zara-coding: make branch creation HEAD fence atomic #199

New issue

Closed

opened 2026-09-08 02:03:12 +00:00 by nsaspy · 0 comments

nsaspy commented

2026-09-08 02:03:12 +00:00

Owner

Advances #1.

Follow-up to #185/#186. The new branch-create contract rejects an already-stale caller-observed expected_head, but its current rev-parse HEAD check and update-ref refs/heads/<new> creation are separate Git operations. HEAD can move after the check and before ref creation, allowing a branch to be created after the fence became stale.

Acceptance:

deterministic RED proving branch creation uses one Git ref transaction that verifies HEAD == expected_head and creates the new branch ref together;
use canonical Git plumbing (update-ref --stdin transaction semantics), no shell, no private runtime;
retain full-object-ID validation and create-only behavior;
fail closed with a useful CodingError on stale HEAD/existing ref;
focused tests + registry validator + full nix flake check + generated package build + exact-head protected merge.

Advances #1. Follow-up to #185/#186. The new branch-create contract rejects an already-stale caller-observed `expected_head`, but its current `rev-parse HEAD` check and `update-ref refs/heads/<new>` creation are separate Git operations. HEAD can move after the check and before ref creation, allowing a branch to be created after the fence became stale. Acceptance: - deterministic RED proving branch creation uses one Git ref transaction that verifies `HEAD == expected_head` and creates the new branch ref together; - use canonical Git plumbing (`update-ref --stdin` transaction semantics), no shell, no private runtime; - retain full-object-ID validation and create-only behavior; - fail closed with a useful CodingError on stale HEAD/existing ref; - focused tests + registry validator + full `nix flake check` + generated package build + exact-head protected merge.

nsaspy closed this issue

2026-09-08 02:03:12 +00:00

nsaspy referenced this issue from a pull request that will close it,

2026-09-08 02:19:37 +00:00

coding: validate branch inventory object IDs #379