[P1] Enforce native MCP commits #894

New Issue

2026-07-24T21:37:28-05:00

jcwalker3 commented

2026-07-24 21:37:28 -05:00

Parent epic: #887
Priority: P1

Problem

A resolved commit_files capability was followed by shell git add and git commit. The native path was authorized and then bypassed, so the commit carries no manifest, no scope check, and no audit receipt. Known adjacent detail: only heredoc-form git commit is refused by the harness — git commit -F file succeeds — so shell commits are reachable in practice.

Prerequisites

#713 (registered worktree proof for branches-only mutation authorization) covers the authorization side and must be consumed, not restated.

Acceptance criteria

A complete native commit operation exists that covers every case currently requiring a shell fallback.
It requires an expected HEAD and an approved file manifest.
It rejects files outside the issue worktree or outside the declared scope.
It scans staged content for credentials and accidentally-included generated files, and fails closed on a hit.
It records an auditable mutation receipt (actor, profile, session, HEAD before/after, manifest digest).
When the branch advances through an unauthorized commit path, the next workflow call detects it and fails closed rather than proceeding on the unexpected head.

Duplicate verdict

PARTIAL. #713 requires registered worktree proof for branches-only mutation authorization; this issue is about the commit operation's completeness and the detection of out-of-band commit paths. #670 and #722 are incident records of bare direct-to-master commits — evidence, not fixes.

Parent epic: #887 Priority: P1 ## Problem A resolved `commit_files` capability was followed by shell `git add` and `git commit`. The native path was authorized and then bypassed, so the commit carries no manifest, no scope check, and no audit receipt. Known adjacent detail: only heredoc-form `git commit` is refused by the harness — `git commit -F file` succeeds — so shell commits are reachable in practice. ## Prerequisites - #713 (registered worktree proof for branches-only mutation authorization) covers the authorization side and must be consumed, not restated. ## Acceptance criteria - A complete native commit operation exists that covers every case currently requiring a shell fallback. - It requires an expected HEAD and an approved file manifest. - It rejects files outside the issue worktree or outside the declared scope. - It scans staged content for credentials and accidentally-included generated files, and fails closed on a hit. - It records an auditable mutation receipt (actor, profile, session, HEAD before/after, manifest digest). - When the branch advances through an unauthorized commit path, the next workflow call detects it and fails closed rather than proceeding on the unexpected head. ## Duplicate verdict PARTIAL. #713 requires registered worktree proof for branches-only mutation *authorization*; this issue is about the commit operation's completeness and the detection of out-of-band commit paths. #670 and #722 are incident records of bare direct-to-master commits — evidence, not fixes.

jcwalker3 added the type:guardrail status:ready workflow-hardening safety protected-branch labels 2026-07-24 21:37:28 -05:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Scaled-Tech-Consulting/Gitea-Tools#894