⚠️ This skill is one of two authorized paths for Claude to execute `git push`.
⚠️ The other is /epic-merge (--force-with-lease for stacked PR chains, per-iteration AskUserQuestion gate).
⚠️ This skill may also use --force-with-lease, but only when the caller passes the flag — and NEVER onto a protected branch; bare --force is forbidden everywhere.
⚠️ All other skills and rules MUST output push commands only (not execute).
⚠️ Push REQUIRES explicit user approval via AskUserQuestion — no exceptions.

sequenceDiagram
    participant C as Claude
    participant U as User
    participant GH as GitHub
 
    C->>C: Phase 0: Preflight
    alt Protected branch + --force-with-lease
        C->>U: ⛔ Hard abort — prohibited combination, no question asked, no push
    else Permitted combination
        opt Protected branch (plain push)
            C->>U: ⚠️ Warning + ask pre-approval
            U->>C: Continue / Abort
        end
        C->>U: Phase 1: Show push plan + ask approval
        U->>C: Approve / Reject
        alt Approved
            C->>C: Phase 2: Protected×lease guard + command assembly
            C->>GH: Execute git push
            C->>GH: Phase 3: Delegate to /watch-ci
            GH-->>C: CI verdict
        else Rejected
            C->>U: Abort (no push)
        end
    end

# 0. Bind the two flag variables from THIS invocation, before anything reads them.
# Write the literal value on each line: `true` only when that flag appeared in the
# /push-ci invocation, `false` otherwise. Both lines are always written, always in
# this order, and never guarded by `:=`, `-z` or `[ -n … ]` — a guard would let an
# inherited environment value survive, which is the entire defect this step closes.
# Measured: with these two unbound and an ambient `FORCE_WITH_LEASE=true` exported,
# the Phase 2 assembly below runs `git push --force-with-lease=refs/heads/<b>:<tip>`
# for an invocation that passed no flag and a plan that showed a plain push. The
# approval must name the force form (`rules/git-workflow.md` § Exception), so the
# form has to come from the arguments and from nothing else.
FORCE_WITH_LEASE=false   # `true` only if the invocation contained --force-with-lease
SET_UPSTREAM=false       # `true` only if the invocation contained --set-upstream
# ── Step 0a: the interpreter, before anything else ────────────────────────────
# First, because every check below is only as good as the shell running it. A non-interactive bash
# SOURCES `$BASH_ENV` before line 1 of this fence; zsh does the same with `$ENV` under sh
# emulation. A sourced file may define a function whose name contains a slash — bash refuses to
# IMPORT such a name from the environment, which is why the prefix is spelled absolutely, but it
# does not refuse to DEFINE one. Measured 2026-08-22, bash 3.2.57 and zsh 5.9: with
# `function /usr/bin/env { …; }` defined, the word `/usr/bin/env` resolved to the function and the
# child never ran. Every reading this phase prints, and the destination this phase digests for
# the approval, would then be whatever that function chose to say.
#
# **This block contains no command word, and that is the design.** Two `[[ ]]` tests (a keyword the
# parser resolves — a function cannot outrank it), three assignments (syntax, not commands), one
# expansion. Round 65 rewrote it after measuring the two ways the first version failed:
#   * it read its sentinel without resetting it, so an exported `SD0X_PUSH_CI_REFUSED=1` satisfied
#     the expansion and the fence continued with status 0 — the refusal printed and nothing stopped;
#   * it used `${!name+set}`, bash indirect expansion, which zsh rejects as `bad substitution`
#     even under `--emulate sh` — so on macOS's default shell it aborted at the first iteration
#     whether or not anything was set, and the `ENV` refusal it documents never ran.
# Assign, THEN expand: `:?` fires on null **or** unset, so assigning empty one line above makes it
# fire unconditionally. Set-ness, not emptiness, for what is DETECTED (`${BASH_ENV+set}` — an
# exported empty value is still a file the parent named); names never values (Anchor Register #2).
#
# What this does NOT close, stated because the comment that used to stand here over-claimed: a
# startup file that defines the function and then unsets the variable leaves nothing to detect. That
# residue has no owner downstream — the `pre-push` hook is opt-in, so where it is absent the
# in-session approval is the whole credential (`rules/git-workflow.md` § Push safety).
SHELL_STARTUP_INHERITED=
[[ -n "${BASH_ENV+set}" ]] && SHELL_STARTUP_INHERITED=BASH_ENV
[[ -n "${ENV+set}" ]] && SHELL_STARTUP_INHERITED="${SHELL_STARTUP_INHERITED:+${SHELL_STARTUP_INHERITED}, }ENV"
if [[ -n "$SHELL_STARTUP_INHERITED" ]]; then
  # No apostrophe anywhere in the word: inside `${var:?word}` bash reads one as an opening quote
  # even within double quotes, and that is a PARSE error — it would take the whole fence down on
  # every run, refusing and ordinary alike. Measured 2026-08-22.
  SD0X_PUSH_CI_REFUSED=
  : "${SD0X_PUSH_CI_REFUSED:?refusing — ${SHELL_STARTUP_INHERITED} is set in this environment.
   That startup file is sourced before line 1 of this fence and can redefine the commands below,
   including the absolute /usr/bin/env prefix (measured). Nothing this phase reports could then be
   relied on, and the in-session approval is the only credential where the opt-in pre-push hook is
   not installed. Unset it and re-run. Nothing is planned and nothing is pushed.}"
fi
 
# 0b. Transport variables decide WHERE git’s traffic goes — which repository is read from and
# written to — so nothing is planned while any of them is set. Four names, each measured 2026-08-22 on git 2.55.0 / OpenSSH 10.3p1: `GIT_SSH_COMMAND`,
# `GIT_SSH` and `GIT_PROXY_COMMAND` are run BY git AS the connection, handed the host and the
# remote command as arguments they are free to ignore; `GIT_SSH_VARIANT` names no executable at
# all but changes the argv git BUILDS — under `=plink` a URL's `:2222` is emitted as OpenSSH's
# `-P`, which takes a *tag* rather than a port (`ssh` usage: `[-P tag]`), so the connection
# silently falls back to 22.
#
# Refusing here, rather than relying on the `-u` clearing every command below carries, is this
# step's whole point. Clearing is not a neutral act: an operator's own
# `GIT_SSH_COMMAND='ssh -p 2222'` encodes part of the destination, and dropping it moves the push
# to port 22 — which SUCCEEDS silently wherever that host serves the same path there too. Set or
# cleared, the URL and digests this phase prints would then describe a destination the push does
# not reach, which is the one thing this phase exists to prevent. The `-u` list stays as defence
# in depth, for any caller that arrives at a later phase without passing through here.
#
# Set-ness, not emptiness, is the test — measured: an exported-empty `GIT_SSH_COMMAND` is not
# treated as unset, git runs `''` as the command (`run_command: GIT_PROTOCOL=version=2 '' -G …`).
# `${VAR+set}` — the direct form, one literal test per name — is what delivers it below; the
# indirect `${!_n+set}` a loop would need is bash-only and is why the loop is gone (next
# paragraph). Names are printed and values never are: a transport
# command line routinely carries a key path (Anchor Register #2).
# Four literal tests rather than a loop over `${!_n+set}`. That is **bash** indirect expansion and
# zsh 5.9 rejects it outright — `bad substitution`, rc=1, even under `--emulate sh` — so on the
# platform's default shell the loop aborted at its FIRST iteration whether or not anything was set:
# this refusal never ran, and neither did anything below it. Measured 2026-08-22. Round 65 took the
# same construction out of step 0a and left this copy, one block away, standing.
TRANSPORT_PRESENT=
[[ -n "${GIT_SSH_COMMAND+set}" ]] && TRANSPORT_PRESENT=GIT_SSH_COMMAND
[[ -n "${GIT_SSH+set}" ]] && TRANSPORT_PRESENT="${TRANSPORT_PRESENT:+${TRANSPORT_PRESENT}, }GIT_SSH"
[[ -n "${GIT_PROXY_COMMAND+set}" ]] && TRANSPORT_PRESENT="${TRANSPORT_PRESENT:+${TRANSPORT_PRESENT}, }GIT_PROXY_COMMAND"
[[ -n "${GIT_SSH_VARIANT+set}" ]] && TRANSPORT_PRESENT="${TRANSPORT_PRESENT:+${TRANSPORT_PRESENT}, }GIT_SSH_VARIANT"
if [[ -n "$TRANSPORT_PRESENT" ]]; then
  echo "⛔ transport variables set in this environment: ${TRANSPORT_PRESENT}" >&2
  echo "   Each one decides where a push lands, so neither honouring nor clearing them lets this" >&2
  echo "   phase describe the destination that would be reached." >&2
  echo "   Move the setting to ~/.ssh/config or 'git config core.sshCommand' — per-host, durable," >&2
  echo "   and visible to 'git config' — then re-run. Nothing is planned or pushed until then." >&2
  # Terminated the way step 0a is, and for the same measured reason: `exit` is a builtin, and an
  # imported `BASH_FUNC_exit%%` that returns leaves the refusal printed and the phase running.
  SD0X_PUSH_CI_REFUSED=
  : "${SD0X_PUSH_CI_REFUSED:?refusing — transport variables set in this environment}"
fi
 
# 1. Current branch
BRANCH=$(/usr/bin/env -u BASH_ENV -u ENV -u GIT_EXEC_PATH -u GIT_DIR -u GIT_WORK_TREE -u GIT_COMMON_DIR -u GIT_INDEX_FILE -u GIT_OBJECT_DIRECTORY -u GIT_ALTERNATE_OBJECT_DIRECTORIES -u GIT_NAMESPACE -u GIT_CEILING_DIRECTORIES -u GIT_GLOB_PATHSPECS -u GIT_ICASE_PATHSPECS -u GIT_NOGLOB_PATHSPECS -u GIT_LITERAL_PATHSPECS -u GIT_CONFIG -u GIT_CONFIG_PARAMETERS -u GIT_CONFIG_COUNT -u GIT_CONFIG_NOSYSTEM -u GIT_CONFIG_GLOBAL -u GIT_CONFIG_SYSTEM -u GIT_IMPLICIT_WORK_TREE -u GIT_GRAFT_FILE -u GIT_SHALLOW_FILE -u GIT_PREFIX -u GIT_REPLACE_REF_BASE -u GIT_EXTERNAL_DIFF -u GIT_SSH_COMMAND -u GIT_SSH -u GIT_PROXY_COMMAND -u GIT_SSH_VARIANT git rev-parse --abbrev-ref HEAD)
 
# 1b. Detached HEAD, **or no branch name at all** — hard-abort. On a detached HEAD the command
# above returns the literal string `HEAD`, which is not a branch name; when it *fails* it returns
# nothing, which is not one either, and the empty case was the one this check could not see.
# Every later step treats $BRANCH as a branch name: the protected-branch match below compares it
# against main/master/develop, the upstream probe builds `origin/$BRANCH`, and the push builds a
# branch refspec — so an empty one silently compares against nothing and builds `origin/`. The
# same refusal is already carried in Phase 1; Phase 0 is where the plan is built, so it belongs
# here first.
if [[ -z "$BRANCH" ]] || [[ "$BRANCH" = "HEAD" ]]; then
  echo "⛔ Phase 0: no branch name here — detached HEAD, or rev-parse failed. /push-ci pushes a" >&2
  echo "   named branch, and every check below names it. Nothing is planned and nothing is pushed." >&2
  # Not `exit`: a builtin is outranked by an imported `BASH_FUNC_exit%%`, and this arm sets no
  # flag a later step reads, so a shadowed `exit` would leave the whole phase running on a
  # branch name that is not one.
  SD0X_PUSH_CI_REFUSED=
  : "${SD0X_PUSH_CI_REFUSED:?refusing — no branch name could be derived in Phase 0}"
fi
 
# 2. Protected branch detection
# If main, master, develop, or release/* → warn + AskUserQuestion pre-approval
# (do NOT hard-abort; let user decide) — EXCEPT when --force-with-lease was passed:
# that combination hard-aborts, because force push to shared branches is prohibited
# (rules/git-workflow.md § Prohibited) and no approval can authorize it
 
# 3. Remote exists. The status is CAPTURED and acted on, not discarded: this line used to
# run bare with `>/dev/null 2>&1`, so a failing `ls-remote` left `$?` for the next command
# to overwrite and the fence reported a normal-looking preflight for a remote that does not
# resolve. The table below calls this an Abort, and an abort a later step cannot see is a
# table row nothing implements.
# No `--exit-code`, and that is the whole question this check asks. Measured 2026-08-22
# against a local bare repo: `--exit-code` returns 2 for a remote that answered and simply
# has no refs yet, 128 for one that could not be reached — one status for "reachable and
# empty", another for "not there", and the flag conflates the first with a failure. An
# empty remote is the first push of a new repository, which is a case /push-ci exists for.
# Without the flag the two separate: 0 reachable (refs or not), 128 unreachable.
if ! /usr/bin/env -u BASH_ENV -u ENV -u GIT_EXEC_PATH -u GIT_DIR -u GIT_WORK_TREE -u GIT_COMMON_DIR -u GIT_INDEX_FILE -u GIT_OBJECT_DIRECTORY -u GIT_ALTERNATE_OBJECT_DIRECTORIES -u GIT_NAMESPACE -u GIT_CEILING_DIRECTORIES -u GIT_GLOB_PATHSPECS -u GIT_ICASE_PATHSPECS -u GIT_NOGLOB_PATHSPECS -u GIT_LITERAL_PATHSPECS -u GIT_CONFIG -u GIT_CONFIG_PARAMETERS -u GIT_CONFIG_COUNT -u GIT_CONFIG_NOSYSTEM -u GIT_CONFIG_GLOBAL -u GIT_CONFIG_SYSTEM -u GIT_IMPLICIT_WORK_TREE -u GIT_GRAFT_FILE -u GIT_SHALLOW_FILE -u GIT_PREFIX -u GIT_REPLACE_REF_BASE -u GIT_EXTERNAL_DIFF -u GIT_SSH_COMMAND -u GIT_SSH -u GIT_PROXY_COMMAND -u GIT_SSH_VARIANT git ls-remote --upload-pack=git-upload-pack origin >/dev/null 2>&1; then
  echo "⛔ remote 'origin' did not answer — check the remote, or that you can reach it" >&2
  # Same terminator class as step 1b: no flag is set here, so `exit` alone is the whole refusal.
  SD0X_PUSH_CI_REFUSED=
  : "${SD0X_PUSH_CI_REFUSED:?refusing — remote 'origin' did not answer}"
fi
 
# 4. Working tree status. The status is checked, not merely printed: Phase 0's contract is to
# hard-abort on infrastructure failure, and a `git status` that fails prints nothing — which
# reads exactly like a clean tree to whoever is about to approve a push plan built from it.
/usr/bin/env -u BASH_ENV -u ENV -u GIT_EXEC_PATH -u GIT_DIR -u GIT_WORK_TREE -u GIT_COMMON_DIR -u GIT_INDEX_FILE -u GIT_OBJECT_DIRECTORY -u GIT_ALTERNATE_OBJECT_DIRECTORIES -u GIT_NAMESPACE -u GIT_CEILING_DIRECTORIES -u GIT_GLOB_PATHSPECS -u GIT_ICASE_PATHSPECS -u GIT_NOGLOB_PATHSPECS -u GIT_LITERAL_PATHSPECS -u GIT_CONFIG -u GIT_CONFIG_PARAMETERS -u GIT_CONFIG_COUNT -u GIT_CONFIG_NOSYSTEM -u GIT_CONFIG_GLOBAL -u GIT_CONFIG_SYSTEM -u GIT_IMPLICIT_WORK_TREE -u GIT_GRAFT_FILE -u GIT_SHALLOW_FILE -u GIT_PREFIX -u GIT_REPLACE_REF_BASE -u GIT_EXTERNAL_DIFF -u GIT_SSH_COMMAND -u GIT_SSH -u GIT_PROXY_COMMAND -u GIT_SSH_VARIANT git status --short || {
  echo "⛔ Phase 0: the working tree could not be read. The plan below would describe a tree" >&2
  echo "   nobody looked at. Nothing is planned and nothing is pushed." >&2
  SD0X_PUSH_CI_REFUSED=
  : "${SD0X_PUSH_CI_REFUSED:?refusing — the working tree could not be read}"
}
 
