Repository navigation
Decide Whether Every Bare Push With an Undetermined Repository Fails Closed in the Write Guard #3730
Description
Raised by the local strict-review pass on the #3728 fix (feature/burndown-guard-bare-branch). It is a design decision for the maintainer rather than a defect in that change.
After #3728, a push naming no refspec behind an unrecognized env option is read as writing every branch protected by default unless an absolute anchor names its repository. The same reason, that the push may land in a repository on a protected branch, applies to a bare push whose repository the reading does not determine for other causes. Those stay allowed, as requirement 4 of host-setup/agent-safety/README.md documents ("So is a push naming no refspec whose repository the reading does not determine"). Constructed cases, from a feature-branch checkout:
cd "$D" && git push origin,git -C "$D" push origin, andenv -C "$D" git push originare allowed.GIT_DIR=/abs/b/.git sh -c 'git push origin', withbondevelop, is allowed. TheGIT_DIRreaches the wrapper body as inherited environment and reads as$GIT_DIR, although git certainly sees it. The same push without the wrapper is judged ondevelopand denied.env --ch="$D" git push originis now denied.
Separately, requirement 6 reads an unrecognized env option as leaving the command where it was ("An env option the reading does not recognize leaves it where it was"), while requirement 4 now reads it as possibly moving the push anywhere.
Decision needed: whether every bare push with an undetermined repository should fail closed for a protected default, accepting more refusals, and whether requirements 4 and 6 should read an unrecognized env option the same way.
Activity
Keep a Bare Push's Branch Unresolved Behind an Unrecognized env Optio…
ptr727 commentedon Oct 31, 2026
One more constructed case for this decision, found while verifying a review claim on promotion #3715 (the claim itself did not reproduce). With an exported absolute
GIT_DIRnaming a repository checked out on a branch that requires a pull request, run from a different repository:the guard cannot read the branch the push writes (an exported
GIT_DIRis read as unreadable, by design), no unrecognizedenvoption is involved, so the no-refspec push is allowed, while git would push the protectedmainof/s/a. The same command namingmainexplicitly is denied. Whichever way this issue is decided should cover this shape too.Promote Develop: Read a Push's Remote in the Repository Git Uses, Rea…
ptr727 commentedon Oct 31, 2026
Maintainer decision, 2026-10-31: fail closed for all. Every push naming no refspec whose repository the write guard cannot determine is read as writing every protected default, as #3731 already does behind an unrecognized
envoption. That covers a bare push after acdorgit -Cto a directory the guard cannot resolve, and one under an exportedGIT_DIR. The cost accepted: such a push is refused even from a feature branch, and naming the branch explicitly is the remedy. This issue is now work for the next burndown round rather than a question.ptr727 commentedon Nov 1, 2026
Decision triage (2026-11-01) found the open question here already answered or overtaken, so it is not asked:
The maintainer decided it in an issue comment on 2026-10-31 ("fail closed for all"; "This issue is now work for the next burndown round rather than a question"). Not yet implemented:
_bare_push_branchandbranch_ofin gh-write-guard.py still fail closed only oncmd.undetermined.ptr727 commentedon Nov 1, 2026
Released (2026-11-01): worktree and branch removed, so this claim holds no files. Its fix merged to develop in PR #3764. The issue closes when that is promoted.
Backlog burndown claim (round 1, group G2). Branch:
feature/burn-3729. Issues: #3729, #3730, #3723.Predicted file set:
host-setup/agent-safety/claude/gh-write-guard.pyhost-setup/agent-safety/claude/test_install.pyhost-setup/agent-safety/README.mdtests/test_guard_size.pyThis edits the agent-safety tree: the worker drives the pull request to the Merge Gate and does not merge it. The merge waits on the maintainer's go-ahead after reading the diff.
Read an Unread Bare Push Branch as Every Protected Default in the Wri…