Harden author workflow against branch drift and accidental commits to master #177

New Issue

2026-07-05T13:46:19-05:00

jcwalker3 commented

2026-07-05 13:46:19 -05:00

Problem:
During the author implementation for Gitea-Tools issue #173 / PR #176, the agent detected that the commit initially landed on local master instead of the intended feature branch feat/issue-173-reviewer-workflow-proofs.

The agent repaired the local state before pushing:

moved the commit onto the feature branch
restored local master to prgs/master
pushed only the feature branch
did not push to master

However, this should be prevented by workflow/tooling gates rather than repaired after detection.

Observed anomaly:

intended branch: feat/issue-173-reviewer-workflow-proofs
commit: ccc5ef79dfe629853e144763238593bd808d57e0
local master was unexpectedly active or moved mid-session
root cause unknown, possibly concurrent shared-worktree activity
no remote master mutation occurred

Required behavior:

Before staging, committing, or pushing, author workflows must verify:
- current branch equals the intended feature branch
- current branch is not master, main, develop, development, or dev
- worktree path matches the intended issue/branch worktree when applicable
- branch upstream/remote target matches the intended feature branch
If the current branch changes unexpectedly during the session, stop before committing.
If HEAD or branch name changes between validation and commit, stop and require reconciliation.
If a commit is accidentally made on a protected branch locally, do not push; report and require explicit repair steps.
Add tests/harness assertions for:
- commit attempted while on master is blocked
- branch drift between validation and commit is blocked
- push target mismatch is blocked
- shared-worktree branch switch is detected
- repair path does not silently continue without reporting

Acceptance criteria:

Author workflows cannot commit to local master by accident.
Feature-branch push requires proof that local branch, remote branch, and intended issue branch all match.
The final report must include branch proof before commit and before push.

Author-side counterpart of the branch/checkout proofs in #173 (reviewer-side pinned-head wall); origin incident occurred while implementing #173 itself (PR #176).
mcp-control-plane #77 (exact mutation capability / author walls) covers the capability dimension; this issue covers the local-git-state dimension it does not: branch identity proof at commit/push time.
Shared-worktree concurrency is a live risk in this environment — multiple agent sessions operate on the same checkout of this repo; detection of external branch switches mid-session should be treated as expected, not exceptional.

Problem: During the author implementation for Gitea-Tools issue #173 / PR #176, the agent detected that the commit initially landed on local `master` instead of the intended feature branch `feat/issue-173-reviewer-workflow-proofs`. The agent repaired the local state before pushing: * moved the commit onto the feature branch * restored local `master` to `prgs/master` * pushed only the feature branch * did not push to master However, this should be prevented by workflow/tooling gates rather than repaired after detection. Observed anomaly: * intended branch: `feat/issue-173-reviewer-workflow-proofs` * commit: `ccc5ef79dfe629853e144763238593bd808d57e0` * local master was unexpectedly active or moved mid-session * root cause unknown, possibly concurrent shared-worktree activity * no remote master mutation occurred Required behavior: 1. Before staging, committing, or pushing, author workflows must verify: * current branch equals the intended feature branch * current branch is not `master`, `main`, `develop`, `development`, or `dev` * worktree path matches the intended issue/branch worktree when applicable * branch upstream/remote target matches the intended feature branch 2. If the current branch changes unexpectedly during the session, stop before committing. 3. If `HEAD` or branch name changes between validation and commit, stop and require reconciliation. 4. If a commit is accidentally made on a protected branch locally, do not push; report and require explicit repair steps. 5. Add tests/harness assertions for: * commit attempted while on `master` is blocked * branch drift between validation and commit is blocked * push target mismatch is blocked * shared-worktree branch switch is detected * repair path does not silently continue without reporting Acceptance criteria: * Author workflows cannot commit to local `master` by accident. * Feature-branch push requires proof that local branch, remote branch, and intended issue branch all match. * The final report must include branch proof before commit and before push. Related: * Author-side counterpart of the branch/checkout proofs in #173 (reviewer-side pinned-head wall); origin incident occurred while implementing #173 itself (PR #176). * mcp-control-plane #77 (exact mutation capability / author walls) covers the capability dimension; this issue covers the local-git-state dimension it does not: branch identity proof at commit/push time. * Shared-worktree concurrency is a live risk in this environment — multiple agent sessions operate on the same checkout of this repo; detection of external branch switches mid-session should be treated as expected, not exceptional.