# 5. Commits ahead of remote. Two steps, never `… 2>/dev/null || echo "new branch"`: that form
# cannot tell "there is no remote-tracking ref" from a `rev-list` that fataled on a corrupt or
# unreadable object — it discards the diagnostic, prints the reassuring reading and exits 0, in a
# phase whose stated contract is to hard-abort on infrastructure failure. Existence is asked
# first, and only a ref that exists but cannot be counted is an error. Fully qualified for the
# reason § Names in commands gives: `origin/<name>` is DWIM and git resolves `refs/tags/` before
# `refs/remotes/`, so a tag named `origin/feat/x` would answer this range in place of the branch.
# The status is CAPTURED and switched on, never negated. `git rev-parse --verify --quiet` exits
# 1 for a ref that is absent and 128 for a repository or lookup failure, and `if !` collapses
# the two into one branch — so an unreadable repository prints "new branch" and this phase
# continues, in a phase whose stated contract is to hard-abort on infrastructure failure. It is
# the same fail-open shape the note above rejects one level out, pointing the same way: the
# collapsed reading is the reassuring one, which is why nobody notices it.
# `if` rather than a following `VERIFY_STATUS=$?` line: under an inherited `errexit` the shell
# aborts AT the lookup, so exit 1 — the ref genuinely is not there, which is this phase's
# ordinary new-branch case — would never reach the arm below that reports it. A command whose
# status the `if` consumes is not one `set -e` acts on.
if /usr/bin/env -u BASH_ENV -u ENV -u GIT_EXEC_PATH -u GIT_DIR -u GIT_WORK_TREE -u GIT_COMMON_DIR -u GIT_INDEX_FILE -u GIT_OBJECT_DIRECTORY -u GIT_ALTERNATE_OBJECT_DIRECTORIES -u GIT_NAMESPACE -u GIT_CEILING_DIRECTORIES -u GIT_GLOB_PATHSPECS -u GIT_ICASE_PATHSPECS -u GIT_NOGLOB_PATHSPECS -u GIT_LITERAL_PATHSPECS -u GIT_CONFIG -u GIT_CONFIG_PARAMETERS -u GIT_CONFIG_COUNT -u GIT_CONFIG_NOSYSTEM -u GIT_CONFIG_GLOBAL -u GIT_CONFIG_SYSTEM -u GIT_IMPLICIT_WORK_TREE -u GIT_GRAFT_FILE -u GIT_SHALLOW_FILE -u GIT_PREFIX -u GIT_REPLACE_REF_BASE -u GIT_EXTERNAL_DIFF -u GIT_SSH_COMMAND -u GIT_SSH -u GIT_PROXY_COMMAND -u GIT_SSH_VARIANT git rev-parse --verify --quiet "refs/remotes/origin/${BRANCH}" >/dev/null; then
  VERIFY_STATUS=0
else
  VERIFY_STATUS=$?
fi
case "$VERIFY_STATUS" in
  1)
    echo "new branch (no refs/remotes/origin/${BRANCH})"
    ;;
  0)
    if COMMITS_AHEAD=$(/usr/bin/env -u BASH_ENV -u ENV -u GIT_EXEC_PATH -u GIT_DIR -u GIT_WORK_TREE -u GIT_COMMON_DIR -u GIT_INDEX_FILE -u GIT_OBJECT_DIRECTORY -u GIT_ALTERNATE_OBJECT_DIRECTORIES -u GIT_NAMESPACE -u GIT_CEILING_DIRECTORIES -u GIT_GLOB_PATHSPECS -u GIT_ICASE_PATHSPECS -u GIT_NOGLOB_PATHSPECS -u GIT_LITERAL_PATHSPECS -u GIT_CONFIG -u GIT_CONFIG_PARAMETERS -u GIT_CONFIG_COUNT -u GIT_CONFIG_NOSYSTEM -u GIT_CONFIG_GLOBAL -u GIT_CONFIG_SYSTEM -u GIT_IMPLICIT_WORK_TREE -u GIT_GRAFT_FILE -u GIT_SHALLOW_FILE -u GIT_PREFIX -u GIT_REPLACE_REF_BASE -u GIT_EXTERNAL_DIFF -u GIT_SSH_COMMAND -u GIT_SSH -u GIT_PROXY_COMMAND -u GIT_SSH_VARIANT git rev-list --count "refs/remotes/origin/${BRANCH}..HEAD" --); then
      echo "${COMMITS_AHEAD}"
    else
      echo "⛔ Phase 0: refs/remotes/origin/${BRANCH} exists but the commits-ahead count could" >&2
      echo "   not be read. That is a repository failure, not a new branch, and the two need" >&2
      echo "   opposite responses. Nothing is planned and nothing is pushed." >&2
      SD0X_PUSH_CI_REFUSED=
      : "${SD0X_PUSH_CI_REFUSED:?refusing — the commits-ahead count could not be read}"
    fi
    ;;
  *)
    echo "⛔ Phase 0: refs/remotes/origin/${BRANCH} could not be looked up — git exited" >&2
    echo "   ${VERIFY_STATUS}, which is a repository or lookup failure and not an absent ref." >&2
    echo "   Reading it as a new branch would plan a push against a repository nothing read." >&2
    SD0X_PUSH_CI_REFUSED=
    : "${SD0X_PUSH_CI_REFUSED:?refusing — the remote-tracking ref could not be looked up}"
    ;;
esac
 
# 5b. --set-upstream auto-detect. This may only ever turn SET_UPSTREAM ON: `-u` on a
# branch that already has an upstream is a no-op, while dropping a requested `-u`
# would silently change what the plan promised. It runs after step 1b, so a detached
# HEAD has already aborted rather than reaching an `@{u}` probe that cannot mean
# anything there.
if [[ "$SET_UPSTREAM" != "true" ]] &&
   ! /usr/bin/env -u BASH_ENV -u ENV -u GIT_EXEC_PATH -u GIT_DIR -u GIT_WORK_TREE -u GIT_COMMON_DIR -u GIT_INDEX_FILE -u GIT_OBJECT_DIRECTORY -u GIT_ALTERNATE_OBJECT_DIRECTORIES -u GIT_NAMESPACE -u GIT_CEILING_DIRECTORIES -u GIT_GLOB_PATHSPECS -u GIT_ICASE_PATHSPECS -u GIT_NOGLOB_PATHSPECS -u GIT_LITERAL_PATHSPECS -u GIT_CONFIG -u GIT_CONFIG_PARAMETERS -u GIT_CONFIG_COUNT -u GIT_CONFIG_NOSYSTEM -u GIT_CONFIG_GLOBAL -u GIT_CONFIG_SYSTEM -u GIT_IMPLICIT_WORK_TREE -u GIT_GRAFT_FILE -u GIT_SHALLOW_FILE -u GIT_PREFIX -u GIT_REPLACE_REF_BASE -u GIT_EXTERNAL_DIFF -u GIT_SSH_COMMAND -u GIT_SSH -u GIT_PROXY_COMMAND -u GIT_SSH_VARIANT git rev-parse --abbrev-ref --symbolic-full-name '@{u}' >/dev/null 2>&1; then
  SET_UPSTREAM=true
fi
 
# 6. Local HEAD SHA (for CI run matching later). Checked for the same reason as step 4, and with
# a sharper consequence: this value is what the approval names and what `/watch-ci` is later sent
# after. A failed lookup makes it empty, and an empty `HEAD_SHA` in the plan is a plan the
# operator cannot approve meaningfully. Phase 2 re-derives and compares, so this is not a route to
# an unsafe push — it is an approval collected for a plan that was never valid.
HEAD_SHA=$(/usr/bin/env -u BASH_ENV -u ENV -u GIT_EXEC_PATH -u GIT_DIR -u GIT_WORK_TREE -u GIT_COMMON_DIR -u GIT_INDEX_FILE -u GIT_OBJECT_DIRECTORY -u GIT_ALTERNATE_OBJECT_DIRECTORIES -u GIT_NAMESPACE -u GIT_CEILING_DIRECTORIES -u GIT_GLOB_PATHSPECS -u GIT_ICASE_PATHSPECS -u GIT_NOGLOB_PATHSPECS -u GIT_LITERAL_PATHSPECS -u GIT_CONFIG -u GIT_CONFIG_PARAMETERS -u GIT_CONFIG_COUNT -u GIT_CONFIG_NOSYSTEM -u GIT_CONFIG_GLOBAL -u GIT_CONFIG_SYSTEM -u GIT_IMPLICIT_WORK_TREE -u GIT_GRAFT_FILE -u GIT_SHALLOW_FILE -u GIT_PREFIX -u GIT_REPLACE_REF_BASE -u GIT_EXTERNAL_DIFF -u GIT_SSH_COMMAND -u GIT_SSH -u GIT_PROXY_COMMAND -u GIT_SSH_VARIANT git rev-parse HEAD) || HEAD_SHA=
if [[ -z "$HEAD_SHA" ]]; then
  echo "⛔ Phase 0: HEAD could not be resolved. The push plan names the commit being pushed;" >&2
  echo "   an empty one is not a plan. Nothing is planned and nothing is pushed." >&2
  SD0X_PUSH_CI_REFUSED=
  : "${SD0X_PUSH_CI_REFUSED:?refusing — HEAD could not be resolved}"
fi
 
# 7. pre-push gate detection — reports whether a hook referencing the gate exists.
# It informs how the push plan describes the credential; it never decides one, for
# the reason spelled out below: reference is not invocation.
# --git-path resolves core.hooksPath (and therefore Husky, which sets it), so a
# hook installed in any of the modes /codex-setup supports is found here.
# Existence is not enough: an unrelated pre-push hook (lint, test runner, a Husky
# shim that never sources the gate) is executable too, and reporting it as the
# terminal credential would promise a /dev/tty prompt that never comes.
# Comment lines are excluded before matching, because a disabled gate keeps its
# name in the file — `# pre-push-gate disabled during migration` followed by
# `exit 0` is executable, mentions the gate, and prompts for nothing.
# What this predicate establishes is *reference*, not invocation — and no static
# check of a shell script can establish invocation. `printf pre-push-gate >/dev/null`
# satisfies it and runs nothing. So the result is evidence, never proof, and the
# consequence is bounded below: an approval is required in every case, and L2 is
# demoted to advisory by the operator SEEING the terminal prompt, not by this check
# predicting one (see the note under the push-class table).
# This detection reads only THIS file and does not follow indirection:
# a Husky shim that execs a second script naming the gate reads as `absent`. That
# is the safe direction and the reason the whole check is written to fail toward
# it — an under-claimed credential costs one extra confirmation, an over-claimed
# one manufactures an approval nobody gave.
# Wrapped in an ABSOLUTE `/bin/bash -c` so the compound command matches this skill's
# allowed-tools (`Bash(/bin/bash:*)`, granted alongside `Bash(bash:*)` for this line); a bare
# `grep` here is outside the grant (see the Footguns table in CLAUDE.md). The absolute spelling
# is not cosmetic. The body below already runs `/usr/bin/grep` and `/bin/echo` for exactly one
# reason — every bare word is claimable by an imported function — and a bare `bash` wrapping
# them is that same hole one level up, where it swallows the whole probe rather than one word
# of it: an imported `BASH_FUNC_bash%%` never runs the body at all and prints what it likes.
# `PUSH_GATE=referenced` forged that way makes the push plan promise the operator a `/dev/tty`
# prompt that no hook is going to show.
PUSH_GATE=$(/bin/bash -c '
  hook="$(/usr/bin/env -u BASH_ENV -u ENV -u GIT_EXEC_PATH -u GIT_DIR -u GIT_WORK_TREE -u GIT_COMMON_DIR -u GIT_INDEX_FILE -u GIT_OBJECT_DIRECTORY -u GIT_ALTERNATE_OBJECT_DIRECTORIES -u GIT_NAMESPACE -u GIT_CEILING_DIRECTORIES -u GIT_GLOB_PATHSPECS -u GIT_ICASE_PATHSPECS -u GIT_NOGLOB_PATHSPECS -u GIT_LITERAL_PATHSPECS -u GIT_CONFIG -u GIT_CONFIG_PARAMETERS -u GIT_CONFIG_COUNT -u GIT_CONFIG_NOSYSTEM -u GIT_CONFIG_GLOBAL -u GIT_CONFIG_SYSTEM -u GIT_IMPLICIT_WORK_TREE -u GIT_GRAFT_FILE -u GIT_SHALLOW_FILE -u GIT_PREFIX -u GIT_REPLACE_REF_BASE -u GIT_EXTERNAL_DIFF -u GIT_SSH_COMMAND -u GIT_SSH -u GIT_PROXY_COMMAND -u GIT_SSH_VARIANT git rev-parse --git-path hooks)/pre-push"
  # Absolute paths, and `echo` included: the stdout of this subshell IS `PUSH_GATE`, and every
  # word here is claimable by an imported function — `grep` and `echo` alike, since function
  # lookup precedes both the builtins and PATH. The probe selects no credential, but it decides
  # what the push plan tells the operator to expect. (No apostrophes in this block: it is the
  # body of a single-quoted `bash -c`, so one would close the string.)
  if [[ -x "$hook" ]] && /usr/bin/grep -v "^[[:space:]]*#" "$hook" 2>/dev/null | /usr/bin/grep -q "pre-push-gate"; then
    /bin/echo referenced
  else
    /bin/echo absent
  fi
')
 
# 8. The effective push destination. `origin` is a name, not a destination: it can
# carry one URL for fetching and another for pushing, and `pushurl` is multi-valued,
# so the push may fan out. Derived HERE, in the same shell as the steps above and
# before the first question is asked — the protected-branch pre-approval below and
# the Phase 1 plan both name it, and Phase 2 refuses when it no longer matches.
# Until round 49 the only pre-approval derivation lived inside Phase 1's
# `--force-with-lease` branch, so an ordinary push reached that comparison with a
# value no approval had shown; round 50 moved it in here, because a value assigned
# in a fence of its own dies with that fence (see Phase 2 on separate shells).
if PUSH_URLS=$(/usr/bin/env -u BASH_ENV -u ENV -u GIT_EXEC_PATH -u GIT_DIR -u GIT_WORK_TREE -u GIT_COMMON_DIR -u GIT_INDEX_FILE -u GIT_OBJECT_DIRECTORY -u GIT_ALTERNATE_OBJECT_DIRECTORIES -u GIT_NAMESPACE -u GIT_CEILING_DIRECTORIES -u GIT_GLOB_PATHSPECS -u GIT_ICASE_PATHSPECS -u GIT_NOGLOB_PATHSPECS -u GIT_LITERAL_PATHSPECS -u GIT_CONFIG -u GIT_CONFIG_PARAMETERS -u GIT_CONFIG_COUNT -u GIT_CONFIG_NOSYSTEM -u GIT_CONFIG_GLOBAL -u GIT_CONFIG_SYSTEM -u GIT_IMPLICIT_WORK_TREE -u GIT_GRAFT_FILE -u GIT_SHALLOW_FILE -u GIT_PREFIX -u GIT_REPLACE_REF_BASE -u GIT_EXTERNAL_DIFF -u GIT_SSH_COMMAND -u GIT_SSH -u GIT_PROXY_COMMAND -u GIT_SSH_VARIANT GIT_GRAFT_FILE=/dev/null GIT_NO_REPLACE_OBJECTS=1 git remote get-url --push --all origin); then
  PUSH_URL=${PUSH_URLS%%$'\n'*}
else
  PUSH_URLS=; PUSH_URL=
fi
# 7c. `--force-with-lease` × a fan-out destination: refuse HERE, before any question is asked.
# A `url.<x>.pushInsteadOf` rewrite is NOT a way in, and the earlier draft said it was: git applies
# the single longest matching prefix, so a rewrite maps one URL to one URL, and where an explicit
# `remote.<name>.pushurl` exists `pushInsteadOf` is not consulted for that remote at all.
# `"$PUSH_URLS" != "$PUSH_URL"` is this document's own idiom for "more than one" (the two lines
# below say why it is exact). A FAILED derivation leaves both empty and equal, so it is not this
# row — that one is fail-closed downstream, where the destination guard compares the digest.
if [[ "$FORCE_WITH_LEASE" == "true" ]] && [[ "$PUSH_URLS" != "$PUSH_URL" ]]; then
  echo "⛔ --force-with-lease with more than one push destination — refusing before asking." >&2
  echo "   'origin' resolves to a fan-out: remote.origin.pushurl is multi-valued, or — with no" >&2
  echo "   pushurl configured — remote.origin.url is. A lease is measured against ONE" >&2
  echo "   remote tip, so the topology re-check before the push cannot say what each destination" >&2
  echo "   would be rewritten from — it reads 'unknown' and refuses. That refusal is correct;" >&2
  echo "   asking you to approve the push first is not." >&2
  echo "   Push the rewrite one destination at a time, naming each URL explicitly, so each one" >&2
  echo "   gets its own lease and its own answer to who else holds ${BRANCH}." >&2
  # Not `exit 1`: measured 2026-08-22, an imported `BASH_FUNC_exit%%` that returns leaves the
  # refusal printed and execution continuing into the report and the approval. Assign-then-expand,
  # as in step 0a — syntax and an expansion, nothing a function can outrank. The `echo`s above are
  # shadowable too; that costs the message, not the refusal, which is the right way round.
  SD0X_PUSH_CI_REFUSED=
  : "${SD0X_PUSH_CI_REFUSED:?refusing — --force-with-lease with more than one push destination}"
fi
 
