NoBranch_Silent(t *testing.T) {
 	if err != nil {
 		t.Fatalf("push (no branch): %v", err)
 	}
-	if stderr != "" {
-		t.Errorf("push with no branch should be silent, got: %q", stderr)
+	if !strings.Contains(stderr, "no data to push") {
+		t.Errorf("push with no branch should report no data, got: %q", stderr)
 	}
 }
 
@@ -472,8 +472,8 @@ func TestPush_NoRemote_Silent(t *testing.T) {
 	if err != nil {
 		t.Fatalf("push (no remote): %v", err)
 	}
-	if strings.Contains(stderr, "pushed to origin/") {
-		t.Errorf("push with no remote should not report success, got: %q", stderr)
+	if !strings.Contains(stderr, "no remote") {
+		t.Errorf("push with no remote should report it, got: %q", stderr)
 	}
 }
 
@@ -665,12 +665,15 @@ func TestPush_NoNewCheckpoints(t *testing.T) {
 		t.Fatalf("git remote add: %v", err)
 	}
 
-	// Push with no checkpoints — should still push the orphan branch (initial empty body).
+	// Push with no checkpoints — should report no new checkpoints but still push initial branch.
 	_, stderr, err := env.RunCLI("push")
 	if err != nil {
 		t.Fatalf("push (no checkpoints): %v", err)
 	}
-	// Should push the initial orphan branch.
+	if !strings.Contains(stderr, "no new checkpoints") {
+		t.Errorf("expected 'no new checkpoints' message, got: %q", stderr)
+	}
+	// Should still push the initial orphan branch.
 	if !strings.Contains(stderr, "pushed to origin/") {
 		t.Errorf("expected push of initial branch, got: %q", stderr)
 	}

cmd/rekal/cli/push.go

@@ -40,6 +40,13 @@ func runPush(cmd *cobra.Command, gitRoot string, force bool) error {
 
 	// Check if local branch exists — if not, nothing to push.
 	if err := exec.Command("git", "-C", gitRoot, "rev-parse", "--verify", branch).Run(); err != nil {
+		fmt.Fprintln(cmd.ErrOrStderr(), "rekal: no data to push (run 'rekal checkpoint' first)")
+		return nil
+	}
+
+	// Check if remote is configured.
+	if err := exec.Command("git", "-C", gitRoot, "remote", "get-url", "origin").Run(); err != nil {
+		fmt.Fprintln(cmd.ErrOrStderr(), "rekal: no remote 'origin' configured — skipping push")
 		return nil
 	}
 
@@ -52,6 +59,8 @@ func runPush(cmd *cobra.Command, gitRoot string, force bool) error {
 		if _, err := commitWireFormat(gitRoot, body, dict); err != nil {
 			return fmt.Errorf("commit to rekal branch: %w", err)
 		}
+	} else {
+		fmt.Fprintln(cmd.ErrOrStderr(), "rekal: no new checkpoints to export")
 	}
 
 	// Compare local SHA vs remote tracking SHA — skip if identical.
@@ -61,14 +70,16 @@ func runPush(cmd *cobra.Command, gitRoot string, force bool) error {
 	}
 	remoteSHA, err := exec.Command("git", "-C", gitRoot, "rev-parse", "origin/"+branch).Output()
 	if err == nil && strings.TrimSpace(string(localSHA)) == strings.TrimSpace(string(remoteSHA)) {
-		return nil // already up to date
+		fmt.Fprintln(cmd.ErrOrStderr(), "rekal: already up to date")
+		return nil
 	}
 
 	if force {
 		forceCmd := exec.Command("git", "-C", gitRoot, "push", "--no-verify", "--force", "origin", branch)
 		forceCmd.Stdin = nil
-		if err := forceCmd.Run(); err != nil {
-			return nil // network or other error — fail silently
+		if output, err := forceCmd.CombinedOutput(); err != nil {
+			fmt.Fprintf(cmd.ErrOrStderr(), "rekal: force push failed: %s\n", strings.TrimSpace(string(output)))
+			return nil
 		}
 		fmt.Fprintf(cmd.ErrOrStderr(), "rekal: force pushed to origin/%s\n", branch)
 		return nil
@@ -84,7 +95,7 @@ func runPush(cmd *cobra.Command, gitRoot string, force bool) error {
 			fmt.Fprintln(cmd.ErrOrStderr(), "rekal: your remote branch has diverged from local — review and run 'rekal push --force' to overwrite remote with local data")
 			return nil
 		}
-		// Other errors (network, no remote) — return silently.
+		fmt.Fprintf(cmd.ErrOrStderr(), "rekal: push failed: %s\n", strings.TrimSpace(string(output)))
 		return nil
 	}