[Deep-Sixed]

Summary

This closes a way to get around claim scopes, found in review and reproduced with real pushes through the hook. An agent whose claim covers docs/** could land src/auth.py on its claimed branch:

1. It pushes the commit straight to its claimed branch: rejected, needs out_of_scope_push.
2. It pushes the same commit to an unclaimed branch, scratch: accepted, because unclaimed branches have no scopes.
3. It pushes its claimed branch again: accepted, because the commit was already on a ref and so counted as nothing new.

The cause is that changed_paths treated every commit reachable from any existing ref as already governed, and one path list was used for two different checks.

Changes

• git_objects.mainline_tips (new): the commits the hub's default branch (HEAD) and the protected refs point to. A missing ref is skipped, which only makes the check stricter.
• gate.governed_operations now takes two path lists:
  • paths, measured against every ref as before, is used for protected paths. That baseline is sound because protected paths are checked on every push to every ref.
  • scope_paths, measured against the branch's previous value plus the mainline, is used for claim scopes. Merging main in still isn't charged to the claim. Merging another agent's branch, or first pushing to an unclaimed branch, now is. Counting another agent's branch against your claim was a deliberate choice.
• prepare_push computes both lists the same way the hook does, so approve prepare still produces the hash the hook asks for. The existing check that the clone has every hub tip covers the mainline tips too.
• README: "Changed paths" explains the two baselines. The threat-model line that described the old bypass as a limitation is replaced with the real remaining one: if the default branch isn't protected, changes pushed straight to it are never checked against a claim.

Integration with the reference-transaction hook (#30)

After main gained the two-phase push check (pre-receive records each update in ref_updates; the reference-transaction hook re-validates it at prepared), scope_paths has to be replayed like paths so operation hashes stay stable between the two phases:

• Migration 007_ref_update_scope_paths.sql adds a nullable ref_updates.scope_paths JSON array.
• pre-receive records scope_paths, and prepared re-validates with both recorded lists. A NULL (a row validated before the migration) is recomputed.
• test_prepared_uses_the_paths_pre_receive_derived covers scope_paths too, and the migration-list tests include 006 and 007.

Tests

• New: test_staging_work_on_another_branch_does_not_escape_the_claim. The staged commit is rejected, and approve prepare gives the same hash as the hook.
• New: test_new_claimed_branch_is_measured_from_the_default_branch. With no protected refs, a new claimed branch is charged only for its own commits.
• Changed: test_hook_holds_claimed_branch_to_its_scopes now expects that merging another agent's unprotected branch needs out_of_scope_push.
• With the src/ change reverted, the first and third tests fail. The default-branch test passes either way; it guards against the fix being too strict.

Validation

• pytest tests -q: 231 passed (after merging main).
• pyright: 0 errors.
• ruff check (the pinned 0.16.9): clean.

🤖 Generated with Claude Code

https://claude.ai/code/session_014R4wfmENrMnt36KN1Kj6Fx
https://claude.ai/code/session_01Q8BpCkArA34hB1aSyVcnZp