[Deep-Sixed]

4 of 4 restoring ideas from the retired Codex_Kernel repo. This is a draft, stacked on #22. It will be rebased onto main once #10 merges, because #10 rewrites the same gate code. At that point the migration will also be renumbered, since main now has its own 004_approval_authority.sql.

Problem

Claims only coordinate refs/heads/*. Anything else a push creates or moves (a tag, a note, a custom refs/… ref) went through ungoverned unless it was explicitly protected, deleted or force-moved. Codex_Kernel's gate only accepted refs/heads/ updates.

Change

• governed_operation: an update to a ref outside refs/heads/ is a non_branch_ref_update, and needs an approval bound to the exact update. Protected, delete and force operations still take precedence as the operation type.
• quorumgit repo namespace open|close|list <repo> <refs/prefix/> lets a repository open a namespace, for example refs/tags/ for release tooling. Updates there then skip the rule.
  • refs/heads/ can't be opened.
  • Deletes, forced moves and explicitly protected refs inside an open namespace are still governed.
  • Opening and closing are audited.
  • Migration 004_open_ref_namespaces.sql stores the list.
• approve request --push doesn't peel non-branch refs down to a commit. An annotated tag's derived operation therefore names the tag object, which is what the hook sees.
• README: documented the rule, the namespace commands and the annotated-tag usage.

Tests

tests/test_ref_namespaces.py adds 11 tests:

• a lightweight tag push is rejected, then accepted with the exact derived approval;
• an annotated tag derives the tag object's ID and lands once approved;
• a custom namespace is governed;
• open → ungoverned (other namespaces still governed) → closed → governed again;
• an open namespace still governs deletes and protected refs;
• namespace validation (4 cases);
• the audited lifecycle;
• the CLI.

tests/test_authorization_binding.py: the list of migrations expected after 001 now includes 004.

Local results: pytest 165 passed, ruff clean, pyright 0 errors.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Mc44WsAZx9hzZdWEihDk5a

---

Generated by Claude Code

[Deep-Sixed]

Closing as superseded by #23, now on main. Repositories accept only refs/heads/ until an operator allows a namespace with quorumgit repo allow-ref <name> refs/tags/. Protected refs and protected paths still apply inside allowed namespaces.

The one difference: this PR let a push to a non-allowed namespace through with an exact approval, while main refuses it outright. The repository owner chose main's stricter default.

---

Generated by Claude Code