Module bypass 

The ledger of unverified commits — the bypass signal, kept instead of discarded.

crate::gate_stamp already detects the interesting event: a commit that a commit-time gate declaration covered, created without that gate having run — --no-verify is the commonest cause, a blocked attempt retried with it the second, a gate whose tool was missing the third. Until this module existed the detection was followed by a bare return: the first symptom of a slow or flaky check (people routing around it) was thrown away at the exact moment it was in hand.

This module only counts. The stamp gates a check (a wrong read there weakens the push gate); the ledger informs a dashboard (a wrong read here miscounts). That difference in stakes is why this is not part of gate_stamp — nothing in this file participates in any suppression decision, and nothing ever may.

The ledger is a local file, never a ref, never pushed, never sent anywhere — the project’s no-telemetry promise applies in full. It lives in the COMMON git dir (unlike the deliberately worktree-private marker) because “how often does this repository dodge its gate” is a question about the repository, not about one worktree. amont uninstall deletes it; so does amont.recordBypasses false, prospectively.

Format, versioned like its siblings (amont-gate-v1, amont-held-v1):

amont-bypass-v1
<unix-epoch> <commit-oid> <script>

One line per uncovered script. No paths ever appear in the file, which is why newline/space delimiting is safe here where staged_only needed NUL.

Structs

Ledger

What the ledger says, aggregated. Everything a reader displays comes through here; nobody re-parses the file.

ScriptCount

One script’s slice of the ledger.

Constants

FORMAT

First line of the ledger. A future amont that changes the shape bumps this, and an old ledger reads as empty rather than being misread.

Functions

age

A relative age in the largest unit that fits — integer arithmetic only, no calendar. A timestamp from the future (clock skew between worktree hosts) clamps to “just now” rather than underflowing.

forget

uninstall: the ledger is OUR bookkeeping, gone with the hooks.

parse

Aggregate a ledger’s text. Pure; a malformed line is skipped, never guessed at, and a missing or foreign header reads as an empty ledger.

read

The in-repo door: resolves the common dir itself (process cwd). Empty on any failure — amont list in a broken repo still prints.

read_at

The fleet’s door: read the ledger under an already-resolved common dir. Absent file, unreadable file, foreign format — all read as empty.