# Anything but exactly one URL is the fail-closed row, not a benign one. $(...) strips trailing
# newlines, so one URL leaves none and "$PUSH_URLS" != "$PUSH_URL" is precisely "more than one".
PUSH_URLS_SAFE=
while IFS= read -r U; do
  case "$U" in
    *://*)
      REST=${U#*://}; AUTH=${REST%%/*}; AUTH=${AUTH%%\?*}; AUTH=${AUTH%%\#*}
      case "$AUTH" in
        *@*) U="${U%%://*}://<redacted>@${AUTH##*@}${REST#"$AUTH"}" ;;
      esac
      case "$U" in
        *\?*) U="${U%%\?*}?<redacted>" ;;
        *\#*) U="${U%%\#*}#<redacted>" ;;
      esac
      ;;
    *:*)
      # scp-like `[user@]host:path`. No scheme, so the arm above cannot reach it — until
      # 2026-08-22 every scp-like user printed verbatim, on the reasoning that it is always `git`.
      # It is not: `<token>@host:path` is legal, and this value goes into an approval transcript.
      # The `*/*` guard is the two readings of `:` — git treats one as scp-like only when no `/`
      # precedes it, so a local path keeps its `@`. Same as `scripts/pre-push-gate.sh`; keep in step.
      _pre=${U%%:*}
      case "$_pre" in
        */*) ;;
        *@*) U="<redacted>@${_pre##*@}:${U#*:}" ;;
      esac
      ;;
  esac
  PUSH_URLS_SAFE=${PUSH_URLS_SAFE:+$PUSH_URLS_SAFE$'\n'}$U
done <<SAFE_EOF
$PUSH_URLS
SAFE_EOF
# 9. Report everything above. Each fence is a separate shell, so a value assigned here and
# not printed here reaches nobody — not the Phase 1 plan, not the questions, not Phase 2's
# re-derivation check. Until round 52 this block printed `PUSH_URLS_SAFE` alone, and every
# other line above was a value only this fence ever saw: the plan then named a branch, an
# upstream decision, a HEAD and a gate state that the model had to supply from somewhere
# else, which is the same failure as deriving them in a fence of their own. One field per
# line, name first, value bracketed — brackets so an empty value is visible as `[]` rather
# than as a line that looks truncated.
# 8b. The binding key, round 54. `PUSH_URLS_SAFE` is what a HUMAN reads, and redaction is lossy
# by design — it deletes the whole query and fragment. Two different repositories therefore
# redact to one string: `https://gw.example/push?repo=A&token=one` and `…?repo=B&token=two` both
# become `https://gw.example/push?<redacted>` (measured). Comparing THAT in Phase 2 binds the
# approval to a host and a path, not to a destination, so a `.git/config` edit between approval
# and push moves the push to another repository and the guard passes.
# So identity travels as a digest of each RAW URL, and the redaction is what a human reads. The
# digest IS printed — on the line below, in the plan, and by the gate when it refuses — so the
# honest claim is not "nothing is displayed" but that a SHA-256 preimage is not recoverable from
# it. What it does leak is equality: two transcripts carrying the same digest pushed to the same
# destination, and a guessable URL can be confirmed offline. Both are accepted; neither is a
# reason to show the raw URL instead, which would leak the credential itself.
# One digest per push URL, SHA-256, space separated — a SET, because git invokes the pre-push hook
# ONCE PER PUSH URL with that single URL in `$2` (measured 2026-08-22). A digest of the whole list
# matches no single call, so it refused every fan-out the operator had configured and approved.
# SHA-256 rather than `git hash-object`: `rules/security.md` prohibits SHA-1 where a digest carries
# a security decision, and that prohibition is what makes the change mandatory. `hash-object` also
# follows the *repository's* object format — measured 2026-08-22, the same URL digests to
# `b354136a…` by default and `7524f1f0…` under `--object-format=sha256`, and back to the SHA-1
# value outside a repository. Round 59 corrects how much that carries: it does NOT by itself make
# the two sides disagree, since the plan side and the hook run for the same repository and read
# the same format. It is a reason not to build a cross-process binding on a tool whose algorithm
# is chosen by ambient state, and it bites where one side runs outside the repository at all.
# A URL that will not hash empties the WHOLE value rather than shortening the set: a partial set
# approves fewer destinations than the plan showed, and looks like a successful derivation.
# Round 60: SELECT the digest tool, THEN feed it. A `||` chain over a pipeline let the FIRST
# command consume stdin and then fail, after which the fallback hashed EOF. Measured 2026-08-22:
# `https://gw.example/push?repo=A&token=one` and `…?repo=B&token=two` BOTH digested to
# e3b0c442…b855 — the SHA-256 of the empty string — so two different destinations compared EQUAL
# and the destination guard passed on a destination that had changed. `command -v` does not read
# stdin, so doing the selection with it feeds the input exactly once, to exactly one tool. Same
# shape as `scripts/pre-push-gate.sh` § sha256_raw, deliberately: one algorithm, stated once.
sha256_raw() {   # reads stdin, writes the selected tool's own output line; nonzero only if none exists
  # Invoked through `/usr/bin/env`, never as a bare word. `command -v` reports an imported shell
  # function as a perfectly good command, and the known-answer test below only rejects a tool that
  # answers one CONSTANT. An ADAPTIVE function passes both vectors and then returns one fixed
  # digest for every real URL, so two different destinations compare EQUAL and the approval is
  # bound to nothing. `env` resolves PATH only, and bash refuses to import a function whose name
  # contains a slash, so a function-only match makes `env` fail and the test below correctly
  # empties the digest. `scripts/pre-push-gate.sh` needs no such spelling and is not inconsistent
  # with this: its `#!/usr/bin/env -S bash -p` shebang refuses to import functions at all, while
  # these fences have no shebang of their own. The defence differs because the channel does.
  if command -v sha256sum >/dev/null 2>&1; then /usr/bin/env sha256sum
  elif command -v shasum >/dev/null 2>&1; then /usr/bin/env shasum -a 256
  elif command -v openssl >/dev/null 2>&1; then /usr/bin/env openssl dgst -sha256
  else return 1
  fi
}
sha256_hex() {   # the bare hex the tool produced — NO shape check, the KAT below needs the raw answer
  _H=$(/usr/bin/printf '%s' "$1" | sha256_raw 2>/dev/null) || _H=
  _H=${_H##*= }     # openssl: `SHA2-256(stdin)= <hex>`
  _H=${_H%% *}      # sha256sum / shasum: `<hex>  -`
  /usr/bin/printf '%s' "$_H"
}
# Known-answer test, two vectors. A tool that answers one constant whatever it is fed makes every
# destination compare equal to every approval — and a constant is well-shaped, so the shape check
# in the loop cannot see it. The empty vector is precisely the answer the defect above produced.
DIGEST_TOOL_OK=
if [[ "$(sha256_hex '')" = e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 ]] \
&& [[ "$(sha256_hex abc)" = ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad ]]; then
  DIGEST_TOOL_OK=yes
fi
PUSH_URLS_DIGEST=
while IFS= read -r U; do
  [[ -n "$U" ]] || continue
  D=
  if [[ -n "$DIGEST_TOOL_OK" ]]; then D=$(sha256_hex "$U"); fi
  case "$D" in *[!0-9a-f]*|'') D= ;; *) [[ ${#D} -eq 64 ]] || D= ;; esac
  if [[ -z "$D" ]]; then PUSH_URLS_DIGEST=; break; fi
  PUSH_URLS_DIGEST=${PUSH_URLS_DIGEST:+$PUSH_URLS_DIGEST }$D
done <<< "$PUSH_URLS"
# `remote.<name>.receivepack` names the program that receives the objects on the far side, and a
# program is free to ignore the repository the URL named. Measured 2026-08-22: with one configured,
# an ordinary branch push printed `To <the approved URL>  * [new branch] main -> main` while every
# object landed in a DIFFERENT repository and the named one stayed empty. No digest of the URL can
# see that, so with one configured the destination is not established and this skill does not push.
# The gate refuses it too where the binding reaches it; this line is what covers the projects that
# never installed the gate, and `git-workflow.md` § Push safety is why the absent gate moves the
# question here rather than deleting it. This read is best-effort and its boundary is measured:
# git runs the pre-push hook only after the ref advertisement, so a wrapper that clears its own
# config key before serving redirects the objects while every reader here sees nothing (measured
# 2026-08-22 — the hook saw `<unset>`, git reported success against the named URL, and the objects
# landed elsewhere). What closes that is the push line itself, which spells
# `--receive-pack=git-receive-pack`: a command-line value overrides the configured one, while
# `-c remote.<name>.receivepack=` does not (git keeps the config value and says "more than one
# receivepack given, using the first"). This read still earns its place — it refuses BEFORE the
# operator is asked to approve a destination that was never going to receive the objects.
PUSH_RECEIVEPACK=$(/usr/bin/env -u BASH_ENV -u ENV -u GIT_EXEC_PATH -u GIT_DIR -u GIT_WORK_TREE -u GIT_COMMON_DIR -u GIT_INDEX_FILE -u GIT_OBJECT_DIRECTORY -u GIT_ALTERNATE_OBJECT_DIRECTORIES -u GIT_NAMESPACE -u GIT_CEILING_DIRECTORIES -u GIT_GLOB_PATHSPECS -u GIT_ICASE_PATHSPECS -u GIT_NOGLOB_PATHSPECS -u GIT_LITERAL_PATHSPECS -u GIT_CONFIG -u GIT_CONFIG_PARAMETERS -u GIT_CONFIG_COUNT -u GIT_CONFIG_NOSYSTEM -u GIT_CONFIG_GLOBAL -u GIT_CONFIG_SYSTEM -u GIT_IMPLICIT_WORK_TREE -u GIT_GRAFT_FILE -u GIT_SHALLOW_FILE -u GIT_PREFIX -u GIT_REPLACE_REF_BASE -u GIT_EXTERNAL_DIFF -u GIT_SSH_COMMAND -u GIT_SSH -u GIT_PROXY_COMMAND -u GIT_SSH_VARIANT git config --get remote.origin.receivepack 2>/dev/null) || PUSH_RECEIVEPACK=
PUSH_RECEIVEPACK_SET=no
if [[ -n "$PUSH_RECEIVEPACK" ]]; then PUSH_RECEIVEPACK_SET=yes; fi
# **The report is as security-sensitive as the readings above, and until round 59 it was the one
# construct here that a caller could answer.** `printf` is a regular builtin, and in bash a
# function outranks a builtin, so an exported `BASH_FUNC_printf%%` replaces this line wholesale:
# measured 2026-08-22, a fence whose real variables were `ASK=1 ASK_REASON=rewrite` printed
# `ASK=[] ASK_REASON=[fast-forward]` to the agent. Every `case` and `[[` above is immune and it
# bought nothing, because the verdict left through a channel the caller owned. An ABSOLUTE path is
# immune for the reason the Husky stanza already relies on — bash refuses to import a function
# whose name contains a slash (`error importing function definition for '/usr/bin/printf'`,
# measured). If `/usr/bin/printf` is missing the fence prints no report at all, and that is the
# correct failure: **a run with no report line is `unknown`, and unknown asks.**
/usr/bin/printf 'BRANCH=[%s]\nSET_UPSTREAM=[%s]\nFORCE_WITH_LEASE=[%s]\nHEAD_SHA=[%s]\nPUSH_GATE=[%s]\nPUSH_URLS_SAFE=[%s]\nPUSH_URLS_DIGEST=[%s]\nPUSH_RECEIVEPACK_SET=[%s]\n' \
  "$BRANCH" "$SET_UPSTREAM" "$FORCE_WITH_LEASE" "$HEAD_SHA" "$PUSH_GATE" "$PUSH_URLS_SAFE" "$PUSH_URLS_DIGEST" \
    "$PUSH_RECEIVEPACK_SET"

## Push Plan
 
-Branch: `<branch>`
-Remote: `origin` → `<the effective push destination — the `PUSH_URLS_SAFE` value Phase 0 step 8 derived and printed, never the raw one: a push URL may carry `user:token@` and this line goes into the approval transcript>`. Show the destination, not just the remote name: `origin` can name a different URL for fetching than for pushing (an explicit `remote.origin.pushurl`, or a `url.<x>.pushInsteadOf` rewrite), and the name alone cannot tell the approver which repository is about to change. More than one URL means the push fans out to all of them — say so
-Commits: <N> ahead
-HEAD: `<the full object ID from Phase 0 step 6 — whatever width `git rev-parse HEAD` returned, not an abbreviation>`. Phase 2 re-derives it and refuses the push if it no longer matches, so this line is what that comparison is made against: shown short, it would either compare short (and pass on a prefix collision) or compare against a value the user never saw
-Overwrites: `<on a `--force-with-lease` push whose Phase 0 step 8 reading is `rewrite`: the full `REMOTE_TIP` object ID that step printed — the commit on the remote this push replaces. On every other reading: `nothing (<the ASK_REASON word>)`>`. **This line is why the plan can be reused as a comparison at all.** Phase 2 re-measures the remote and refuses when the answer differs from what is written here, exactly as it does for `HEAD:` above — and without the line there is nothing to compare against, so an approval given for destroying one commit would silently carry to a push destroying another. Full object ID, for the same reason `HEAD:` is: a prefix can collide, and a value shown short is not the value compared. `nothing` is a measurement too, not a blank — a reading of `rewrite` that appears only at Phase 2 is a topology change the approval never described, and it is refused there
-Push gate: state the **probe result and its limits**, never a credential verdict — `pre-push` hook found referencing the gate / **no direct reference found in the hook file (the probe does not follow indirection, so a gate reached through a shim would read this way too)**. Then, for a protected-branch push: if a `/dev/tty` prompt appears it is the terminal authorization and this approval was advisory; if none appears, **this approval is the only one there will be**
 
Command to execute: `<the exact command Phase 2 will run, flags included>`
 
When `--force-with-lease` was passed, the plan **must** show it, the `Overwrites:` line **must**
carry the measured tip, and the approval option **must** say so.
Two steps, and the second is the one this round added: approving `git push origin feat/x` is not approval of a history rewrite,
and approving a history rewrite in the abstract is not approval of destroying the particular commit
that is there.

