[Deep-Sixed]

Fixes findings from a code review of main at d73bb83, plus two raised afterwards: the pre-receive timing gap and verify_contract not checking indexes and triggers. Each fix comes with regression tests (tests/test_governance_fixes.py, tests/test_transaction_boundary.py). I ran the key tests against the previous code, and they fail there for the intended reason. Supersedes #9, which is now closed.

Changes

1. Self-approval. Now provided by main's Move approval authority to the repository and continue retained worktrees #12: agent roles, a per-repository approval policy, and a rule that an agent who approved an operation can't be the one to carry it out. This PR's original fix and its tests were removed in favour of it. The push path below authorizes through Move approval authority to the repository and continue retained worktrees #12's rules, with the pusher as the agent using the approval.
2. Reusing the old worktree when a task is re-claimed on the same branch. Also provided by Move approval authority to the repository and continue retained worktrees #12 (continue_or_create_worktree). This PR's duplicate code was removed.
3. Scope globs are normalized (./, //, a leading /, backslashes, ..). Overlap is compared case-insensitively, and scopes that point outside the repository are refused.
4. The hook checks pushed files against the claim's scopes. When a branch has a live claim, new commits may only touch files inside that claim's scopes. A merge commit only counts the files the merge itself changed.
5. Common mistakes give a clean error instead of a traceback. Commit arguments accept short SHAs, refs and uppercase hex and are stored as full commit IDs. Duplicate registrations and malformed operation JSON produce normal errors.
6. handoff create --last-commit is honored even when the claim has a worktree.
7. Pushes are authorized at the moment Git updates the ref
   • Before: pre-receive consumed the approval and committed that before Git moved the ref. An update Git refused later (another hook, a lost ref lock) still used up its approval. And if a claim was released, taken over or handed off in that gap, the push landed on authority that no longer held.
   • pre-receive: validates the push and records each exact ref update in a new ref_updates table (migration 003_ref_updates.sql, between 002 and main's 004). It no longer consumes anything.
   • Transaction hook, prepared stage: Git's reference-transaction hook re-checks every recorded update against current state while Git holds the ref locks and can still abort. Approvals are consumed only here, and any failure aborts the update.
   • committed / aborted stages: these record the outcome. An abort after prepared returns the consumed approval to usable. If the same operation was requested again in the meantime, the old approval stays used up so there are never two live approvals for one operation.
   • Hook must be present: pre-receive refuses pushes if the transaction hook is missing, modified, or not executable.
   • Installation: hook install inspects both hook paths before writing either. It refuses to overwrite a hook QuorumGit didn't write and requires Git 2.28 or newer.
   • Only unidentified ref changes pass through. A transaction with an agent identity must match a fresh validation from pre-receive, and if the store has disappeared it fails closed. Only transactions without an identity (maintenance run inside the hub) pass through.
8. verify_contract checks the whole schema. It replays the bundled migrations into an in-memory database and requires every table, index and trigger in the store to match (ignoring formatting). It rejects missing or altered objects, indexes or triggers that shouldn't be there, and stores migrated by a newer version.
9. Latent bug fixed along the way. Repository identity lookups inherited the hook's GIT_DIR. With an absolute GIT_DIR, every registered path resolved to the hub.
10. doctor settles ref updates stuck in prepared. It reads the outcome from the ref itself: at the new value → committed; still at the old value → aborted, and --repair restores the approval; moved elsewhere or still locked → reported, never guessed.

Notes for reviewers

• Upgrading an existing hub: re-run quorumgit hook install --repo <name>. Until then, pushes are rejected with a message saying the transaction hook is missing.
• Merges with main:
  • docs: align README and design notes with current behaviour #11 (README update): two statements it added are corrected, because this PR changes the behaviour they describe.
  • Use standard-library SQLite 3 for the store instead of libSQL #14 (standard-library sqlite3): the schema replay uses sqlite3. Restoring an approval catches sqlite3.IntegrityError, the error raised when the one-live-approval index is hit.
  • Ignore removed worktrees in handoff and checkpoint #13 (removed worktrees) and Fix pre-existing ruff lint findings #15 (lint cleanup): this PR uses Ignore removed worktrees in handoff and checkpoint #13's active_worktree_for_claim and follows Fix pre-existing ruff lint findings #15's explicit check= convention.
  • Move approval authority to the repository and continue retained worktrees #12 (approval authority, worktree continuation): takes over fixes 1 and 2, as described above.
• Review: the three P1 findings from Codex's review bot are fixed in 9e2fb24, and their threads are resolved.

Validation

• pytest tests -q: 185 passed
• pyright: 0 errors
• ruff check (the pinned 0.16.9): no findings

🤖 Generated with Claude Code

https://claude.ai/code/session_01Q8BpCkArA34hB1aSyVcnZp

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cc88d14851

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Deep-Sixed]

Closing this in favour of smaller PRs. main has overtaken most of it:

• Move approval authority to the repository and continue retained worktrees #12 covers the self-approval and worktree-continuation fixes.
• Normalize claim scopes and enforce them at push time #19 ported the scope normalization and push-time scope enforcement.
• docs: state the minimum Git version (2.17) #18 rewrote the push hook this PR's ref-transaction boundary was built on.

The remaining pieces land separately:

• Verify the full schema contract and harden commit and CLI inputs #28: full schema contract, the GIT_DIR identity fix, commit-spec resolution, --last-commit precedence, and clean CLI errors.
• A follow-up PR: the ref-transaction boundary (approvals used only at the prepared stage, the stuck-update doctor check), rebuilt on docs: state the minimum Git version (2.17) #18's hook and raising the Git minimum to 2.28.

This branch is left in place as the reference for that follow-up.

---

Generated by Claude Code