push: five git push calls run outside the guarded Writer #833

New issue

Closed

opened 2026-10-20 03:28:55 +00:00 by hexajon · 0 comments

hexajon commented

2026-10-20 03:28:55 +00:00

Owner

The guard of ADR 0046 runs at every git write seam: the Writer in internal/git checks each push before git runs. Five push calls skip the Writer and call a raw git runner directly:

internal/service/workflow/finish_initial.go:146, the initial finish push of the branch
internal/service/workflow/finish_initial.go:251, the initial finish push of HEAD to the default branch
internal/service/issue/develop.go:116, the push of the new issue branch
internal/cmd/git/tag.go:205, tag create with --push
internal/service/workflow/init.go:346, the init push of HEAD to the default branch

Each site carries its own checks, so a new check added to the Writer does not reach them. The fix for a leading + in a push refspec (#637) had to add the same check to three of these sites by hand. A future push site can repeat the gap.

Acceptance criteria

Each push above goes through the Writer, so the guard and the refspec checks run on it.
The first push into an empty repo still works, as ADR 0046 allows.
A parity test fails when production code outside internal/git runs git push without the Writer.
The gate passes.

The guard of ADR 0046 runs at every git write seam: the Writer in `internal/git` checks each push before git runs. Five push calls skip the Writer and call a raw git runner directly: - `internal/service/workflow/finish_initial.go:146`, the initial finish push of the branch - `internal/service/workflow/finish_initial.go:251`, the initial finish push of HEAD to the default branch - `internal/service/issue/develop.go:116`, the push of the new issue branch - `internal/cmd/git/tag.go:205`, tag create with `--push` - `internal/service/workflow/init.go:346`, the init push of HEAD to the default branch Each site carries its own checks, so a new check added to the Writer does not reach them. The fix for a leading `+` in a push refspec (#637) had to add the same check to three of these sites by hand. A future push site can repeat the gap. ## Acceptance criteria - Each push above goes through the Writer, so the guard and the refspec checks run on it. - The first push into an empty repo still works, as ADR 0046 allows. - A parity test fails when production code outside `internal/git` runs `git push` without the Writer. - The gate passes.

hexajon referenced this issue

2026-10-20 03:29:52 +00:00

audit: find every concern with more than one implementation, and every bypass of an existing chokepoint #834

hexajon added a new dependency

2026-10-20 03:30:00 +00:00

#834 audit: find every concern with more than one implementation, and every bypass of an existing chokepoint

hexajon referenced this issue

2026-10-20 16:40:49 +00:00

fix: refuse a push refspec that begins with '+', so no push can force an update #839

hexajon referenced this issue from a commit

2026-10-21 03:08:17 +00:00

fix: route five git pushes through the guarded writer