# Bound HERE, not inherited. Phase 0 says every fence is a separate shell, and this one reached
# `"refs/heads/$BRANCH"` with nothing binding `BRANCH` in it. Unset, that refspec is
# `refs/heads/` — the exact-ref lookup returns no line, `REMOTE_TIP` is empty, and the classifier
# below reads `ASK_REASON=creation`: a push that rewrites `feat/x` skips the unshared question
# entirely. The failure is silent in the only direction that matters, because "creation" is also
# the honest answer for a genuinely new branch.
BRANCH=$(/usr/bin/env -u BASH_ENV -u ENV -u GIT_EXEC_PATH -u GIT_DIR -u GIT_WORK_TREE -u GIT_COMMON_DIR -u GIT_INDEX_FILE -u GIT_OBJECT_DIRECTORY -u GIT_ALTERNATE_OBJECT_DIRECTORIES -u GIT_NAMESPACE -u GIT_CEILING_DIRECTORIES -u GIT_GLOB_PATHSPECS -u GIT_ICASE_PATHSPECS -u GIT_NOGLOB_PATHSPECS -u GIT_LITERAL_PATHSPECS -u GIT_CONFIG -u GIT_CONFIG_PARAMETERS -u GIT_CONFIG_COUNT -u GIT_CONFIG_NOSYSTEM -u GIT_CONFIG_GLOBAL -u GIT_CONFIG_SYSTEM -u GIT_IMPLICIT_WORK_TREE -u GIT_GRAFT_FILE -u GIT_SHALLOW_FILE -u GIT_PREFIX -u GIT_REPLACE_REF_BASE -u GIT_EXTERNAL_DIFF -u GIT_SSH_COMMAND -u GIT_SSH -u GIT_PROXY_COMMAND -u GIT_SSH_VARIANT git rev-parse --abbrev-ref HEAD)
if [[ -z "$BRANCH" ]] || [[ "$BRANCH" == HEAD ]]; then
  echo "⛔ Phase 1: the branch name could not be derived here (detached HEAD, or rev-parse failed)." >&2
  echo "   Every classification below names refs/heads/\${BRANCH}; an empty one asks about" >&2
  echo "   refs/heads/ and answers 'creation'. Nothing is planned and nothing is pushed." >&2
  SD0X_PUSH_CI_REFUSED=
  : "${SD0X_PUSH_CI_REFUSED:?refusing — the branch name could not be derived in this fence}"
fi
# No pipe, and no `awk`. Both are deliberate, and each closes a defect this block shipped with for
# one round: a pipeline reports the status of its LAST command, so `git ls-remote … | awk …`
# exits 0 when `ls-remote` fails — measured `rc=0 tip=<>` against a nonexistent remote — which is
# byte-for-byte the "branch does not exist" reading below, and the fail-closed row underneath it
# became unreachable. A bare `awk` is a second hole in the same line: this classifier decides
# whether an attestation is collected, and an imported `BASH_FUNC_awk%%` answering it emits an
# empty tip from real output. `${x%%<tab>*}` is a parameter expansion — no command, nothing to
# shadow — and the exact `refs/heads/` refspec means at most one line comes back.
# And it probes the **push destination**, not `origin`. A remote can name two different URLs, and
# the push uses the one a probe of `origin` does not read. Measured, both mechanisms:
#
#   remote.origin.pushurl set          ls-remote --get-url origin -> FETCH url; push contacts pushurl
#   url.<x>.pushInsteadOf, no pushurl  ls-remote --get-url origin -> FETCH url; push contacts rewrite
#
# In both, `git remote get-url --push --all origin` returned exactly what the push contacted, so it
# is the oracle and `origin` is not. A probe reading the fetch URL classifies repository A as a
# creation or a fast-forward and the push then rewrites repository B — with no attestation ever
# collected for the repository that actually changed. L1 is opt-in, so that skipped question can
# be the only attestation layer there was.
#
# `--all`, never the singular form: `pushurl` is multi-valued and git pushes to every one of them,
# while `get-url --push` returns only the first — the reading that makes a fan-out look like a
# single destination. Anything other than exactly one URL is the fail-closed row, not a benign one.
# The count is a parameter expansion for the same reason the field split is: `$(...)` strips
# trailing newlines, so one URL leaves no newline and PUSH_URLS != PUSH_URL is exactly "more than
# one" — no `wc`, no `grep`, nothing an imported function can answer.
if PUSH_URLS=$(/usr/bin/env -u BASH_ENV -u ENV -u GIT_EXEC_PATH -u GIT_DIR -u GIT_WORK_TREE -u GIT_COMMON_DIR -u GIT_INDEX_FILE -u GIT_OBJECT_DIRECTORY -u GIT_ALTERNATE_OBJECT_DIRECTORIES -u GIT_NAMESPACE -u GIT_CEILING_DIRECTORIES -u GIT_GLOB_PATHSPECS -u GIT_ICASE_PATHSPECS -u GIT_NOGLOB_PATHSPECS -u GIT_LITERAL_PATHSPECS -u GIT_CONFIG -u GIT_CONFIG_PARAMETERS -u GIT_CONFIG_COUNT -u GIT_CONFIG_NOSYSTEM -u GIT_CONFIG_GLOBAL -u GIT_CONFIG_SYSTEM -u GIT_IMPLICIT_WORK_TREE -u GIT_GRAFT_FILE -u GIT_SHALLOW_FILE -u GIT_PREFIX -u GIT_REPLACE_REF_BASE -u GIT_EXTERNAL_DIFF -u GIT_SSH_COMMAND -u GIT_SSH -u GIT_PROXY_COMMAND -u GIT_SSH_VARIANT GIT_GRAFT_FILE=/dev/null GIT_NO_REPLACE_OBJECTS=1 git remote get-url --push --all origin); then
  PUSH_URL=${PUSH_URLS%%$'\n'*}
else
  PUSH_URLS=
  PUSH_URL=
fi
# A push URL can carry credentials — `https://user:token@host/repo.git`, returned verbatim by
# the command above (measured 2026-08-21). The raw value never leaves this shell: everything the
# operator sees, and everything compared against an approval, is the redacted form. Three
# credential-bearing components are masked whole: userinfo — split at the LAST `@` inside the
# authority, because git parses it that way and the first `@` leaves the tail of a password
# behind — plus query and fragment, since `?access_token=` is a credential no userinfo mask
# reaches. Comparing redacted forms costs this: two destinations differing inside a masked
# component read alike. For userinfo that merges two credentials for one repository, never two
# repositories. For query and fragment the loss is real where a host identifies the repository by
# parameter, and round 54 stopped accepting it — `https://gw.example/push?repo=A&token=one` and
# `…?repo=B&token=two` redact to one string (measured), so a guard on the redaction alone binds
# an approval to a host and a path rather than to a repository. Identity is therefore compared on
# a one-way digest of the RAW list and the redaction is only displayed; the alternative that was
# rejected — printing the token — is still rejected. Scheme, host and path are never
# masked, so a redirect to a different repository is still caught even before the digest. `scripts/pre-push-gate.sh`
# applies the same transformation to its prompts; keep them in step.
PUSH_URLS_SAFE=
while IFS= read -r U; do
  case "$U" in
    *://*)
      REST=${U#*://}; AUTH=${REST%%/*}; AUTH=${AUTH%%\?*}; AUTH=${AUTH%%\#*}
      case "$AUTH" in
        *@*) U="${U%%://*}://<redacted>@${AUTH##*@}${REST#"$AUTH"}" ;;
      esac
      case "$U" in
        *\?*) U="${U%%\?*}?<redacted>" ;;
        *\#*) U="${U%%\#*}#<redacted>" ;;
      esac
      ;;
    *:*)
      # scp-like `[user@]host:path`. No scheme, so the arm above cannot reach it — until
      # 2026-08-22 every scp-like user printed verbatim, on the reasoning that it is always `git`.
      # It is not: `<token>@host:path` is legal, and this value goes into an approval transcript.
      # The `*/*` guard is the two readings of `:` — git treats one as scp-like only when no `/`
      # precedes it, so a local path keeps its `@`. Same as `scripts/pre-push-gate.sh`; keep in step.
      _pre=${U%%:*}
      case "$_pre" in
        */*) ;;
        *@*) U="<redacted>@${_pre##*@}:${U#*:}" ;;
      esac
      ;;
  esac
  PUSH_URLS_SAFE=${PUSH_URLS_SAFE:+$PUSH_URLS_SAFE$'\n'}$U
done <<SAFE_EOF
$PUSH_URLS
SAFE_EOF
if [[ -z "$PUSH_URL" ]] || [[ "$PUSH_URLS" != "$PUSH_URL" ]]; then
  REMOTE_TIP=
  LOOKUP_FAILED=1
# Round 76, the same detector Phase 2 carries and for the same measurement: `$PUSH_URL` has already
# been through one `url.*.insteadOf` pass, and handing it to another git command applies a second.
# Where a chain exists the probe reads a repository the push never contacts, so the reading is not
# about the destination. `unknown-lookup` is the honest classification and it fails closed — the
# unshared question gets asked rather than skipped. Detector is local: `--get-url` expands and exits.
elif ! REMOTE_REPROBE=$(/usr/bin/env -u BASH_ENV -u ENV -u GIT_EXEC_PATH -u GIT_DIR -u GIT_WORK_TREE -u GIT_COMMON_DIR -u GIT_INDEX_FILE -u GIT_OBJECT_DIRECTORY -u GIT_ALTERNATE_OBJECT_DIRECTORIES -u GIT_NAMESPACE -u GIT_CEILING_DIRECTORIES -u GIT_GLOB_PATHSPECS -u GIT_ICASE_PATHSPECS -u GIT_NOGLOB_PATHSPECS -u GIT_LITERAL_PATHSPECS -u GIT_CONFIG -u GIT_CONFIG_PARAMETERS -u GIT_CONFIG_COUNT -u GIT_CONFIG_NOSYSTEM -u GIT_CONFIG_GLOBAL -u GIT_CONFIG_SYSTEM -u GIT_IMPLICIT_WORK_TREE -u GIT_GRAFT_FILE -u GIT_SHALLOW_FILE -u GIT_PREFIX -u GIT_REPLACE_REF_BASE -u GIT_EXTERNAL_DIFF -u GIT_SSH_COMMAND -u GIT_SSH -u GIT_PROXY_COMMAND -u GIT_SSH_VARIANT git ls-remote --get-url -- "$PUSH_URL") || [[ "$REMOTE_REPROBE" != "$PUSH_URL" ]]; then
  REMOTE_TIP=
  LOOKUP_FAILED=1
elif REMOTE_LS=$(/usr/bin/env -u BASH_ENV -u ENV -u GIT_EXEC_PATH -u GIT_DIR -u GIT_WORK_TREE -u GIT_COMMON_DIR -u GIT_INDEX_FILE -u GIT_OBJECT_DIRECTORY -u GIT_ALTERNATE_OBJECT_DIRECTORIES -u GIT_NAMESPACE -u GIT_CEILING_DIRECTORIES -u GIT_GLOB_PATHSPECS -u GIT_ICASE_PATHSPECS -u GIT_NOGLOB_PATHSPECS -u GIT_LITERAL_PATHSPECS -u GIT_CONFIG -u GIT_CONFIG_PARAMETERS -u GIT_CONFIG_COUNT -u GIT_CONFIG_NOSYSTEM -u GIT_CONFIG_GLOBAL -u GIT_CONFIG_SYSTEM -u GIT_IMPLICIT_WORK_TREE -u GIT_GRAFT_FILE -u GIT_SHALLOW_FILE -u GIT_PREFIX -u GIT_REPLACE_REF_BASE -u GIT_EXTERNAL_DIFF -u GIT_SSH_COMMAND -u GIT_SSH -u GIT_PROXY_COMMAND -u GIT_SSH_VARIANT GIT_GRAFT_FILE=/dev/null GIT_NO_REPLACE_OBJECTS=1 git ls-remote --upload-pack=git-upload-pack -- "$PUSH_URL" "refs/heads/$BRANCH"); then
  REMOTE_TIP=${REMOTE_LS%%$'\t'*}
  LOOKUP_FAILED=
else
  REMOTE_TIP=
  LOOKUP_FAILED=1
fi
# The classifier the table below documents — executable, because a table is a reading and a
# reading cannot lose an exit status. Each arm is one expression, and `merge-base`'s status is
# captured IMMEDIATELY into its own variable: exit 1 is its answer "not contained", anything
# above it is the ABSENCE of an answer, and `if ! git merge-base …` collapses the two into
# the SAME asking branch — so an errored ancestry is reported as a *measured* rewrite. The bit
# survives; the reason does not, and the reason is what the question states.
# ASK_REASON is carried because "unknown" and "measured rewrite" are different claims and the
# question below states which one the operator is answering.
if [[ -n "$LOOKUP_FAILED" ]]; then
  ASK=1; ASK_REASON=unknown-lookup
elif [[ -z "$REMOTE_TIP" ]]; then
  ASK=; ASK_REASON=creation
elif ! /usr/bin/env -u BASH_ENV -u ENV -u GIT_EXEC_PATH -u GIT_DIR -u GIT_WORK_TREE -u GIT_COMMON_DIR -u GIT_INDEX_FILE -u GIT_OBJECT_DIRECTORY -u GIT_ALTERNATE_OBJECT_DIRECTORIES -u GIT_NAMESPACE -u GIT_CEILING_DIRECTORIES -u GIT_GLOB_PATHSPECS -u GIT_ICASE_PATHSPECS -u GIT_NOGLOB_PATHSPECS -u GIT_LITERAL_PATHSPECS -u GIT_CONFIG -u GIT_CONFIG_PARAMETERS -u GIT_CONFIG_COUNT -u GIT_CONFIG_NOSYSTEM -u GIT_CONFIG_GLOBAL -u GIT_CONFIG_SYSTEM -u GIT_IMPLICIT_WORK_TREE -u GIT_GRAFT_FILE -u GIT_SHALLOW_FILE -u GIT_PREFIX -u GIT_REPLACE_REF_BASE -u GIT_EXTERNAL_DIFF -u GIT_SSH_COMMAND -u GIT_SSH -u GIT_PROXY_COMMAND -u GIT_SSH_VARIANT GIT_GRAFT_FILE=/dev/null GIT_NO_REPLACE_OBJECTS=1 git cat-file -e "${REMOTE_TIP}^{commit}" 2>/dev/null; then
  ASK=1; ASK_REASON=unknown-tip
else
  if /usr/bin/env -u BASH_ENV -u ENV -u GIT_EXEC_PATH -u GIT_DIR -u GIT_WORK_TREE -u GIT_COMMON_DIR -u GIT_INDEX_FILE -u GIT_OBJECT_DIRECTORY -u GIT_ALTERNATE_OBJECT_DIRECTORIES -u GIT_NAMESPACE -u GIT_CEILING_DIRECTORIES -u GIT_GLOB_PATHSPECS -u GIT_ICASE_PATHSPECS -u GIT_NOGLOB_PATHSPECS -u GIT_LITERAL_PATHSPECS -u GIT_CONFIG -u GIT_CONFIG_PARAMETERS -u GIT_CONFIG_COUNT -u GIT_CONFIG_NOSYSTEM -u GIT_CONFIG_GLOBAL -u GIT_CONFIG_SYSTEM -u GIT_IMPLICIT_WORK_TREE -u GIT_GRAFT_FILE -u GIT_SHALLOW_FILE -u GIT_PREFIX -u GIT_REPLACE_REF_BASE -u GIT_EXTERNAL_DIFF -u GIT_SSH_COMMAND -u GIT_SSH -u GIT_PROXY_COMMAND -u GIT_SSH_VARIANT GIT_GRAFT_FILE=/dev/null GIT_NO_REPLACE_OBJECTS=1 git merge-base --is-ancestor "$REMOTE_TIP" HEAD; then ANCESTRY=0; else ANCESTRY=$?; fi
  # 0 contained · 1 not contained · >1 merge-base ERRORED — three readings, never two
  # `case`, not `[ … -eq … ]` and not `[[ … -eq … ]]`. `[` is a builtin, so an imported
  # `BASH_FUNC_[%%` function outranks it and answers every one of these tests for the caller
  # (measured 2026-08-22: `[ a = a ]` returns the forged status). `[[` is a keyword and immune to
  # that, but its `-eq` is arithmetic, and arithmetic is the wrong tool twice over: an empty
  # operand reads as 0, so `[[ "" -eq 0 ]]` is TRUE where `[ ]` errors to false — fail-closed
  # inverted — and bash evaluates arithmetic operands recursively, so a non-numeric one is
  # dereferenced as a variable name. `case` is a keyword that does neither.
  case "$ANCESTRY" in
    0) ASK=; ASK_REASON=fast-forward ;;
    1) ASK=1; ASK_REASON=rewrite ;;
    *) ASK=1; ASK_REASON=unknown-ancestry ;;
  esac
fi
# Report what was measured, for the reason Phase 0 step 9 gives: this fence is a shell of its
# own, and the next thing to run is a question whose wording depends on every field below.
# `ASK` alone would not be enough even if it were printed — the table's seven rows collapse to
# two values of it, and "unknown-lookup" and "rewrite" ask the operator different questions
# while agreeing that one must be asked.
# **The report is as security-sensitive as the readings above, and until round 59 it was the one
# construct here that a caller could answer.** `printf` is a regular builtin, and in bash a
# function outranks a builtin, so an exported `BASH_FUNC_printf%%` replaces this line wholesale:
# measured 2026-08-22, a fence whose real variables were `ASK=1 ASK_REASON=rewrite` printed
# `ASK=[] ASK_REASON=[fast-forward]` to the agent. Every `case` and `[[` above is immune and it
# bought nothing, because the verdict left through a channel the caller owned. An ABSOLUTE path is
# immune for the reason the Husky stanza already relies on — bash refuses to import a function
# whose name contains a slash (`error importing function definition for '/usr/bin/printf'`,
# measured). If `/usr/bin/printf` is missing the fence prints no report at all, and that is the
# correct failure: **a run with no report line is `unknown`, and unknown asks.**
/usr/bin/printf 'ASK=[%s]\nASK_REASON=[%s]\nREMOTE_TIP=[%s]\nLOOKUP_FAILED=[%s]\n' \
  "$ASK" "$ASK_REASON" "$REMOTE_TIP" "$LOOKUP_FAILED"

