zara-coding: fence branch creation to observed HEAD #201

New issue

Closed

opened 2026-09-08 02:03:13 +00:00 by nsaspy · 0 comments

nsaspy commented

2026-09-08 02:03:13 +00:00

Owner

Local #1 safety slice.

coding.git.branch.create is approval-gated but creates a new ref at whatever repository HEAD exists when the mutation runs. If HEAD moves after the caller inspected the repository, the branch can silently start from an unobserved commit. Commit/delete/worktree mutations already use exact observed object-ID fencing.

Acceptance:

deterministic RED proving branch creation refuses a moved HEAD;
require a full expected_head object ID through plugin and domain layers;
use git update-ref <new-ref> <expected_head> '' only after current HEAD still matches expected;
keep canonical approval metadata;
structured evidence returns the exact fenced head;
deterministic/network-free tests and full registry/Nix/package gates.

Local #1 safety slice. `coding.git.branch.create` is approval-gated but creates a new ref at whatever repository HEAD exists when the mutation runs. If HEAD moves after the caller inspected the repository, the branch can silently start from an unobserved commit. Commit/delete/worktree mutations already use exact observed object-ID fencing. Acceptance: - deterministic RED proving branch creation refuses a moved HEAD; - require a full `expected_head` object ID through plugin and domain layers; - use `git update-ref <new-ref> <expected_head> ''` only after current HEAD still matches expected; - keep canonical approval metadata; - structured evidence returns the exact fenced head; - deterministic/network-free tests and full registry/Nix/package gates.

nsaspy closed this issue

2026-09-08 02:03:13 +00:00