guard: refuse every commit on the default branch after the first push, with no override

hexajon commented

2026-09-29 18:36:59 +00:00

Owner

ADR 0006 and ADR 0046 say that the only write to the default branch is the first push into an empty repo. madt_commit and madtea commit break that rule in two ways today:

A per-call override lets a commit land on the default branch: allow_default_branch on MCP (internal/mcp/tools_localgit.go) and --allow-default-branch on the CLI (internal/cmd/git/commit.go). ADR 0006 says that no guard in this tier has an override.
A commit that finishes a merge, revert, or cherry-pick on the default branch is exempt (internal/service/git/commit.go). ADR 0006 refuses it.

Scope:

Remove the override from both surfaces, with no alias and no replacement flag.
Remove the in-progress exemption. The empty-repo exemption stays.
The refusal text follows ADR 0026.

Acceptance:

Against the live forge and a test repo: a commit on the default branch is refused, both with and without a merge in progress. A commit in an empty repo succeeds.
Neither surface accepts an override parameter or flag.

Depends on #659 (the git write functions call the guard). Decision records: ADR 0006, ADR 0046.

ADR 0006 and ADR 0046 say that the only write to the default branch is the first push into an empty repo. `madt_commit` and `madtea commit` break that rule in two ways today: - A per-call override lets a commit land on the default branch: `allow_default_branch` on MCP (`internal/mcp/tools_localgit.go`) and `--allow-default-branch` on the CLI (`internal/cmd/git/commit.go`). ADR 0006 says that no guard in this tier has an override. - A commit that finishes a merge, revert, or cherry-pick on the default branch is exempt (`internal/service/git/commit.go`). ADR 0006 refuses it. Scope: - Remove the override from both surfaces, with no alias and no replacement flag. - Remove the in-progress exemption. The empty-repo exemption stays. - The refusal text follows ADR 0026. Acceptance: - Against the live forge and a test repo: a commit on the default branch is refused, both with and without a merge in progress. A commit in an empty repo succeeds. - Neither surface accepts an override parameter or flag. Depends on #659 (the git write functions call the guard). Decision records: ADR 0006, ADR 0046.

hexajon added a new dependency

2026-09-29 18:37:02 +00:00

#659 guard: the git write functions call the guard

hexajon referenced this issue

2026-09-29 18:52:59 +00:00

docs(adr): consolidate the decision records into their end-state form #667

hexajon referenced this issue

2026-09-29 19:06:46 +00:00

epic: one guard enforces the recorded limits on every surface #670

hexajon added a new dependency

2026-09-29 19:06:51 +00:00

#670 epic: one guard enforces the recorded limits on every surface

hexajon added a new dependency

2026-09-29 19:36:04 +00:00

#674 epic: run forge tests against throwaway Forgejo and Gitea servers behind a real proxy

hexajon referenced this issue

2026-10-15 20:38:39 +00:00

feat(guard): #659 route every git push and commit through the write guard #775

hexajon referenced this issue

2026-10-15 21:07:09 +00:00

feat(guard)!: #665 refuse every default-branch commit, with no override #776

hexajon referenced this issue from a commit

2026-10-15 21:07:11 +00:00

feat(guard): #665 remove the default-branch commit override

hexajon commented

2026-10-17 16:49:18 +00:00

Author

Owner

The code for this landed on main, and the host tests pass: a commit on the default branch is refused on both surfaces, with and without a merge in progress, the empty-repo first commit still works, and the override is gone from both surfaces with no alias. There is no forge-tagged test for this one; the proof is the real-git tests on the host. Keeping this open until the forge-test gate for the breaking set is green.

hexajon commented

2026-10-18 05:23:10 +00:00

Author

Owner

The v0.20.0 breaking set is complete and green on main. The code landed across the v0.20.0 branches, the full local gate passes, and the forge suite is green on both forges at both pinned versions on current main (31693766). Closing as done.

The v0.20.0 breaking set is complete and green on main. The code landed across the v0.20.0 branches, the full local gate passes, and the forge suite is green on both forges at both pinned versions on current main (31693766). Closing as done.

hexajon removed a dependency

2026-10-18 05:24:41 +00:00

#674 epic: run forge tests against throwaway Forgejo and Gitea servers behind a real proxy

hexajon closed this issue

2026-10-18 05:25:18 +00:00

Rows
Columns

guard: refuse every commit on the default branch after the first push, with no override #665