# Build and execute push command (ONLY after explicit approval)
# PUSH_BLOCKED is this fence's own refusal record, and it exists because `exit` cannot be trusted to
# end the fence. `exit` is a builtin, so an imported `BASH_FUNC_exit%%` function outranks it —
# measured on bash 3.2.57: the refusal printed in full and the push then ran, exit status 0. No
# keyword terminates a shell (`return` is a builtin too), so the fix is not a better terminator:
# a refusal RECORDS itself in an assignment, and the push sits inside a branch `[[ ]]` selects.
# The record is FROZEN, not merely written — this paragraph used to say an assignment is something
# "nothing outranks", which confuses the command with the value. The command cannot be outranked;
# the value it wrote can be erased by whatever runs next, and under this vector that is the hostile
# function itself: `BASH_FUNC_exit%%='() { PUSH_BLOCKED=; return 0; }'` cleared the flag and the
# push ran at status 0 (measured 2026-08-22, bash 3.2.57 and 5.3.15). `readonly` at every refusal
# site below closes it — the erasing assignment, `unset` and `declare -g` each fail against a
# readonly name and the refusal held on both shells. What it does NOT close is injection: an
# environment that can define `exit` can define `git`, measured the same day intercepting a whole
# push. The record defends the case where the terminator alone was trusted — a stubbed, swallowed
# or subshell-confined `exit`; it was never a fence against arbitrary imported functions.
# `exit 1` stays — in an ordinary shell it is still right, and it is no
# longer the only thing standing between a refusal and a force-push. Cleared here rather than
# defaulted, so an exported value of the same name cannot pre-approve anything either.
PUSH_BLOCKED=
# Re-bind both flag variables here, with the same literal values Phase 0 step 0 was
# written with. This is not redundancy: every fenced block in this skill is a separate
# shell, so nothing Phase 0 assigned survives into this one — what survives is the
# EXPORTED environment, and reading it is precisely how a plain push becomes a
# lease-force. Re-binding at the top of the fence that consumes them means the branch
# taken below is a function of the invocation alone, whatever the environment holds.
# The two lines must state the same values as Phase 0; if they cannot, the push plan
# and the push have diverged and the run stops instead of choosing between them.
FORCE_WITH_LEASE=false   # `true` only if the invocation contained --force-with-lease
SET_UPSTREAM=false       # `true` if --set-upstream was passed, or Phase 0 step 5b set it
# $BRANCH gets both treatments, because it is the one value git can still answer for
# itself: the approved name is written literally, the live name is re-derived, and the
# push proceeds only if they agree. An inherited `BRANCH` would aim the push at a name
# the plan never showed and leave the protected-branch re-assertion below judging the
# wrong one; a bare re-derivation would silently follow a checkout made after the
# approval. Disagreement is not repaired here — the approval covered one branch, so
# the run stops and asks again. Detached HEAD lands here too: `HEAD` matches no
# approved branch name, so the same comparison catches it.
# The prefix is on THIS command too, and that is the whole point of the round-39 fix. Normalizing
# only the push made the approval and the push describe different repositories: with an ambient
# GIT_DIR, a bare re-derivation returned branch `main` at 4d01381e while the normalized push
# resolved `main` to 2692ede5 — same name, different commit, comparison green. A branch-name guard
# is only a guard if both names come from the same repository.
PLAN_BRANCH=<the branch name the Phase 1 plan showed, written literally and quoted>
BRANCH=$(/usr/bin/env -u BASH_ENV -u ENV -u GIT_EXEC_PATH -u GIT_DIR -u GIT_WORK_TREE -u GIT_COMMON_DIR -u GIT_INDEX_FILE -u GIT_OBJECT_DIRECTORY -u GIT_ALTERNATE_OBJECT_DIRECTORIES -u GIT_NAMESPACE -u GIT_CEILING_DIRECTORIES -u GIT_GLOB_PATHSPECS -u GIT_ICASE_PATHSPECS -u GIT_NOGLOB_PATHSPECS -u GIT_LITERAL_PATHSPECS -u GIT_CONFIG -u GIT_CONFIG_PARAMETERS -u GIT_CONFIG_COUNT -u GIT_CONFIG_NOSYSTEM -u GIT_CONFIG_GLOBAL -u GIT_CONFIG_SYSTEM -u GIT_IMPLICIT_WORK_TREE -u GIT_GRAFT_FILE -u GIT_SHALLOW_FILE -u GIT_PREFIX -u GIT_REPLACE_REF_BASE -u GIT_EXTERNAL_DIFF -u GIT_SSH_COMMAND -u GIT_SSH -u GIT_PROXY_COMMAND -u GIT_SSH_VARIANT git rev-parse --abbrev-ref HEAD)
if [[ "$BRANCH" != "$PLAN_BRANCH" ]]; then
  echo "⛔ HEAD is on '${BRANCH:-nothing}' but the approval covered '$PLAN_BRANCH' — aborting" >&2
  readonly PUSH_BLOCKED=1; exit 1
fi
# ⛔ Protected × force-with-lease is prohibited (rules/git-workflow.md: force push to
# shared branches). Phase 0 already hard-aborted this combination; re-assert it here
# so no approval path — cached, mis-run, or otherwise — can reach a prohibited push.
case "$BRANCH" in
  main|master|develop|release/*)
    if [[ "$FORCE_WITH_LEASE" == "true" ]]; then
      echo "⛔ --force-with-lease targets protected branch '$BRANCH' — force push to shared branches is prohibited" >&2
      readonly PUSH_BLOCKED=1; exit 1
    fi
    ;;
esac
# The PLAN_BRANCH comparison answers "which branch", not "which commit" — and once the approval
# and the push are separated in time those are different questions. A commit made on the same branch
# between Phase 1 and here passes the name comparison unchanged, and the push then publishes work
# the plan never showed. Same treatment for the same reason: the approved SHA is written
# literally, the live one is re-derived through the same normalized prefix, and disagreement stops
# the run instead of choosing a side. It is the full object ID, not an abbreviation — an
# abbreviated pair can agree on a prefix and name different commits. Full means whatever width
# `git rev-parse HEAD` printed: 40 hex under SHA-1, 64 under SHA-256. Naming one width here would
# make every push in a SHA-256 repository abort as though HEAD had moved — `pre-push-gate.sh`
# already accepts both, and a skill that does not disagrees with the gate it defers to.
# Declined, recorded so it is not re-proposed: pushing `refs/heads/${BRANCH}` could be replaced by
# a SHA source (`${PLAN_HEAD_SHA}:refs/heads/${BRANCH}`), pinning the commit in the refspec itself.
# The push below now uses BOTH, and the comparison is no longer the whole binding: it is what makes
# the literal in the refspec provably the current HEAD, while the refspec is what makes the pushed
# object provably the compared one. Either alone leaves a gap — a comparison whose result the push
# then re-resolves by name, or a literal nothing checked against the tree.
# Round 63 kept only the comparison because a SHA source silently defeats `--set-upstream`
# (measured 2026-08-21, re-measured 2026-08-22 on git 2.55.0). That measurement stands; what was
# wrong was the conclusion drawn from it, since `-u` is recoverable and the binding is not. The
# recovery, and the second measurement it rests on, are written out at the write itself below.
# It sits AFTER the protected × force-with-lease refusal, not before: that refusal is a
# prohibition and decides on the branch name alone, so making it wait on a second read would
# widen what a prohibited push depends on for no gain.
PLAN_HEAD_SHA=<the full HEAD object ID the Phase 1 plan showed, at its printed width, written literally and quoted>
HEAD_SHA=$(/usr/bin/env -u BASH_ENV -u ENV -u GIT_EXEC_PATH -u GIT_DIR -u GIT_WORK_TREE -u GIT_COMMON_DIR -u GIT_INDEX_FILE -u GIT_OBJECT_DIRECTORY -u GIT_ALTERNATE_OBJECT_DIRECTORIES -u GIT_NAMESPACE -u GIT_CEILING_DIRECTORIES -u GIT_GLOB_PATHSPECS -u GIT_ICASE_PATHSPECS -u GIT_NOGLOB_PATHSPECS -u GIT_LITERAL_PATHSPECS -u GIT_CONFIG -u GIT_CONFIG_PARAMETERS -u GIT_CONFIG_COUNT -u GIT_CONFIG_NOSYSTEM -u GIT_CONFIG_GLOBAL -u GIT_CONFIG_SYSTEM -u GIT_IMPLICIT_WORK_TREE -u GIT_GRAFT_FILE -u GIT_SHALLOW_FILE -u GIT_PREFIX -u GIT_REPLACE_REF_BASE -u GIT_EXTERNAL_DIFF -u GIT_SSH_COMMAND -u GIT_SSH -u GIT_PROXY_COMMAND -u GIT_SSH_VARIANT git rev-parse HEAD)
# Emptiness first, because the comparison cannot see it: `"" != ""` is FALSE, so two empty values
# pass this gate as though HEAD were exactly where the approval left it. Both sides can be empty
# for ordinary reasons — `git rev-parse HEAD` on an unborn branch prints nothing and exits 128,
# and with `errexit` not inherited the assignment simply succeeds; `PLAN_HEAD_SHA` is a literal
# the model writes, so a rendering that dropped it is empty too. What makes this a refusal rather
# than a warning is what the push below does with it: since round 72 the refspec source is that
# literal, and an empty left side makes it `":refs/heads/${BRANCH}"` — git's spelling for DELETE
# that branch. `pre-push-gate.sh` is no backstop here: its rewrite test requires a non-null OID on
# BOTH sides, so a deletion reaches neither of its prompts by design. Same guard, same reason, as
# the `[[ -n "$PUSHED" ]]` on the `epic-merge` pushes — that one was added and this one was not.
if [[ -z "$PLAN_HEAD_SHA" ]] || [[ -z "$HEAD_SHA" ]]; then
  echo "⛔ the approved commit is '${PLAN_HEAD_SHA:-empty}' and HEAD reads '${HEAD_SHA:-empty}' —" >&2
  echo "   one of them is empty, so nothing was compared. Re-run Phase 1 and push nothing." >&2
  readonly PUSH_BLOCKED=1; exit 1
fi
if [[ "$HEAD_SHA" != "$PLAN_HEAD_SHA" ]]; then
  echo "⛔ HEAD is at '${HEAD_SHA:-nothing}' but the approval covered '$PLAN_HEAD_SHA' — aborting" >&2
  readonly PUSH_BLOCKED=1; exit 1
fi
# Branch and commit are two of the three things the approval fixed; the third is **where**. The
# push below goes to the name `origin`, and that name resolves at push time — `remote.origin.pushurl`
# or `url.<x>.pushInsteadOf` changing between the approval and here would redirect the approved
# commits to a different repository with every assertion above still true. The Phase 0 topology
# probe already resolved the destination and the plan printed it; this re-resolves it with the
# same oracle, in THIS fence, with no question asked in between — so what the comparison closes is
# the window that actually existed: Phase 0 and the approval are minutes and several tool calls
# away, this read is microseconds away.
# Declined, with the measurement, so it is not re-proposed a third time: "push to the validated URL
# instead of the mutable name `origin`" does **not** close this. Measured 2026-08-22 — with
# `url.<B>.insteadOf=<A>` configured, `git push <A> HEAD:refs/heads/x` landed the ref in **B**, not
# A. git applies the rewrite layer to a command-line URL exactly as it applies it to a remote name,
# so addressing the URL moves the re-resolution from one config key to another and pins nothing.
# (The same measurement also shows the check is honest: `git remote get-url --push --all origin`
# reports the POST-rewrite URL, so what Phase 0 hashed is the destination git would really use.)
# # What remains after the comparison is not closable **by naming a destination**: git resolves it
# inside its own process, from configuration this shell cannot freeze, and every construct that
# names one — a remote, a URL, a SHA refspec — goes through the same rewrite layer. This block
# therefore narrows the window; it does not pin the destination.
#
# It was written here as "irreducible client-side", and that was wrong — corrected 2026-08-22.
# The resolution happens client-side, but it does not happen *unobservably*: git computes the
# real destination and then hands it to the pre-push hook as `$2`, inside the pushing process,
# after every rewrite. `SD0X_PUSH_DEST_DIGEST` on the push line below is what turns that into a
# binding — see the block above it. The claim mattered because it told a reader to stop looking
# for a layer that was already there and simply unread: `scripts/pre-push-gate.sh` had `$2`
# commented `unused`.
#
# Two values are carried across, and the second is the one that binds. `PLAN_PUSH_URLS` is the
# redacted string the human approved and is compared so the refusal can NAME what changed;
# `PLAN_PUSH_DIGEST` is the Phase 0 digest of the raw list and is what makes the comparison an
# identity check at all. Redaction deletes the whole query, so two destinations differing only
# there compare equal (measured, round 54) — a guard on the redaction alone binds the approval to
# a host and a path, and a `.git/config` edit in between redirects the push while it passes.
PLAN_PUSH_URLS=<the redacted destination the Phase 1 plan showed, written literally and quoted>
PLAN_PUSH_DIGEST=<the PUSH_URLS_DIGEST value Phase 0 step 8b printed, written literally and quoted>
PUSH_URLS=$(/usr/bin/env -u BASH_ENV -u ENV -u GIT_EXEC_PATH -u GIT_DIR -u GIT_WORK_TREE -u GIT_COMMON_DIR -u GIT_INDEX_FILE -u GIT_OBJECT_DIRECTORY -u GIT_ALTERNATE_OBJECT_DIRECTORIES -u GIT_NAMESPACE -u GIT_CEILING_DIRECTORIES -u GIT_GLOB_PATHSPECS -u GIT_ICASE_PATHSPECS -u GIT_NOGLOB_PATHSPECS -u GIT_LITERAL_PATHSPECS -u GIT_CONFIG -u GIT_CONFIG_PARAMETERS -u GIT_CONFIG_COUNT -u GIT_CONFIG_NOSYSTEM -u GIT_CONFIG_GLOBAL -u GIT_CONFIG_SYSTEM -u GIT_IMPLICIT_WORK_TREE -u GIT_GRAFT_FILE -u GIT_SHALLOW_FILE -u GIT_PREFIX -u GIT_REPLACE_REF_BASE -u GIT_EXTERNAL_DIFF -u GIT_SSH_COMMAND -u GIT_SSH -u GIT_PROXY_COMMAND -u GIT_SSH_VARIANT git remote get-url --push --all origin) || PUSH_URLS=
# Redacted destination — the same derivation, and the same reason, as its first use above.
PUSH_URLS_SAFE=
while IFS= read -r U; do
  case "$U" in
    *://*)
      REST=${U#*://}; AUTH=${REST%%/*}; AUTH=${AUTH%%\?*}; AUTH=${AUTH%%\#*}
      case "$AUTH" in
        *@*) U="${U%%://*}://<redacted>@${AUTH##*@}${REST#"$AUTH"}" ;;
      esac
      case "$U" in
        *\?*) U="${U%%\?*}?<redacted>" ;;
        *\#*) U="${U%%\#*}#<redacted>" ;;
      esac
      ;;
    *:*)
      # scp-like `[user@]host:path`. No scheme, so the arm above cannot reach it — until
      # 2026-08-22 every scp-like user printed verbatim, on the reasoning that it is always `git`.
      # It is not: `<token>@host:path` is legal, and this value goes into an approval transcript.
      # The `*/*` guard is the two readings of `:` — git treats one as scp-like only when no `/`
      # precedes it, so a local path keeps its `@`. Same as `scripts/pre-push-gate.sh`; keep in step.
      _pre=${U%%:*}
      case "$_pre" in
        */*) ;;
        *@*) U="<redacted>@${_pre##*@}:${U#*:}" ;;
      esac
      ;;
  esac
  PUSH_URLS_SAFE=${PUSH_URLS_SAFE:+$PUSH_URLS_SAFE$'\n'}$U
done <<SAFE_EOF
$PUSH_URLS
SAFE_EOF
# One digest per push URL, SHA-256, space separated — a SET, because git invokes the pre-push hook
# ONCE PER PUSH URL with that single URL in `$2` (measured 2026-08-22). A digest of the whole list
# matches no single call, so it refused every fan-out the operator had configured and approved.
# SHA-256 rather than `git hash-object`: `rules/security.md` prohibits SHA-1 where a digest carries
# a security decision, and that prohibition is what makes the change mandatory. `hash-object` also
# follows the *repository's* object format — measured 2026-08-22, the same URL digests to
# `b354136a…` by default and `7524f1f0…` under `--object-format=sha256`, and back to the SHA-1
# value outside a repository. Round 59 corrects how much that carries: it does NOT by itself make
# the two sides disagree, since the plan side and the hook run for the same repository and read
# the same format. It is a reason not to build a cross-process binding on a tool whose algorithm
# is chosen by ambient state, and it bites where one side runs outside the repository at all.
# A URL that will not hash empties the WHOLE value rather than shortening the set: a partial set
# approves fewer destinations than the plan showed, and looks like a successful derivation.
# Round 60: SELECT the digest tool, THEN feed it. A `||` chain over a pipeline let the FIRST
# command consume stdin and then fail, after which the fallback hashed EOF. Measured 2026-08-22:
# `https://gw.example/push?repo=A&token=one` and `…?repo=B&token=two` BOTH digested to
# e3b0c442…b855 — the SHA-256 of the empty string — so two different destinations compared EQUAL
# and the destination guard passed on a destination that had changed. `command -v` does not read
# stdin, so doing the selection with it feeds the input exactly once, to exactly one tool. Same
# shape as `scripts/pre-push-gate.sh` § sha256_raw, deliberately: one algorithm, stated once.
sha256_raw() {   # reads stdin, writes the selected tool's own output line; nonzero only if none exists
  # Invoked through `/usr/bin/env`, never as a bare word. `command -v` reports an imported shell
  # function as a perfectly good command, and the known-answer test below only rejects a tool that
  # answers one CONSTANT. An ADAPTIVE function passes both vectors and then returns one fixed
  # digest for every real URL, so two different destinations compare EQUAL and the approval is
  # bound to nothing. `env` resolves PATH only, and bash refuses to import a function whose name
  # contains a slash, so a function-only match makes `env` fail and the test below correctly
  # empties the digest. `scripts/pre-push-gate.sh` needs no such spelling and is not inconsistent
  # with this: its `#!/usr/bin/env -S bash -p` shebang refuses to import functions at all, while
  # these fences have no shebang of their own. The defence differs because the channel does.
  if command -v sha256sum >/dev/null 2>&1; then /usr/bin/env sha256sum
  elif command -v shasum >/dev/null 2>&1; then /usr/bin/env shasum -a 256
  elif command -v openssl >/dev/null 2>&1; then /usr/bin/env openssl dgst -sha256
  else return 1
  fi
}
sha256_hex() {   # the bare hex the tool produced — NO shape check, the KAT below needs the raw answer
  _H=$(/usr/bin/printf '%s' "$1" | sha256_raw 2>/dev/null) || _H=
  _H=${_H##*= }     # openssl: `SHA2-256(stdin)= <hex>`
  _H=${_H%% *}      # sha256sum / shasum: `<hex>  -`
  /usr/bin/printf '%s' "$_H"
}
# Known-answer test, two vectors. A tool that answers one constant whatever it is fed makes every
# destination compare equal to every approval — and a constant is well-shaped, so the shape check
# in the loop cannot see it. The empty vector is precisely the answer the defect above produced.
DIGEST_TOOL_OK=
if [[ "$(sha256_hex '')" = e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 ]] \
&& [[ "$(sha256_hex abc)" = ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad ]]; then
  DIGEST_TOOL_OK=yes
fi
PUSH_URLS_DIGEST=
while IFS= read -r U; do
  [[ -n "$U" ]] || continue
  D=
  if [[ -n "$DIGEST_TOOL_OK" ]]; then D=$(sha256_hex "$U"); fi
  case "$D" in *[!0-9a-f]*|'') D= ;; *) [[ ${#D} -eq 64 ]] || D= ;; esac
  if [[ -z "$D" ]]; then PUSH_URLS_DIGEST=; break; fi
  PUSH_URLS_DIGEST=${PUSH_URLS_DIGEST:+$PUSH_URLS_DIGEST }$D
done <<< "$PUSH_URLS"
# `remote.<name>.receivepack` names the program that receives the objects on the far side, and a
# program is free to ignore the repository the URL named. Measured 2026-08-22: with one configured,
# an ordinary branch push printed `To <the approved URL>  * [new branch] main -> main` while every
# object landed in a DIFFERENT repository and the named one stayed empty. No digest of the URL can
# see that, so with one configured the destination is not established and this skill does not push.
# The gate refuses it too where the binding reaches it; this line is what covers the projects that
# never installed the gate, and `git-workflow.md` § Push safety is why the absent gate moves the
# question here rather than deleting it. This read is best-effort and its boundary is measured:
# git runs the pre-push hook only after the ref advertisement, so a wrapper that clears its own
# config key before serving redirects the objects while every reader here sees nothing (measured
# 2026-08-22 — the hook saw `<unset>`, git reported success against the named URL, and the objects
# landed elsewhere). What closes that is the push line itself, which spells
# `--receive-pack=git-receive-pack`: a command-line value overrides the configured one, while
# `-c remote.<name>.receivepack=` does not (git keeps the config value and says "more than one
# receivepack given, using the first"). This read still earns its place — it refuses BEFORE the
# operator is asked to approve a destination that was never going to receive the objects.
PUSH_RECEIVEPACK=$(/usr/bin/env -u BASH_ENV -u ENV -u GIT_EXEC_PATH -u GIT_DIR -u GIT_WORK_TREE -u GIT_COMMON_DIR -u GIT_INDEX_FILE -u GIT_OBJECT_DIRECTORY -u GIT_ALTERNATE_OBJECT_DIRECTORIES -u GIT_NAMESPACE -u GIT_CEILING_DIRECTORIES -u GIT_GLOB_PATHSPECS -u GIT_ICASE_PATHSPECS -u GIT_NOGLOB_PATHSPECS -u GIT_LITERAL_PATHSPECS -u GIT_CONFIG -u GIT_CONFIG_PARAMETERS -u GIT_CONFIG_COUNT -u GIT_CONFIG_NOSYSTEM -u GIT_CONFIG_GLOBAL -u GIT_CONFIG_SYSTEM -u GIT_IMPLICIT_WORK_TREE -u GIT_GRAFT_FILE -u GIT_SHALLOW_FILE -u GIT_PREFIX -u GIT_REPLACE_REF_BASE -u GIT_EXTERNAL_DIFF -u GIT_SSH_COMMAND -u GIT_SSH -u GIT_PROXY_COMMAND -u GIT_SSH_VARIANT git config --get remote.origin.receivepack 2>/dev/null) || PUSH_RECEIVEPACK=
# An empty digest is a refusal, not a match: `[ "" = "" ]` would pass for a destination that did
# not resolve on either side, which is the shape every fail-closed row in this skill exists to
# refuse. The digest is compared FIRST because it is the identity; the redaction is compared after
# so the message can say what the operator saw.
if [[ -n "$PUSH_RECEIVEPACK" ]] || [[ -z "$PUSH_URLS" ]] || [[ -z "$PUSH_URLS_DIGEST" ]] || [[ "$PUSH_URLS_DIGEST" != "$PLAN_PUSH_DIGEST" ]] \
   || [[ "$PUSH_URLS_SAFE" != "$PLAN_PUSH_URLS" ]]; then
  echo "⛔ push destination is '${PUSH_URLS_SAFE:-unresolvable}' but the approval covered '$PLAN_PUSH_URLS' — aborting" >&2
  echo "   (identity is compared on a digest of the raw destination, so a change the redaction hides still refuses here)" >&2
  if [[ -n "$PUSH_RECEIVEPACK" ]]; then
    echo "   (remote.origin.receivepack is configured, so the URL does not decide where the objects land; read it with: git config --get remote.origin.receivepack)" >&2
  fi
  readonly PUSH_BLOCKED=1; exit 1
fi
# ── Final topology re-check, in the fence that pushes (round 60) ──────────────────────────────
# Phase 1 classified the topology and decided from it whether the unshared question was owed. By
# the time this fence runs that classification is a **prediction**: a different shell, after an
# approval, with everything a remote can do in between. `/epic-merge` § Safety records what a stale
# one costs. So re-measure here and refuse when the reading and the attestation disagree — the
# reviewer's phrase for the class is the right one: a prediction is not a measurement.
#
# Only the lease path can rewrite anything. Without `--force-with-lease` git refuses a
# non-fast-forward client-side, before the hook is ever invoked (§ Defense in Depth, row 1), so a
# plain push has no topology to re-check and this whole block is skipped for it.
if [[ "$FORCE_WITH_LEASE" == "true" ]]; then
  # The attestation Phase 1 collected, written **literally into this fence** by the model. Fill it
  # in ONLY when the unshared question was put to the operator by name and answered "nobody else":
  # replace the empty value with the literal, quoted string "refs/heads/<BRANCH>". It is never read
  # from the environment and it is assigned unconditionally right here — an exported value would
  # answer a question nobody was asked, which is exactly the hazard `ALLOW_FORCE_UNSHARED` carries
  # and why this skill clears that one instead of imitating it. Empty refuses.
  UNSHARED_ATTESTED=
  # The remote tip Phase 0 step 8 PRINTED as `REMOTE_TIP=[...]` — the commit the plan named as the
  # thing this push would overwrite — written literally and quoted by the model, exactly like the
  # two `PLAN_PUSH_*` fields above and for the same reason. Not re-derived: re-reading it here
  # would ask the question again instead of remembering the answer, which is the whole failure
  # this field exists to close. Empty is not a free pass — the `rewrite` arm below compares it
  # against a non-empty `$FINAL_TIP`, so a field left unfilled refuses.
  PLAN_REMOTE_TIP=
  # One destination or none: the digest guard above already refused a fan-out that no longer
  # matches the plan, and a multi-URL push has no single tip to classify.
  if [[ -z "$PUSH_URLS" ]] || [[ "$PUSH_URLS" == *$'\n'* ]]; then
    FINAL_TIP=; FINAL_LOOKUP_FAILED=1
  # Round 76: a rewrite CHAIN resolves twice across two commands, and this fence spans two.
  # `git remote get-url --push --all origin` already applied one pass; handing that string to
  # `git ls-remote` applies another. Measured 2026-08-22 (git 2.55.0) with
  # `url.<B>.insteadOf=<A>` and `url.<C>.insteadOf=<B>`: the resolved push URL is B, `git push`
  # lands in B, and `git ls-remote -- <B>` answers **C's** tip. The lease would then be bound to a
  # tip measured from a repository the push never contacts — the classification and the credential
  # would both be about the wrong remote. There is no repair available from a URL string, because
  # any string handed back to git gets rewritten again; so this is a REFUSAL. `--get-url` is the
  # detector and it is purely local — it expands and exits, contacting nothing.
  elif ! FINAL_REPROBE=$(/usr/bin/env -u BASH_ENV -u ENV -u GIT_EXEC_PATH -u GIT_DIR -u GIT_WORK_TREE -u GIT_COMMON_DIR -u GIT_INDEX_FILE -u GIT_OBJECT_DIRECTORY -u GIT_ALTERNATE_OBJECT_DIRECTORIES -u GIT_NAMESPACE -u GIT_CEILING_DIRECTORIES -u GIT_GLOB_PATHSPECS -u GIT_ICASE_PATHSPECS -u GIT_NOGLOB_PATHSPECS -u GIT_LITERAL_PATHSPECS -u GIT_CONFIG -u GIT_CONFIG_PARAMETERS -u GIT_CONFIG_COUNT -u GIT_CONFIG_NOSYSTEM -u GIT_CONFIG_GLOBAL -u GIT_CONFIG_SYSTEM -u GIT_IMPLICIT_WORK_TREE -u GIT_GRAFT_FILE -u GIT_SHALLOW_FILE -u GIT_PREFIX -u GIT_REPLACE_REF_BASE -u GIT_EXTERNAL_DIFF -u GIT_SSH_COMMAND -u GIT_SSH -u GIT_PROXY_COMMAND -u GIT_SSH_VARIANT git ls-remote --get-url -- "$PUSH_URLS") || [[ "$FINAL_REPROBE" != "$PUSH_URLS" ]]; then
    echo "⛔ url.*.insteadOf rewrites the resolved push destination a SECOND time, so this fence" >&2
    echo "   cannot measure the repository the push will contact: the push goes to the once-" >&2
    echo "   rewritten URL, a probe of that URL reads the twice-rewritten one. Remove the chained" >&2
    echo "   rewrite rule, or push without --force-with-lease." >&2
    FINAL_TIP=; FINAL_LOOKUP_FAILED=1
  elif FINAL_LS=$(/usr/bin/env -u BASH_ENV -u ENV -u GIT_EXEC_PATH -u GIT_DIR -u GIT_WORK_TREE -u GIT_COMMON_DIR -u GIT_INDEX_FILE -u GIT_OBJECT_DIRECTORY -u GIT_ALTERNATE_OBJECT_DIRECTORIES -u GIT_NAMESPACE -u GIT_CEILING_DIRECTORIES -u GIT_GLOB_PATHSPECS -u GIT_ICASE_PATHSPECS -u GIT_NOGLOB_PATHSPECS -u GIT_LITERAL_PATHSPECS -u GIT_CONFIG -u GIT_CONFIG_PARAMETERS -u GIT_CONFIG_COUNT -u GIT_CONFIG_NOSYSTEM -u GIT_CONFIG_GLOBAL -u GIT_CONFIG_SYSTEM -u GIT_IMPLICIT_WORK_TREE -u GIT_GRAFT_FILE -u GIT_SHALLOW_FILE -u GIT_PREFIX -u GIT_REPLACE_REF_BASE -u GIT_EXTERNAL_DIFF -u GIT_SSH_COMMAND -u GIT_SSH -u GIT_PROXY_COMMAND -u GIT_SSH_VARIANT git ls-remote --upload-pack=git-upload-pack -- "$PUSH_URLS" "refs/heads/${BRANCH}"); then
    FINAL_TIP=${FINAL_LS%%$'\t'*}; FINAL_LOOKUP_FAILED=
  else
    FINAL_TIP=; FINAL_LOOKUP_FAILED=1
  fi
  # The object this push PUBLISHES, not a re-resolution of the branch NAME. Until round 74 this
  # line read `git rev-parse --verify --quiet "refs/heads/${BRANCH}"`, so a branch that moved
  # between the Phase 2 comparison and here was CLASSIFIED while `$PLAN_HEAD_SHA` was PUSHED: the
  # fence could read `fast-forward` about commit B, skip the unshared question on that basis, and
  # let git overwrite the remote with commit A — with the tracking ref and reflog updated by the
  # same movement, the lease and `--force-if-includes` both passed — the form this fence carried
  # until round 75, and the bind below is now the second half of the same fix. That is § 4.50's defect one
  # fence later. The approval is bound to a commit, so every check that AUTHORIZES the push must
  # be bound to the same commit; `/epic-merge` Step 5 classifies against `$PUSHED` for this exact
  # reason. An assignment, not a capture: `$PLAN_HEAD_SHA` is already in this fence and already
  # guarded for emptiness above, and re-reading it through git would reintroduce the gap.
  FINAL_LOCAL=$PLAN_HEAD_SHA
