Session Handoff [engineering]: Write Guard Push Target Reads Released as 2.0.1125, Directory and Tokenizer Guard Lane Next #3327

Next steps, in priority order

1. The guard's remaining allow gaps, one lane at a time, all in gh-write-guard.py. Done for each lane means a merged PR into develop, a develop-versus-branch differential showing zero deny-to-allow flips, and a revert proof for its new tests. The push-target lane is done (Judge a Push Against the Repository and Branches It Actually Writes #3316).
   • Directory values, tokenizer, launchers and wrapper bodies: Read Carriage Returns, Folded Lines, Eval, and Globs in a Directory Value in the Write Guard #2995, Read Commands a Quote Pair Spanning Two Comments Hides in the Write Guard #2991, Read Every Launcher in Front of a Push in the Write Guard #3050, Read a Foreign Shell Behind a Launcher the Write Guard Does Not Know #3083, Carry Environment Through an Unknown Launcher to the Git It Runs in the Write Guard #3085, Read a Command String env -S Runs in the Write Guard #3090, Fail Closed on Words xargs Appends to a Merge, Commit, or Push in the Write Guard #3074, Read a Double-Quoted Wrapper Body's Run-Time Words as Splittable in the Write Guard #3075, Read a Direct Git Command's GIT_DIR as a Wrapper's Is Read in the Write Guard #3304, and Read the Config-Change Scan's Remaining Run-Time, Eval, and Xargs Forms in the Write Guard #3307.
   • Shells, case and encoding: Decode a PowerShell -EncodedCommand Body in the Write Guard #3056, Match push.default Case-Sensitively in the Write Guard or Say It Is Folded #3061, Read Git's Environment Variable Names Without Case on Windows in the Write Guard #3086, Read cmd and PowerShell Run-Time Words as Run-Time Words in the Write Guard #3091, Close Four Hidden-Command Allow Gaps the Promotion's Third Review Found in the Write Guard #3088, and Close the Write Guard's Remaining Push Detection Gaps Found Reviewing the #2936 Fix #2943's non-POSIX shell and stdin-script items.
   • Commit option clusters and bypass routes: Read a Commit Cluster With an Attached Value as Taking No Next Word in the Write Guard #3068, Read Short-Option Clusters Through One Primitive in the Write Guard #3071, Deny the Remaining core.hooksPath and no-verify Bypass Routes in the Guard #2177's alias item, Read a Hook-Bypass Flag an Alias Expansion Carries in the Write Guard #3305, Read Persisted Config a Command Writes Before an Alias or Commit in the Write Guard #3303, and Close the Write Guard's Remaining Push Detection Gaps Found Reviewing the #2936 Fix #2943's environment-set editor and config, --config-env alias, and quoted-eval commit items.
   • Push-target residuals the Judge a Push Against the Repository and Branches It Actually Writes #3316 lane and its promotion found: Read a Matching Push Without Relying on Remote-Tracking Refs in the Write Guard #3315 (a matching push read only through remote-tracking refs), Read a Drive-Letter Push Target as Local Only on Windows in the Write Guard #3317 (a drive-letter target read as local off Windows, leaving a one-letter ssh host's rules unread), Fail Closed on a Source-Only Push After an Upstream Change in the Same Command in the Write Guard #3322 (an upstream change earlier in the same command), and Read Every Branch a Persisted Mirror Push Writes in the Write Guard #3326 (a persisted remote.<name>.mirror push).
   • Close the Write Guard's Remaining Push Detection Gaps Found Reviewing the #2936 Fix #2943's last item, the nesting-cap overflow for rule 6 and the gh-write rules, goes with whichever lane touches the wrapper walker.
2. Small non-guard lane, beside the guard lanes: Clear Repository-Location Variables in Every Temporary-Repository Test Through One Helper #3324. Temporary-repository tests outside the guard inherit an ambient GIT_DIR, and spec/audit.py --selftest was confirmed to write commits into the caller's repository when run from a git hook. Done means each such test clears the git location variables the way Run the Write Guard Self-Test Without an Ambient GIT_DIR #3323 did for the guard's self-test, with a test that fails without it.
3. The guard's over-denials, after step 1: Narrow Three Write-Guard Reads That Deny More Broadly Than Git Pushes #2953, Scope a Branch Pattern's Push Operations to the Branches It Can Match in the Write Guard #2964, Read Only an Eval That Runs in the Write Guard's Include Reading #2975, Keep the Write Guard's Terminal-Option Exception When a Redirection Precedes the Option #2981, Write Guard Denies Heredoc Data Inside an Unquoted Backtick Substitution #3000, Read a Commit's Exact -n as a Value Where It Follows a Value Option in the Write Guard #3070, Read a Process Substitution as One Word in the Write Guard's Commit and Merge Walks #3073, End a Merge's Words at a Comment in the Write Guard's Run-Time Check #3076, Read Quoting the Write Guard's Quote-Keeping Lex Cannot Align #3084, Leave a Literal gh Target Inside Heredoc Data Unread in the Write Guard #3134, Read Only Real GH_REPO Setters as Unread in the Write Guard #3286, Read a GH_REPO Only in the Wrapper Body It Reaches in the Write Guard #3144's and Close Three Small GH_REPO and Merge-Message Gaps in the Write Guard #3145's over-deny halves, Let a Top-Level Command-Text GH_REPO Export Override an Inherited One in the Write Guard #3163, Scope a Wrapper's GIT_DIR to Its Own Body in the Write Guard #3309, Measure the Write Guard's HOME and XDG_CONFIG_HOME Override Over-Denial #3311, and the three Judge a Push Against the Repository and Branches It Actually Writes #3316 introduced: Skip the Source-Only Refspec Mapping for a Delete Push in the Write Guard #3314 (source-only mapping applied to a delete push), Resolve a Leading ~+ Directory Rather Than Failing Closed in the Write Guard #3318 (a leading ~+), and Read a cd or pushd Word as the Builtin Only in Command Position in the Write Guard #3319 (a pushd/popd word outside command position). Then Consolidate the Write Guard's Flag-Value Argv Walks #3285, Share One Command-Position Walker Across the Write Guard's Readers #3308, and Move the Write Guard's Option-Prefix, Eval-Reading, and Cluster Sites Onto One Helper Each #3008, helper consolidation, last.

