chore(memory): BDR-112 + LRN-194..196 + journal — feat manual-push-guard run B

This commit is contained in:
bchanot
2026-10-07 12:41:46 +02:00
parent 6468eda495
commit 4630b625f7
6 changed files with 132 additions and 2 deletions
+4
View File
@@ -569,3 +569,7 @@ rules:
- /doc global audit 2026-10-06 (opus): 45 items, 6 docs. Applied 34 (24 AUTO + 9 HUMAN drafts + clone URL → Gitea): README components/slash/flow, Makefile help (11 profiles), USAGE /health→make doctor + GSD 3.0.0, ARCHITECTURE layout, MIGRATION retitled + "Upgrading to 2.0.0", SETTINGS package-install guard, CHANGELOG SemVer + default model + upgrade pointer → c6fb2e4. 10 deferred logged in TODO (LICENSE, Known-residual vs release, README restructure, USAGE narrative, templates/settings.json ask inert).
- Release 2.0.0 cut (user go x3: release, tag push, MIT): bugfix merged 370f35a; develop merged into release/2.0.0 (b47bba7, CHANGELOG conflict resolved: upgrade pointer under [2.0.0]); suite 46/46 green on release; 9ef66e2 MIT LICENSE + README License + Linux residual reworded; gitflow finish by release-executor (BLK-018 did not fire) -> main 4093cca, tag v2.0.0 pushed on user go. Open after release: Linux make test (TODO), make plugin + .env on this machine (BLK-027).
- /feat manual-push-mode run A (user: work machine, same flow, never push alone): `gitflow.autopush false` = manual-push mode end to end. Plan challenged 3 lenses + 1 confirm → 2 MAJOR (`-d` re-arms on lagging upstream LRN-161; /close STEP 5C pushes develop) + 3 BLOCKER in r2 (T22j regress, develop untracked in fixture, T18l/T18n order) all closed by named changes. feater ×2 (gaps: pipefail flake `git log | grep -q`, 9 SC2034 suppressions removed), GATE 0 7/8, verifier ECARTS(1) = AC6 env red only (design-tool-gate, 21st CLI present, same on develop fa67664), security PASS ×2. Commit 2fc8830 on feature/manual-push-mode, UNMERGED. Runs B (push-guard hook, settings deny widening, banner) + C (skills that push) queued in TODO; do NOT enable manual mode at work before B+C.
## 2026-10-07
- /feat manual-push-mode run B (user: "enchaine"): `hooks/push-guard.sh` PreToolUse denies Claude's `git push` when autopush false/unparseable/unreadable in cwd or literal -C/cd dirs (global config counts). Challenge: 3 lenses + robustness confirm FATAL(8) → BSD sed `N` fold empty on 1 line (hook dead), AC3 oracle naming denied tokens, glob trailing ` *` matches end → bare read lost, run C needs lib verb. feater ×3 (impl 58, no-jq test 61, hardening 71: cap 20 dirs, git rc → deny, quoted cd). GATE 0 MET ×3; verifier CONFORME then ECARTS(1) → user gated fail-closed also in auto for pathological commands; security PASS ×2 (3 MEDIUM closed, 2 residual → run D). Commits a2ac018 + 6468eda on feature/manual-push-mode, UNMERGED. settings.json live: 18 deny entries, soft_deny, Bash|Monitor hook group. User probe pending: `! git push --dry-run` bypasses hooks?