  # Fail-closed rows FIRST: a failed lookup also leaves the tip empty, and testing emptiness first
  # would read every unreachable remote as a creation.
  if [[ -z "$FINAL_LOCAL" ]] || [[ "$FINAL_LOOKUP_FAILED" = 1 ]]; then
    FINAL_ANCESTRY=; FINAL_READING=unknown
  elif [[ -z "$FINAL_TIP" ]]; then
    FINAL_ANCESTRY=; FINAL_READING=creation
  elif [[ "$FINAL_TIP" = "$FINAL_LOCAL" ]]; then
    FINAL_ANCESTRY=; FINAL_READING=up-to-date
  else
    if /usr/bin/env -u BASH_ENV -u ENV -u GIT_EXEC_PATH -u GIT_DIR -u GIT_WORK_TREE -u GIT_COMMON_DIR -u GIT_INDEX_FILE -u GIT_OBJECT_DIRECTORY -u GIT_ALTERNATE_OBJECT_DIRECTORIES -u GIT_NAMESPACE -u GIT_CEILING_DIRECTORIES -u GIT_GLOB_PATHSPECS -u GIT_ICASE_PATHSPECS -u GIT_NOGLOB_PATHSPECS -u GIT_LITERAL_PATHSPECS -u GIT_CONFIG -u GIT_CONFIG_PARAMETERS -u GIT_CONFIG_COUNT -u GIT_CONFIG_NOSYSTEM -u GIT_CONFIG_GLOBAL -u GIT_CONFIG_SYSTEM -u GIT_IMPLICIT_WORK_TREE -u GIT_GRAFT_FILE -u GIT_SHALLOW_FILE -u GIT_PREFIX -u GIT_REPLACE_REF_BASE -u GIT_EXTERNAL_DIFF -u GIT_SSH_COMMAND -u GIT_SSH -u GIT_PROXY_COMMAND -u GIT_SSH_VARIANT GIT_GRAFT_FILE=/dev/null GIT_NO_REPLACE_OBJECTS=1 git merge-base --is-ancestor "$FINAL_TIP" "$FINAL_LOCAL"; then FINAL_ANCESTRY=0; else FINAL_ANCESTRY=$?; fi
    # captured immediately — three readings, never two
    case "$FINAL_ANCESTRY" in
      0) FINAL_READING=fast-forward ;;
      1) FINAL_READING=rewrite ;;
      *) FINAL_READING=unknown ;;
    esac
  fi
  /usr/bin/printf 'FINAL_READING=[%s]\nFINAL_TIP=[%s]\nFINAL_LOOKUP_FAILED=[%s]\nUNSHARED_ATTESTED=[%s]\n' \
    "$FINAL_READING" "$FINAL_TIP" "$FINAL_LOOKUP_FAILED" "$UNSHARED_ATTESTED"
  # A `case` over the WORD with a `*` catch-all, not a negated list: a reading this fence has never
  # heard of lands in the refusing arm by construction. `unknown` refuses whatever was attested —
  # the attestation answers "is this ref shared", `unknown` says the measurement failed, and no
  # answer to the first is evidence about the second.
  case "$FINAL_READING" in
    creation|up-to-date|fast-forward) ;;
    rewrite)
      if [[ "$UNSHARED_ATTESTED" != "refs/heads/${BRANCH}" ]]; then
        echo "⛔ this push rewrites refs/heads/${BRANCH} and no unshared attestation covers it." >&2
        echo "   Phase 1 classified the topology before the approval; it reads 'rewrite' now." >&2
        echo "   STOP. Two things are owed, and the ORDER is the contract (git-workflow.md" >&2
        echo "   § Push safety: the unshared question comes BY NAME and BEFORE the force approval):" >&2
        echo "   1) put the unshared question to the operator by name;" >&2
        echo "   2) on a yes, return to Phase 1 for a FRESH push approval whose plan states that" >&2
        echo "      this push rewrites the ref and shows the lease it will carry. The approval you" >&2
        echo "      hold described a topology that no longer applies, and an attestation about" >&2
        echo "      sharedness is not an approval of a rewrite." >&2
        echo "   Only then re-run this fence with UNSHARED_ATTESTED=refs/heads/${BRANCH}." >&2
        echo "   Never set ALLOW_FORCE_UNSHARED." >&2
        readonly PUSH_BLOCKED=1; exit 1
      fi
      # The attestation is a credential; this is a FACT, and they are not interchangeable. The two
      # checks above bind the local side to the approval (`FINAL_LOCAL=$PLAN_HEAD_SHA`) and the
      # destination to it (the digest guard); the object this push DESTROYS was never bound to
      # anything. So a tip that moved between the classification and here means the operator
      # approved overwriting one commit and this fence is about to overwrite a different one —
      # and the lease, carrying `$FINAL_TIP`, expects the NEW value and sails through. The
      # movement is also evidence AGAINST the attestation it would otherwise proceed on: a ref
      # nobody else holds does not acquire commits nobody here published. Fail-closed on an
      # unfilled field, per the declaration above.
      if [[ "$FINAL_TIP" != "$PLAN_REMOTE_TIP" ]]; then
        echo "⛔ refs/heads/${BRANCH} points at '${FINAL_TIP:-<none>}' but the approval covered" >&2
        echo "   overwriting '${PLAN_REMOTE_TIP:-<none>}' — a different commit would be destroyed." >&2
        echo "   The attestation you hold says this ref is not shared; the tip moving since the" >&2
        echo "   classification is evidence against it, so it cannot carry this push. STOP." >&2
        echo "   1) put the unshared question to the operator by name, for the tip as it reads NOW;" >&2
        echo "   2) on a yes, return to Phase 1 for a FRESH push approval whose plan names that tip." >&2
        echo "   Never set ALLOW_FORCE_UNSHARED." >&2
        readonly PUSH_BLOCKED=1; exit 1
      fi ;;
    *)
      echo "⛔ the destination topology for refs/heads/${BRANCH} reads '${FINAL_READING}' — the" >&2
      echo "   measurement did not answer, so nothing here knows what this push would overwrite," >&2
      echo "   and an attestation about sharedness cannot supply it. STOP." >&2
      readonly PUSH_BLOCKED=1; exit 1 ;;
  esac
fi
# ⚠️ Always unset ALLOW_PUSH_PROTECTED **and ALLOW_FORCE_UNSHARED** to prevent env
# inheritance bypassing the hook. Both are developer-set attestations; a value exported
# earlier in the shell would answer the hook's question without anybody being asked now,
# and 'must never set it' is not the same guarantee as 'must never let it through'.
# Clearing is the guarantee.
# Only set ALLOW_FORCE_WITH_LEASE when --force-with-lease is explicitly requested.
# ⚠️ `--` before the ref is load-bearing, and quoting does not replace it: the quotes are
# consumed by the shell, so git still sees an option-shaped branch name as an option.
# `git check-ref-format refs/heads/--all` exits 0, and `git push origin "--all"` on such a
# branch reports "Everything up-to-date" — git took `--all` as the flag and pushed every
# branch, none of which the plan above showed or the approval covered. With `--` the same
# argument is a refspec ("src refspec --all does not match any"). Measured in all four
# forms below, `-u` and `--force-with-lease` included.
# ⚠️ And `--` ends OPTION parsing, not REFSPEC parsing — which is why the ref is written as a
# full `src:dst` refspec rather than a bare branch name. `+` leads a force refspec, and
# `git check-ref-format refs/heads/+main` exits 0, so `+main` is a legal branch name that the
# protected-branch guard above reads as unprotected. Measured: with a local `main` rewound
# behind the remote, `git push origin -- "+main"` — no force flag anywhere on the line —
# reported `+ affcbe7...ad7e970 main -> main (forced update)` and exit 0. It is also simply
# the wrong branch: with a real `+main` branch present, that form pushed `main` and never
# created `refs/heads/+main` on the remote, while `refs/heads/+main:refs/heads/+main` created
# it correctly. So the explicit refspec closes a silent force-push of a protected branch and
# fixes which branch is pushed at the same time. Write `${BRANCH}` in braces: `$BRANCH:refs`
# is a modifier expansion in zsh and silently eats the `:refs`.
# ⚠️ **The lease carries the tip the fence above measured** —
# `--force-with-lease=refs/heads/<b>:$FINAL_TIP` — and `--force-if-includes` is gone with the bare
# form it was compensating for (round 75; Step 5 of `/epic-merge` has been on this shape since
# round 60). The bare lease resolves `refs/remotes/origin/<b>` *inside the pushing process*, so it
# expresses a different expectation than the classification the operator was shown, and the pair
# closed only part of the gap: `--force-if-includes` asks whether the remote tip is reachable from
# **any reflog entry** of the local branch, which a branch that once held that commit satisfies by
# construction. Measured end to end 2026-08-22 (git 2.55.0), and this is the whole finding:
# classifier reads remote `C`; a collaborator publishes divergent `D`; a background fetch moves
# the tracking ref to `D`; `D` is in the branch reflog because the operator had it checked out
# earlier and reset away. The shipped `--force-with-lease --force-if-includes` publishing the
# approved `A` reported `+ 30b0ccd...2f05240 feat/x -> feat/x (forced update)` and exit 0 — `D`
# overwritten, no attestation, and the only topology the operator ever saw said `fast-forward`.
# The same tree with `--force-with-lease="refs/heads/feat/x:<C>"` was rejected: `! [rejected] …
# (stale info)`, remote unchanged. An empty `$FINAL_TIP` is not a hole but the `creation` reading's
# own expectation — measured: `--force-with-lease=refs/heads/<new>:` creates the ref and the same
# form against an existing ref is rejected `(stale info)`. `unknown` never reaches here; the `case`
# above refuses it.
# The two flags are **not** combined: measured on the same git, an explicit lease value plus
# `--force-if-includes` succeeded (exit 0) where the value alone refuses — git documents the flag
# as a no-op beside a lease value, and a silently-inert safety flag reads as protection nobody has.
# Requires git >= 2.30 for the valued form as well; on an older git the push fails with an
# unknown-option error, which is the correct direction — falling back to the bare form would
# restore the hazard silently.
# `SD0X_PUSH_DEST_DIGEST` is the other half of the destination check above, and the half that is
# not a race. The comparison a few lines up re-reads the destination in THIS shell; the push is a
# different process, so a `.git/config` edit or a `url.<x>.pushInsteadOf` landing in between still
# redirects it. git closes that window itself and hands the answer to the pre-push hook as `$2` —
# the destination it is about to reach, resolved inside the pushing process, after every rewrite.
# Measured 2026-08-22 (git 2.55.0): under `url.<B>.pushInsteadOf=<A>` a push naming `origin` gives
# `$1=origin` and `$2=<B>`, and the digest of `$2` equals the digest of `git remote get-url --push
# --all origin` byte for byte, with the rewrite and without it. Wired end to end: the rewrite was
# refused and nothing reached B; the same push carrying B's own digest went through.
#
# **This is not an ALLOW_* variable and the Prohibited list does not cover it.** Those are
# developer attestations, which is why this skill must never set them and must clear the ones it
# inherits. This one is the opposite direction: it is a constraint the skill imposes on its own
# push, it can only ever cause a refusal, and setting it inline is what stops an inherited value
# from deciding. Where the hook is not installed it does nothing at all — monotone, the same
# property the lease value above has: both can only ever turn a push into a refusal.
# Read once, here, rather than inside the arms: with `-u` gone the two arms are one command each,
# and the only thing `SET_UPSTREAM` still decides is whether the write below happens. Deciding it
# before the push also means an ambient value cannot be read for the first time after the push has
# already gone out.
UPSTREAM_OWED=
if [[ "$SET_UPSTREAM" == "true" ]]; then UPSTREAM_OWED=1; fi
if [[ -n "$PUSH_BLOCKED" ]] || [[ -z "$PLAN_HEAD_SHA" ]]; then
  echo "⛔ a guard above refused this push, or the approved commit is empty — nothing is pushed" >&2
  # …and the fence must SAY so, not merely print it. `echo` succeeds, so an arm ending on one
  # reports **success** for a refusal: Phase 2 reads as complete, and the caller goes on to
  # dispatch `/watch-ci` for a push that never happened. This arm is reachable at all only when a
  # guard's own `exit 1` was answered by an imported `BASH_FUNC_exit%%` that returns — the case
  # this document anticipates everywhere else — so terminating it with another `exit` would be
  # the same defect twice. Assign-then-expand, as in step 0a: the reset is a syntax assignment no
  # function can shadow, and `:?` on a null value exits non-zero.
  SD0X_PUSH_CI_REFUSED=
  : "${SD0X_PUSH_CI_REFUSED:?refusing — a guard above refused this push, or the approved commit is empty; nothing was pushed}"
elif [[ "$FORCE_WITH_LEASE" == "true" ]]; then
  /usr/bin/env -u BASH_ENV -u ENV -u GIT_EXEC_PATH -u GIT_DIR -u GIT_WORK_TREE -u GIT_COMMON_DIR -u GIT_INDEX_FILE -u GIT_OBJECT_DIRECTORY -u GIT_ALTERNATE_OBJECT_DIRECTORIES -u GIT_NAMESPACE -u GIT_CEILING_DIRECTORIES -u GIT_GLOB_PATHSPECS -u GIT_ICASE_PATHSPECS -u GIT_NOGLOB_PATHSPECS -u GIT_LITERAL_PATHSPECS -u GIT_CONFIG -u GIT_CONFIG_PARAMETERS -u GIT_CONFIG_COUNT -u GIT_CONFIG_NOSYSTEM -u GIT_CONFIG_GLOBAL -u GIT_CONFIG_SYSTEM -u GIT_IMPLICIT_WORK_TREE -u GIT_GRAFT_FILE -u GIT_SHALLOW_FILE -u GIT_PREFIX -u GIT_REPLACE_REF_BASE -u GIT_EXTERNAL_DIFF -u GIT_SSH_COMMAND -u GIT_SSH -u GIT_PROXY_COMMAND -u GIT_SSH_VARIANT ALLOW_PUSH_PROTECTED= ALLOW_FORCE_UNSHARED= SD0X_PUSH_DEST_DIGEST="$PUSH_URLS_DIGEST" GIT_GRAFT_FILE=/dev/null GIT_NO_REPLACE_OBJECTS=1 ALLOW_FORCE_WITH_LEASE=1 git push --force-with-lease="refs/heads/${BRANCH}:${FINAL_TIP}" --receive-pack=git-receive-pack origin -- "${PLAN_HEAD_SHA}:refs/heads/${BRANCH}"
else
  /usr/bin/env -u BASH_ENV -u ENV -u GIT_EXEC_PATH -u GIT_DIR -u GIT_WORK_TREE -u GIT_COMMON_DIR -u GIT_INDEX_FILE -u GIT_OBJECT_DIRECTORY -u GIT_ALTERNATE_OBJECT_DIRECTORIES -u GIT_NAMESPACE -u GIT_CEILING_DIRECTORIES -u GIT_GLOB_PATHSPECS -u GIT_ICASE_PATHSPECS -u GIT_NOGLOB_PATHSPECS -u GIT_LITERAL_PATHSPECS -u GIT_CONFIG -u GIT_CONFIG_PARAMETERS -u GIT_CONFIG_COUNT -u GIT_CONFIG_NOSYSTEM -u GIT_CONFIG_GLOBAL -u GIT_CONFIG_SYSTEM -u GIT_IMPLICIT_WORK_TREE -u GIT_GRAFT_FILE -u GIT_SHALLOW_FILE -u GIT_PREFIX -u GIT_REPLACE_REF_BASE -u GIT_EXTERNAL_DIFF -u GIT_SSH_COMMAND -u GIT_SSH -u GIT_PROXY_COMMAND -u GIT_SSH_VARIANT ALLOW_PUSH_PROTECTED= ALLOW_FORCE_UNSHARED= SD0X_PUSH_DEST_DIGEST="$PUSH_URLS_DIGEST" GIT_GRAFT_FILE=/dev/null GIT_NO_REPLACE_OBJECTS=1 ALLOW_FORCE_WITH_LEASE= git push --receive-pack=git-receive-pack origin -- "${PLAN_HEAD_SHA}:refs/heads/${BRANCH}"
fi
# `$?` on its own line, and this is deliberately NOT the shape § 4.46 removed. There, what a
# following capture line lost under an inherited `errexit` was a DIAGNOSTIC that had to survive
# the failure it described. Here what follows is a WRITE that must not happen on one: under
# `errexit` the shell dies at the failing push and never reaches it, which is precisely the
# outcome the guard below produces explicitly when `errexit` is off. Both paths refuse; only one
# of them is a line of shell.
PUSH_STATUS=$?
# `-u` is gone from both forms, and the upstream is written here instead. The `-u` was what forced
# the mutable `refs/heads/${BRANCH}` source above: measured 2026-08-21 and again 2026-08-22 on git
# 2.55.0, `git push -u origin "<sha>:refs/heads/feat/x"` succeeds and `@{u}` still reports "no
# upstream configured", with no warning on either stream. Round 63 read that as "the SHA source is
# unavailable" and kept the comparison alone — but a comparison of `HEAD` followed by a push of
# `refs/heads/${BRANCH}` names two different things, and git resolves the second one, inside its own
# process, after the comparison has passed. The approval is bound to a commit; the push has to be
# bound to the same one, and a refspec whose left side is an object ID is the only construct that
# does it — the ID cannot be moved by anything between here and git's own resolution.
# The same measurement, continued 2026-08-22, is what makes that affordable: the SHA-source push
# still updates `refs/remotes/origin/<branch>` (git's default fetch refspec applies to it), so the
# two keys `-u` would have written can be written directly, with no fetch — `@{u}` and
# `git status -sb` both resolve afterwards. Pinning the source costs two config writes, not the
# upstream. These are the same two keys `-u` wrote, to the same values, so nothing about the
# repository ends up in a state the old form could not also produce.
# Gated on the push having SUCCEEDED: an upstream pointing at a branch the push never published is
# a worse state than no upstream at all — `git status` would then report the local branch as ahead
# of a ref that does not exist.
# `|| VAR=$?` rather than a following `STATUS=$?` line, for the reason § 4.46 records: under an
# inherited `errexit` the shell dies AT a failing command and a following capture line never runs,
# while a `||` list suppresses `errexit` for its left side by definition. Both writes assign into
# the SAME variable deliberately — either failing leaves the upstream unusable, and the second
# failing after the first succeeded is the half-written state, which is not better than neither.
UPSTREAM_STATUS=0
if [[ "$UPSTREAM_OWED" = 1 ]] && [[ "$PUSH_STATUS" = 0 ]]; then
  /usr/bin/env -u BASH_ENV -u ENV -u GIT_EXEC_PATH -u GIT_DIR -u GIT_WORK_TREE -u GIT_COMMON_DIR -u GIT_INDEX_FILE -u GIT_OBJECT_DIRECTORY -u GIT_ALTERNATE_OBJECT_DIRECTORIES -u GIT_NAMESPACE -u GIT_CEILING_DIRECTORIES -u GIT_GLOB_PATHSPECS -u GIT_ICASE_PATHSPECS -u GIT_NOGLOB_PATHSPECS -u GIT_LITERAL_PATHSPECS -u GIT_CONFIG -u GIT_CONFIG_PARAMETERS -u GIT_CONFIG_COUNT -u GIT_CONFIG_NOSYSTEM -u GIT_CONFIG_GLOBAL -u GIT_CONFIG_SYSTEM -u GIT_IMPLICIT_WORK_TREE -u GIT_GRAFT_FILE -u GIT_SHALLOW_FILE -u GIT_PREFIX -u GIT_REPLACE_REF_BASE -u GIT_EXTERNAL_DIFF -u GIT_SSH_COMMAND -u GIT_SSH -u GIT_PROXY_COMMAND -u GIT_SSH_VARIANT git config "branch.${BRANCH}.remote" origin || UPSTREAM_STATUS=$?
  /usr/bin/env -u BASH_ENV -u ENV -u GIT_EXEC_PATH -u GIT_DIR -u GIT_WORK_TREE -u GIT_COMMON_DIR -u GIT_INDEX_FILE -u GIT_OBJECT_DIRECTORY -u GIT_ALTERNATE_OBJECT_DIRECTORIES -u GIT_NAMESPACE -u GIT_CEILING_DIRECTORIES -u GIT_GLOB_PATHSPECS -u GIT_ICASE_PATHSPECS -u GIT_NOGLOB_PATHSPECS -u GIT_LITERAL_PATHSPECS -u GIT_CONFIG -u GIT_CONFIG_PARAMETERS -u GIT_CONFIG_COUNT -u GIT_CONFIG_NOSYSTEM -u GIT_CONFIG_GLOBAL -u GIT_CONFIG_SYSTEM -u GIT_IMPLICIT_WORK_TREE -u GIT_GRAFT_FILE -u GIT_SHALLOW_FILE -u GIT_PREFIX -u GIT_REPLACE_REF_BASE -u GIT_EXTERNAL_DIFF -u GIT_SSH_COMMAND -u GIT_SSH -u GIT_PROXY_COMMAND -u GIT_SSH_VARIANT git config "branch.${BRANCH}.merge" "refs/heads/${BRANCH}" || UPSTREAM_STATUS=$?
fi
# The fence's own exit status must stay the PUSH's. Without this arm and the one below it, the
# `if` above is the last command of Phase 2, and a FALSE condition is exactly what a failed push
# produces — so the fence would exit 0, Phase 2 would read as complete, and the caller would go on to dispatch
# `/watch-ci` for a push that was rejected. That is the same defect as an arm ending on `echo`,
# caught here by the test that asserts a rejected push fails the fence rather than by a reader.
# Spelled as the refusal at the top of the block is spelled, and for the same reason: `exit` is a
# builtin an imported `BASH_FUNC_exit%%` outranks, while a null-value `:?` expansion is the
# shell's own error and ends a non-interactive shell with nothing to shadow. The status itself is
# reported in the message, since `:?` cannot carry it.
if [[ "$PUSH_STATUS" != 0 ]]; then
  echo "⛔ the push exited ${PUSH_STATUS} — nothing was published; Phase 3 must not run" >&2
  SD0X_PUSH_CI_REFUSED=
  : "${SD0X_PUSH_CI_REFUSED:?refusing — the push exited non-zero; nothing was published}"
fi
# The other half of the promise. The push succeeding is not the whole of what Phase 2 was
# approved to do when `--set-upstream` was in the plan: `-u` used to fail or succeed WITH the
# push, and moving the upstream into two commands after it split one outcome into two — so a
# fence that reads only the push status now reports success for a state the old form could not
# produce. It is a DIFFERENT sentence from the one above because it is a different state: the
# commits really are on the remote, and telling the operator "nothing was published" here would
# send them to re-push something that is already there.
if [[ "$PUSH_STATUS" = 0 ]] && [[ "$UPSTREAM_STATUS" != 0 ]]; then
  echo "⛔ the push published ${BRANCH}, but the upstream write exited ${UPSTREAM_STATUS} —" >&2
  echo "   branch.${BRANCH}.remote / .merge may be unset or half-written. The COMMITS ARE PUSHED;" >&2
  echo "   do not push again. Set the upstream by hand, then continue:" >&2
  echo "     git config branch.${BRANCH}.remote origin" >&2
  echo "     git config branch.${BRANCH}.merge refs/heads/${BRANCH}" >&2
  SD0X_PUSH_CI_REFUSED=
  : "${SD0X_PUSH_CI_REFUSED:?refusing — the push landed but the upstream write did not}"
fi
# ⚠️ The prefix is spelled `/usr/bin/env`, absolutely, and that is not style. A bare `env` is a
# command word without a slash, so bash resolves an imported `BASH_FUNC_env%%` function first and
# the forged function ignores every `-u`: measured, a child behind `env -u GIT_DIR` still received
# `GIT_DIR=/attacker/repo.git`. `command env` does not fix it either — `command` is a builtin, and
# functions outrank builtins. A word containing `/` closes the IMPORT vector — bash refuses to
# import a function whose name contains one ("error importing function definition for
# '/usr/bin/env'"). It does **not** make the word immune, and round 54 wrote it as though it did.
# Measured 2026-08-22: a `$BASH_ENV` file containing `function /usr/bin/env { ...; }` is sourced
# before line 1 of this fence, defines that exact name in THIS shell, and intercepts the prefix —
# the child printed HIJACKED. Only `bash -p` refuses the sourcing (measured SAFE), and a markdown
# fence cannot choose its interpreter's flags. So the honest boundary: `-u BASH_ENV` below protects
# every CHILD this fence starts, the slash protects against a function arriving through the
# environment, and neither protects this shell from a `$BASH_ENV` its own parent set — in which
# case `git` itself is equally forgeable and the fence has no integrity left to defend.
# What **Phase 0 step 0a** closes is the DETECTABLE half — not the reachable one, and the difference
# is the whole honesty of this comment. It refuses on the set-ness of `BASH_ENV`/`ENV` before any ref
# is read, and terminates through an expansion failure over a sentinel it resets one line above,
# rather than through `exit`: `exit` is a builtin a function outranks, and `:?` fires on null OR
# unset, so without that reset one exported `SD0X_PUSH_CI_REFUSED=1` satisfied it (measured, round
# 65). What it does NOT close: a startup file that defines the function and then unsets the variable,
# which is exactly as reachable as the case that is caught and merely invisible to a check that reads
# variables.
# That residue has no owner downstream. Saying "`pre-push-gate.sh` re-execs under `bash -p`, so L1
# is where the authorization lands" — as this comment did until round 64 — is only true where L1 is
# INSTALLED, and it is opt-in: `rules/git-workflow.md` § Push safety makes the in-session approval
# the whole credential wherever the hook is absent, so there is no stronger mechanism to defer to.
# ⚠️ `-u BASH_ENV -u ENV` leads every form and is not decoration. A non-interactive bash
# sources $BASH_ENV before line 1 of the pre-push hook, so an exported `ALLOW_FORCE_UNSHARED=1`
# assigned there restores exactly what the assignments to its right just cleared — measured, and
# a BASH_ENV that simply runs `exit 0` disables the hook outright. Neither is reachable from
# inside the hook: by the time its first line runs, that file has already been sourced. The hook
# re-execs itself under `bash -p` to shut the door on exported-function injection, which this
# prefix cannot name; this prefix shuts the one the re-exec cannot. Both, or neither works.
# `-u GIT_EXEC_PATH` closes a third, and it is the one the hook provably cannot close itself:
# git PREPENDS its exec-path to PATH before running a hook, so that variable — not a bare PATH —
# chooses which `git` the gate asks about ancestry. Measured end to end on 2026-08-21: with a
# git-core that delegates everything except `merge-base --is-ancestor`, a rewrite of an
# unprotected branch was pushed with exit 0 and no prompt, where the same push without the
# variable was refused with exit 1. Adding `-u GIT_EXEC_PATH` restores the refusal, and does not
# disturb an ordinary create or fast-forward (both still exit 0). The hook has no oracle for
# "which git is real" — every candidate is answered by the git in question — so this belongs
# here. Residual, stated rather than implied: a push made outside this skill is not covered.
# The GIT_* list after it is the same question one layer out: `GIT_CONFIG_COUNT`/`_PARAMETERS`/
# `_GLOBAL` choose the config THIS push resolves against, and two keys there are fatal —
# `url.<host>.insteadOf` sends the approved refspec to another server, `core.hooksPath=/dev/null`
# removes the gate outright. `GIT_GRAFT_FILE` is a third shape: it leaves the gate installed and
# poisons its ancestry oracle instead. All three measured on 2026-08-21 (§ 4.3).
# `GIT_GRAFT_FILE=/dev/null` and `GIT_NO_REPLACE_OBJECTS=1` are SET, not unset — the two names
# here whose safe value is a value, and each spent a round on the strip list with the sense exactly
# inverted. Unsetting `GIT_GRAFT_FILE` restores its DEFAULT path, `$GIT_DIR/info/grafts`, so the
# strip closes the environment channel by opening the repository one (measured 2026-08-21: the
# stripped form answers 0, the `/dev/null` form 1). For the other: unsetting it
# restores git's DEFAULT of honouring `refs/replace/*`, so a `git replace --graft L R` in the
# repository makes the gate's `merge-base --is-ancestor R L` answer 0 and the rewrite reads as a
# fast-forward — while the push publishes the real, unrelated L, because pack transfer ignores
# replacements. That asymmetry is what makes this a PUSH problem and not a general one: nothing
# else here is asked a question whose answer the transfer then disregards, which is why
# `skills/smart-commit` strips the same name and is right to. Measured: honest ancestry 1,
# grafted 0, guarded 1. The last three are the transport itself. `GIT_SSH_COMMAND`, `GIT_SSH` and
# `GIT_PROXY_COMMAND` each name an executable git runs IN PLACE OF the connection, handed the host
# and the remote command as mere arguments — measured 2026-08-22 on git 2.55.0, a wrapper is invoked
# as `<host> "git-receive-pack '/team/a.git'"` and may ignore both and speak to anything. That is the
# same redirection `url.<host>.insteadOf` performs, and closing one channel while leaving the other
# open protected nothing: Phase 0 hashes the approved URL, the operator approves it, the hook checks
# its digest, and the lease-force lands somewhere else. `GIT_ASKPASS` is NOT stripped and the
# difference is measurable, not stylistic — it is handed a prompt and returns a credential, so it
# cannot choose a destination. What this closes is the ENVIRONMENT channel only: `core.sshCommand`
# and `url.*.insteadOf` in the repository's own config still apply, deliberately — that config is
# the operator's, and it is also what keeps their key selection working after this strip
# (`~/.gitconfig`, `~/.ssh/config`). An operator who exported `GIT_SSH_COMMAND` ad hoc for this
# shell loses it here, and that loss is loud ONLY where the fallback cannot connect. On the case
# that matters it is silent: one host, two ports, two repositories, one key — the ad-hoc `-p 2222`
# is dropped, the push succeeds against the WRONG repository, and every control reports success.
# So the strip is not the answer on its own, and Phase 0 step 0b REFUSES a set transport variable
# rather than relying on this line (`docs/features/push-gate-optin/4-implementation.md` § 4.18).
# If push fails (non-zero exit) → stop immediately, report error, do NOT proceed to CI