External blockers

• None.

Internal dependencies

• Steps 1 and 3 run one lane at a time, since each edits gh-write-guard.py. Each lane claims all of host-setup/agent-safety/, READMEs included.
• Step 3 runs after step 1, because narrowing a deny while allow gaps are open has repeatedly opened a new allow in the same reader.
• Step 2 touches no guard file, so it runs beside any guard lane. Check its file set against the live guard lane's claim before dispatch, since spec/audit.py and the tooling tests sit outside host-setup/agent-safety/.
• Consolidate the Write Guard's Flag-Value Argv Walks #3285, Share One Command-Position Walker Across the Write Guard's Readers #3308, and Move the Write Guard's Option-Prefix, Eval-Reading, and Cluster Sites Onto One Helper Each #3008 go last, since moving shared sites onto one walker or helper rewrites lines every other guard lane edits.

State

• Promotion Promote the Write Guard Push Target Reads, Self-Test Isolation, and Smoke Stub Pin Bump to Main #3321 merged with --merge (main 96f571ae). Release run 39703820833 succeeded, tagging 2.0.1125 on that commit.
• Judge a Push to Another Remote Against That Remote's Repository in the Write Guard #3048, Read a Bare Push Under push.default=matching as Updating Every Matching Branch in the Write Guard #3053, and Bump the Smoke Stub Pin to a Release With enable_release_asset #3302 closed through the promotion's Closes lines. Close the Write Guard's Remaining Push Detection Gaps Found Reviewing the #2936 Fix #2943 stays open for the items listed in step 1.
• The installed Skills snapshot is current at 96f571ae. Claude Code loads the primary checkout on develop. The host-safety kit reported STALE against 96f571ae and goes to the maintainer as one install line rather than being run.
• No open pull requests from this lane. Pin the Catalog Caller Snippets to Release 2.0.1122 #3313, Judge a Push Against the Repository and Branches It Actually Writes #3316, and Run the Write Guard Self-Test Without an Ambient GIT_DIR #3323 merged into develop and were promoted. Their remote branches, worktrees, and local branches are removed, as is the snapshot worktree.
• The primary checkout is on develop, clean, at origin/develop.
• pr_review.py cleanup --sweep lists five prunable worktree entries from other sessions as removable and keeps the rest as too recent. They are not this lane's, so they were reported and not applied.
• Other tracks' open handoffs are untouched: Session Handoff [windows]: #2578 Landed for #694, Closing Through Promotion #2580, #1171 Next #2581 (windows), Session Handoff [host-instructions]: Hardening Rule and Merge Guard Released as 2.0.867 and 2.0.868, #2499 Docstring Next #2514 (host-instructions), Session Handoff [default]: Copilot Unresolved Findings Label Ready in Promotion #3515, Merge and Release Next #2361 (default), Session Handoff [python-contract]: Escaped and Folded python-directories Values Refused, Released as 2.0.738 #2014 (python-contract).

