[Deep-Sixed]

A protected path covers a whole file. A protected field covers one value inside matching JSON or TOML files. This is the "structured rules" follow-up to protected paths, and the general version of Codex_Kernel's PROTECTED_JSON_FIELDS. A push needs a protected_field_update approval only when it changes that value. Other edits to the same file are ordinary content.

quorumgit repo protect-field myproject config/state.json /max_depth --agent lead
quorumgit repo protect-field myproject 'services/*/settings.toml' /limits/replicas --agent lead
quorumgit repo protect-field myproject config/state /schema_version --format json --agent lead

What changes

• structured.py works out field changes from Git objects alone:
  • It looks at each commit that is new to the repository, using the same set of already-known commits as protected paths.
  • A commit changes a value when the value differs from its value in every parent. So a clean merge changes nothing of its own, and a change that is reverted later in the same push still counts.
  • Values are compared as canonical JSON. 1, 1.0 and true count as different; reordered object keys don't.
  • A value appearing or disappearing is a change.
  • Unparseable content counts as a change, and so do file names that can't be read back (not valid UTF-8). Rules fail closed.
  • Values are named by a JSON Pointer (RFC 6901), including ~0/~1 escapes and array indices. '' means the whole document.
• Migration 012_protected_fields.sql:
  • Adds a protected_fields table.
  • Adds ref_updates.field_changes. The reference-transaction prepared stage replays the field changes pre-receive recorded, the same way it replays paths and scope_paths, so the operation hashes don't shift. Rows validated before the migration have NULL there and are recomputed.
• Gate: adds the protected_field_update operation, with fields shown as path#pointer in rejection messages. approve prepare works out field changes from the clone using the same code and reports them.
• Registry and CLI:
  • repo protect-field <repo> <glob> <pointer> [--format json|toml] [--remove] is operator-only and audited. The format comes from the glob's extension unless --format is given.
  • repo policy lists the rules.
  • protected_field_update is a new operation type, so it can have its own per-operation policy (for example, two votes).
• README: docs, a command-reference row, and an upgrade note. The migration adds no rules, so nothing changes until an operator adds one.

Testing

• New tests/test_protected_fields.py (11 tests):
  • pointer validation and resolution
  • only the protected value counts, and a value changed then reverted within a push still counts
  • comparison by type and value
  • values appearing, disappearing, or unparseable (including on both sides)
  • non-UTF-8 file names fail closed (Linux only)
  • globs and TOML
  • clean merges
  • operator-only and validated registration
  • a real push rejected, prepare's hash matching the hook's, approved, pushed, and consumed; other edits to the file need nothing, and changing the value again needs a new approval
  • a per-operation threshold of 2 applying to field updates
  • the CLI
• Updated the migration-list assertions for 010.
• pytest: 273 passed. ruff check and pyright are clean.

🤖 Generated with Claude Code

https://claude.ai/code/session_0142xh1CDDPxBvB1EHu6PN3m

---

Generated by Claude Code

Integration after review fixes

Merged current main through #32, #34, and #35 into this branch without rebasing or rewriting history.

• Protected-fields migration is now 012_protected_fields.sql, after merged 010_protected_ref_names.sql and 011_quorum_consumer_separation.sql.
• Protected-field Git-object derivation is performed before the SQLite writer reservation, preserving Fix protected-ref enforcement, push locking, and policy composition #32's large-push concurrency invariant.
• Protected-field operations compose with the ref/force/delete policy fixes from Compose ref policies and preserve quorum executor separation #35.
• Local validation on Friday (Python 3.14.5): 295 passed, Ruff clean, Pyright 0 errors.

The integration review also caught and fixed the replay case where a validation has pre-derived paths but no stored field-change list (for example, an update validated before the protected-fields migration). A regression test now covers recomputing only the missing field changes without re-deriving or referencing absent path variables.