sixfold-space/madtea

SHA256

Fork 0

refuse a removal the forge cannot prove is reachable #788

Merged

hexajon merged 2 commits from issue-666-forge-proven-removal into main

2026-10-16 01:29:03 +00:00

hexajon commented

2026-10-16 01:29:00 +00:00

Owner

Summary

Branch delete, worktree remove, and prune now refuse to destroy a ref whose commits the forge cannot prove are reachable from the forge default branch. Local git state is not proof: the forge is the golden copy, so the check reads the forge compare API and allows the removal only when the ref adds no commit the default lacks.

A squash-merged or rebase-merged branch is not reachable by its original commits, so the check refuses it and the removal falls back to raw git until the content-proof case lands (#777).

Live-forge tests under the forge build tag cover branch delete, worktree remove, and prune against real forges, including the adversarial case where a local ref is rewritten to a commit the forge never saw.

Closes #666

## Summary Branch delete, worktree remove, and prune now refuse to destroy a ref whose commits the forge cannot prove are reachable from the forge default branch. Local git state is not proof: the forge is the golden copy, so the check reads the forge compare API and allows the removal only when the ref adds no commit the default lacks. A squash-merged or rebase-merged branch is not reachable by its original commits, so the check refuses it and the removal falls back to raw git until the content-proof case lands (#777). Live-forge tests under the forge build tag cover branch delete, worktree remove, and prune against real forges, including the adversarial case where a local ref is rewritten to a commit the forge never saw. Closes #666

hexajon added 2 commits

2026-10-16 01:29:00 +00:00

feat(guard): #666 require forge proof before a removal destroys a ref 04f252081d

Add a forge-proven-removal check so branch delete, worktree remove, and
prune refuse to destroy a ref whose commits the forge cannot prove are
reachable from a merged or still-open target. Local state is not proof.

Covers:
- guard package forge-proof effect and its unit tests
- service git forge_proof plus wiring into branch delete and worktree
- prune forge_proof and run wiring, with reassurance text
- live-forge tests under the forge build tag in internal/testforge
- regenerated MCP help and updated CLI git reference

fix(guard): #666 give the forge-reachable test worktree its own branch

drift / govulncheck (pull_request) Has been skipped

Details

drift / surface-diff (pull_request) Successful in 32s

Details

drift / forgejo-smoke (pull_request) Has been skipped

Details

ci / mcp-conformance (pull_request) Successful in 1m25s

Details

ci / mcp-conformance (push) Successful in -31s

Details

drift / govulncheck (push) Has been skipped

Details

drift / surface-diff (push) Successful in -35s

Details

drift / forgejo-smoke (push) Has been skipped

Details

ci / gate (push) Failing after 11m47s

Details

ci / gate (pull_request) Successful in 20m26s

Details

8890a34c28

git refuses a second worktree checked out on the default branch, which
the clone's own worktree already holds, so the live-forge test must add
its reachable worktree on a new branch at the default tip.

hexajon merged commit 8890a34c28 into main

2026-10-16 01:29:03 +00:00

No reviewers

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

sixfold-space/madtea!788

No description provided.

Rows
Columns