jcwalker3 added the status:in-progress label 2026-07-05 14:10:30 -05:00

jcwalker3 commented

2026-07-05 14:11:30 -05:00

Claimed. Branch: feat/issue-177-branch-drift-proofs. Worktree: branches/feat-issue-177-branch-drift-proofs.

Plan: add author_proofs.py (fail-closed branch-identity proofs for commit/push time — protected-branch block, validation→commit drift detection including external shared-worktree switches, push-target match proof, non-silent repair reporting) plus tests/test_author_proofs.py harness assertions, and wire the requirements into the llm-project-workflow skill docs. Author-side counterpart of the #173 reviewer proofs.

Claimed. Branch: `feat/issue-177-branch-drift-proofs`. Worktree: `branches/feat-issue-177-branch-drift-proofs`. Plan: add `author_proofs.py` (fail-closed branch-identity proofs for commit/push time — protected-branch block, validation→commit drift detection including external shared-worktree switches, push-target match proof, non-silent repair reporting) plus `tests/test_author_proofs.py` harness assertions, and wire the requirements into the llm-project-workflow skill docs. Author-side counterpart of the #173 reviewer proofs.

jcwalker3 referenced this issue from a commit

2026-07-05 14:16:39 -05:00

feat(author-workflow): add fail-closed branch-identity proofs for commit/push (#177)

jcwalker3 referenced a pull request that will close this issue

2026-07-05 14:17:04 -05:00

Add fail-closed branch-identity proofs for author commit/push workflow (Issue #177) #181

jcwalker3 referenced this issue

2026-07-05 14:20:22 -05:00

Require controller handoff summaries in all LLM workflow final reports #182

jcwalker3 referenced this issue

2026-07-05 14:22:16 -05:00

Harden author-run reporting and mutation capability proof: Controller Handoff, exact issue-claim capability, exact sweep evidence, PR head SHA #183

jcwalker3 commented

2026-07-05 14:23:20 -05:00

Evidence from a Grok author run (issue #178 → PR #180, head ff4ab500df8447f4409b3e9cc262520e8076d806), relevant to this issue's final-report requirement:

The run's final report named the branch (feat/issue-178-fix-test-suite-stdout-capture) but omitted the exact PR head SHA. This issue's acceptance criterion — "the final report must include branch proof before commit and before push" — should be read as requiring the exact head commit in that proof, not just the branch name. The build_commit_push_report block added by PR #181 carries the proof verdicts; the head-SHA-in-report requirement itself is now tracked in #183 (gap 5) and composes with this issue's proofs rather than duplicating them.

Evidence from a Grok author run (issue #178 → PR #180, head `ff4ab500df8447f4409b3e9cc262520e8076d806`), relevant to this issue's final-report requirement: The run's final report named the branch (`feat/issue-178-fix-test-suite-stdout-capture`) but omitted the exact PR head SHA. This issue's acceptance criterion — "the final report must include branch proof before commit and before push" — should be read as requiring the exact head commit in that proof, not just the branch name. The `build_commit_push_report` block added by PR #181 carries the proof verdicts; the head-SHA-in-report requirement itself is now tracked in #183 (gap 5) and composes with this issue's proofs rather than duplicating them.

jcwalker3 referenced this issue

2026-07-05 14:53:16 -05:00

Tighten A-level reviewer proof requirements after #173 merge #179

sysadmin referenced this issue

2026-07-05 15:01:35 -05:00

Add fail-closed branch-identity proofs for author commit/push workflow (Issue #177) #181

sysadmin referenced this issue

2026-07-05 15:13:22 -05:00

Add fail-closed branch-identity proofs for author commit/push workflow (Issue #177) #181

sysadmin closed this issue

2026-07-05 15:13:24 -05:00

sysadmin referenced this issue from a commit