feat(guard): block direct stable-branch pushes from MCP workflow sessions (Closes #671)

Prevention hardening for the #670 incident (bare direct-to-master commit
2fa97c26 and the PR #654 merger stable-branch push attempt). Worker sessions
must never publish stable branches directly; stable updates land only through
sanctioned Gitea merge tooling or an authorized reconciler path.

New pure module stable_branch_push_guard.py:
- classify_push_command: detects git push <remote> <stable-ref> equivalents
  including refspecs (HEAD:<ref>, +refs/heads/x:refs/heads/<ref>), --force,
  --delete/:<ref>, and --dry-run/-n no-op probes (dry-run still proves intent).
  Fetch/pull and feature-branch pushes are never flagged; sanctioned
  gitea_merge_pr / API merge is not a push.
- assess_root_checkout_local_commit: detects control-checkout commits not on an
  issue feature branch (branches/ worktrees exempt).
- redact_command: strips URL userinfo/token assignments before logging.
- build_contamination_record + assess_contamination_gate: durable marker shape
  and fail-closed gate (reconciler-exempt; comment/lock stay allowed for handoff).

Server wiring (gitea_mcp_server.py, mcp_session_state.py):
- KIND_STABLE_BRANCH_CONTAMINATION durable session marker (per profile identity).
- _enforce_stable_branch_contamination_gate wired into verify_preflight_purity
  so review/merge/close/completion mutations fail closed while contaminated.
- gitea_record_stable_branch_push_attempt: classify + mark on detection.
- gitea_audit_stable_branch_contamination: reconciler-only inspect/clear; a
  worker session can never self-clear.

Tests (AC5): no-op dry-run push, real direct push, sanctioned Gitea merge,
fetch-only, root-checkout local commit, feature-branch push allowed, gate
block/reconciler-exempt, redaction. 51 new tests; full suite 2596 passed.

Docs: llm-project-workflow SKILL.md — universal rule, blocker class, and a
dedicated "Stable Branch Push Protection" section (worker sessions must never
push stable branches directly).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

skills/llm-project-workflow/SKILL.md

@@ -32,6 +32,15 @@ workflow file.
   mutation.
 - A nearby capability does not count.
 - Do not self-review or self-merge.
+- **Never push a stable branch directly.** Worker sessions (author/reviewer/merger)
+  must never run `git push <remote> master` — or `main`/`dev`/other stable refs,
+  including refspecs (`HEAD:master`), `--force`, `--delete`, or `--dry-run` no-op
+  probes — and must never commit on the root/control checkout outside an issue
+  feature branch. Stable-branch updates land ONLY through sanctioned Gitea merge
+  tooling (`gitea_merge_pr`) or an explicitly authorized reconciler path. A
+  detected attempt marks the session workflow-contaminated (#671) and fails
+  closed on review/merge/close/completion until a reconciler audits and clears
+  it. `git fetch` / `git pull --ff-only` and feature-branch pushes stay allowed.
 - Do not mix modes in one run.
 - **BLOCKED + DIAGNOSE default rule (required):** If any required workflow step, skill, tool, capability, preflight, instruction, profile, worktree binding, or terminal/MCP operation cannot be performed or loaded (including the canonical ones listed in this skill and its loaded workflow), immediately enter `BLOCKED + DIAGNOSE`. Stop before any git or Gitea mutation. Diagnose using the standard template in [`templates/blocked-diagnose-report.md`](templates/blocked-diagnose-report.md). Attempt *only* safe non-mutating recovery. Report using the template. Do not continue, use fallbacks, or treat the missing requirement as harmless.
 - If the required workflow cannot be loaded, stop and produce a recovery handoff
@@ -48,6 +57,11 @@ workflow file.
 - wrong profile or role for the requested operation
 - dirty or misbound worktree (root checkout or non-branches/ path)
 - root checkout mutation risk
+- stable-branch push contamination (#671): a direct `git push <remote> master`
+  (or `main`/`dev`) equivalent, or a root/control-checkout commit not on an issue
+  feature branch, marks the session workflow-contaminated; review/merge/close/
+  completion mutations then fail closed until a reconciler audits and clears it
+  (`gitea_audit_stable_branch_contamination action=clear`, reconciler-only)
 - mutation guard failure (e.g. branches-only guard)
 - missing required MCP tool/schema or operation
 - stale or inconsistent runtime state (e.g. lease vs actual, dirty state disagreement)
@@ -118,6 +132,42 @@ The main project checkout is a stable control checkout on `master`, `main`, or
 If `cwd` is not inside `branches/`, stop before any file edit, test write,
 commit, merge, rebase, or cleanup. The main checkout is orchestration-only.
 
+## Stable Branch Push Protection (#671)
+
+Worker sessions must **never** publish a stable branch directly. This is the
+prevention hardening for the #670 incident (a bare direct-to-master commit
+`2fa97c26` and a PR #654 merger `git push prgs master` attempt).
+
+**Forbidden for author/reviewer/merger sessions:**
+
+- `git push <remote> master` (and `main`, `dev`, `develop`, `development`),
+  including refspecs (`HEAD:master`, `+refs/heads/x:refs/heads/master`),
+  `--force`, `--delete` / `:master`, and `--dry-run`/`-n` no-op probes (a
+  dry-run still proves intent and contaminates the session).
+- Local commits on the root/control checkout that are not carried by an issue
+  feature branch under `branches/`.
+
+**Allowed (never blocked):**
+
+- `git fetch` and `git pull --ff-only` of master into the control checkout when
+  authorized for sync.
+- Feature-branch pushes to non-stable refs (`git push <remote> fix/issue-N-...`).
+- Sanctioned merges via `gitea_merge_pr` / the Gitea API merge endpoint — the
+  **only** way stable branches advance.
+
+**What happens on a detected attempt:** the session is marked
+workflow-contaminated (durable `stable_branch_contamination` marker, redacted
+command summary + session id + remote + ref). While contaminated, all
+review / merge / close / issue-completion mutations fail closed. `comment_issue`
+and `lock_issue` remain allowed so the contaminated worker can post the durable
+audit comment and hand off. Contamination **cannot be self-cleared** — only a
+reconciler audit (`gitea_audit_stable_branch_contamination action=clear`) may
+clear it.
+
+Tooling: call `gitea_record_stable_branch_push_attempt` to classify/record a
+proposed push before running it; `gitea_audit_stable_branch_contamination` to
+inspect or (reconciler-only) clear the marker.
+
 ## Shell Spawn Hard-Stop Rule
 
 `exit_code: -1` with empty stdout/stderr means the shell failed to spawn — not a