The parked decision queue

There are 0 open decision issues at this close. The maintainer approved develop merges for this session, and merging and releasing #3321 accepting constituent-PR coverage for Merge Gate item 2, through prompts this round.

What the last round did

• Two lanes, one promotion fix, and a promotion:
  • Judge a Push Against the Repository and Branches It Actually Writes #3316 (Opus) closes Judge a Push to Another Remote Against That Remote's Repository in the Write Guard #3048, Read a Bare Push Under push.default=matching as Updating Every Matching Branch in the Write Guard #3053, and three Close the Write Guard's Remaining Push Detection Gaps Found Reviewing the #2936 Fix #2943 push items. Differential over 1,508 distinct commands: 0 deny-to-allow, 37 allow-to-deny, each mapped to a fix. Revert proof: 36 of 37 new deny cases fail on develop's code, the 37th already denied there for another reason. Six frontier local passes, each recorded.
  • Pin the Catalog Caller Snippets to Release 2.0.1122 #3313 (Sonnet) closes Bump the Smoke Stub Pin to a Release With enable_release_asset #3302, moving the catalog snippet pins to 2.0.1122 after reading the called workflows' declared inputs at that tag.
  • Run the Write Guard Self-Test Without an Ambient GIT_DIR #3323 (Opus) fixes a CodeRabbit promotion finding: the guard self-test now clears git location variables per case, so a run from inside a git hook no longer writes into the hook's repository.
  • Promotion Promote the Write Guard Push Target Reads, Self-Test Isolation, and Smoke Stub Pin Bump to Main #3321 met Merge Gate item 2 through the promotion case: Copilot reviewed its head but stated no coverage, while Judge a Push Against the Repository and Branches It Actually Writes #3316 and Run the Write Guard Self-Test Without an Ambient GIT_DIR #3323 carried published attestations and Pin the Catalog Caller Snippets to Release 2.0.1122 #3313 a Copilot table at their merged heads.
• Filed: Skip the Source-Only Refspec Mapping for a Delete Push in the Write Guard #3314, Read a Matching Push Without Relying on Remote-Tracking Refs in the Write Guard #3315, Read a Drive-Letter Push Target as Local Only on Windows in the Write Guard #3317, Resolve a Leading ~+ Directory Rather Than Failing Closed in the Write Guard #3318, Read a cd or pushd Word as the Builtin Only in Command Position in the Write Guard #3319 (by the guard lane, as over-denials or under-reads its own change introduced), Fail Closed on a Source-Only Push After an Upstream Change in the Same Command in the Write Guard #3322, Clear Repository-Location Variables in Every Temporary-Repository Test Through One Helper #3324, Read Every Branch a Persisted Mirror Push Writes in the Write Guard #3326 (by the promotion worker).

What not to repeat

• gh pr checks <pr> --watch --required on this repository. It exits 1 with "No required checks reported", because the required check comes from a ruleset. The previous link's advice to use --required was wrong. Use timeout <n> gh pr checks <pr> --watch and read the full list.
• Expecting a Lite-effort Copilot round on a promotion head to state coverage. It reviewed Promote the Write Guard Push Target Reads, Self-Test Isolation, and Smoke Stub Pin Bump to Main #3321's head with no file table, so pr_review.py exits 45. Every constituent PR needs a published attestation or a Copilot table at its merged head, which is what lets the promotion case stand. Have each lane run pr_review.py attest after every push a recorded pass covers.
• Narrowing a lane's own unpushed denials between local passes. Held this round: the guard lane filed five residuals instead of narrowing, and landed without the extra rounds the Read Config and Alias Rewrites the Write Guard Missed #3306 lane spent.
• Guard-shaped text in a heredoc. Write such text with the Write tool or a script file.

New learnings

• None beyond the entries above.