pre-push-gate: Cannot open /dev/tty — no interactive terminal in this environment.
A force-form push needs an attestation that these refs are not shared.   # rewrite class
Push to protected branches requires interactive confirmation.            # protected class

- Executing git push WITHOUT prior user approval via AskUserQuestion
- Suggesting or executing git push --force (ever)
- Executing or offering to approve git push --force-with-lease onto a protected branch (main/master/develop/release/*) — hard abort in Phase 0, re-asserted in Phase 2
- Pushing to protected branches WITHOUT explicit user pre-approval via AskUserQuestion
- Setting ALLOW_PUSH_PROTECTED=1 (this skill must NEVER set this env var; it is reserved for manual developer use only)
- Pushing without `-u GIT_EXEC_PATH` in the `env -u` prefix, or letting an inherited `GIT_EXEC_PATH` through. It selects the `git` the pre-push gate itself runs — git prepends its exec-path to PATH for hooks — so an ambient one lets the caller answer the gate's ancestry question with a binary of their choosing. Measured: a forced update past both gates, exit 0, no prompt
- Pushing without the `GIT_*` half of the `env -u` prefix, or letting any of those through. They select the configuration and the ancestry this push resolves against, and the gate resolves the same ones: `GIT_CONFIG_COUNT` + `core.hooksPath=/dev/null` deletes the gate, `url.<host>.insteadOf` redirects the approved refspec to another server, and `GIT_GRAFT_FILE` leaves the gate running while making a rewrite answer "fast-forward". Measured: `main` force-updated with exit 0 and no prompt under the first; the same push refused under the prefix
- Executing any push form without the `env -u BASH_ENV -u ENV` prefix (it is what stops a startup file from re-setting, inside the hook's own interpreter, the bypass variables the line just cleared)
- Setting ALLOW_FORCE_UNSHARED=1, **or letting an inherited one through** (same rule, same reason: it attests that a branch is not shared, which is a fact only the operator has. A skill setting it would be answering its own question; a skill passing an ambient one along lets a shell answer it. Phase 2 clears both bypass variables on every push form)
- Pushing when `remote.origin.receivepack` is configured, or emitting `--exec` / any `--receive-pack=` value other than the exact literal `git-receive-pack`. The flag names the program that receives the objects, and a program can ignore the repository the URL named — so a *chosen* value makes the destination digest true and meaningless at the same time. The canonical value is the opposite: it pins git's own default onto the command line, where it overrides configuration, which is what closes the window between the check above and the push (measured 2026-08-22 — `-c remote.<name>.receivepack=` does not override; the flag does)
- Printing the value of `remote.origin.receivepack` anywhere. It is a command line and may carry a token; report only whether it is set
- Pushing without `SD0X_PUSH_DEST_DIGEST="$PUSH_URLS_DIGEST"` on the push line. The direction is the opposite of the two ALLOW_* rules above and the contrast is the point: those attest a fact only the operator has, so this skill must never set them; this one is a constraint the skill puts on its own push — it names the destination the approval covered and can only cause a refusal, never an authorization. Omitting it leaves the destination checked in one process and pushed in another, which is a window, not a check. Setting it inline is also what stops an inherited value from deciding
- Auto-triggering this skill (disable-model-invocation: true)
- Skipping preflight checks
- Skipping `/watch-ci` delegation after successful push

