coulomb/the-custodian
5
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

Install generated-commit guard safely and record verified checkpoint
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Reject generated-only commits / generated-commit-guard (push) Successful in 7s
Details

Browse source
This commit is contained in:
codex 2026-10-11 21:31:50 +02:00
parent 6fe7201fd5
commit d377b5f30c
3 changed files with 18 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

9
Makefile
View file

@ -1,6 +1,6 @@
# the-custodian top-level Makefile
.PHONY: security-flow-daily security-flow-check generated-commit-check
.PHONY: security-flow-daily security-flow-check generated-commit-check generated-commit-hook
security-flow-daily: ## