[Deep-Sixed]

Summary

PR #9 carries forward the strongest Codex_Kernel enforcement idea without copying its implementation: bind governance to the exact incoming Git ref mutation, reserve that mutation while Git is in flight, and finalize authorization only after Git reports the ref update succeeded.

Protocol

pre-receive now:

1. validates registered pusher, repository binding, claims/handoffs, and any exact protected-operation approval;
2. creates/renews a durable reservation for (repository, refname, oldrev, newrev, agent, approval instance);
3. does not consume the approval;
4. commits the reservation before allowing Git to continue.

post-receive now:

1. verifies the resulting Git ref actually equals the reserved newrev (or is absent for deletion);
2. finds the exact reservation for the same registered pusher;
3. consumes any bound approval instance;
4. marks the mutation completed and audits completion in the same libSQL transaction.

Aborted receives leave the approval approved. An identical retry by the same agent/approval renews the reservation. Reservations are bounded leases so a receive that exits before completion cannot freeze governance permanently.

Governance freeze

Migration 003_git_mutations.sql adds engine-level triggers that block claim acquisition, claim release/renewal, and handoff creation/resolution on a branch while a non-expired Git mutation reservation is active. This closes the reviewed window where ownership could change after pre-receive validation but before Git committed the ref.

Hook installation

quorumgit hook install now installs both the existing hardened pre-receive gate and a post-receive completion hook. Existing unrelated post-receive hooks are preserved and installation fails closed rather than overwriting or silently chaining them.

Regression coverage

New real-Git tests cover:

• successful protected push -> reservation completed + approval consumed;
• downstream update hook rejection -> ref unchanged + approval remains approved;
• retry of the exact rejected mutation -> same reservation reused and completed;
• in-flight branch reservation -> claim release blocked until completion;
• unrelated existing post-receive hook -> preserved and installation refused before touching pre-receive.

Scope boundary

PR #10 will enrich the exact mutation with changed paths/digests derived from incoming Git objects and enforce active claim scopes against those paths. PR #9 intentionally establishes the mutation lifecycle first.

Merge only after the full five-leg CI matrix passes.

[Deep-Sixed]

Closing this in favour of #10, which fixes the same timing gap differently.

This PR uses up the approval in post-receive. By the time that hook runs, Git has already moved the ref. If recording the outcome fails at that point, the protected change has landed and nothing can undo it.

#10 checks the push again and uses up the approval in Git's reference-transaction hook, at the prepared stage. Git has locked the refs by then but can still cancel the update, so any failure stops the push. If Git cancels after that point, the approval becomes usable again. #10 also covers the enforcement of claim scopes on pushed files that this PR had planned as a follow-up.

The branch is left in place in case anything here is worth salvaging.

---

Generated by Claude Code