Input: /push-ci
Phase 0: Preflight — branch feat/auth, 3 commits ahead, remote OK, PUSH_GATE=referenced
Phase 1: Show plan — row 2, so L2 authorizes: an installed hook exits without prompting on an
         unprotected push, leaving nothing stronger to defer to → user approves
Phase 2: Phase 2 assembly — non-force branch, upstream already set
Phase 3: /watch-ci --sha <HEAD> --branch feat/auth (Monitor streaming — receive progress notifications)

Input: /push-ci --timeout 15
Phase 0-1: Same as above, same row and same credential
Phase 2: Phase 2 assembly — non-force branch, upstream written by the auto-detect after the push
Phase 3: /watch-ci --sha <HEAD> --branch <branch> --timeout 15

Input: /push-ci --force-with-lease
Phase 0: Preflight — feat/rebase-cleanup is not protected → continue (a protected branch hard-aborts here)
Phase 1: Show plan naming the force form — the FORCE row, not row 2: `ALLOW_FORCE_WITH_LEASE=1`
         clears the non-fast-forward refusal but not the unshared attestation, so the hook reaches
         /dev/tty and asks whether anybody else works on feat/rebase-cleanup. With the hook
         installed that terminal answer is the authorization and this approval is advisory;
         without it, this approval is the whole of it → ask the unshared question here (Phase 1),
         then user approves
Phase 2: Phase 2 assembly — lease branch, so both lease flags and ALLOW_FORCE_WITH_LEASE=1
Phase 3: CI monitoring

Input: /push-ci (on main branch)
Phase 0: Preflight — ⚠️ "main is a protected branch" → AskUserQuestion pre-approval
User: Continue → proceed
Phase 1: Show plan → user approves push. This is the one row-1 example, so the credential depends
         on a fact Phase 0 cannot establish: if the hook really runs, /dev/tty decides and this
         approval was advisory; if `PUSH_GATE=referenced` was a script that only names the gate,
         no prompt appears and this approval was the whole of it
Phase 2: Phase 2 assembly — non-force branch
Phase 3: /watch-ci (Monitor streaming — receive progress notifications)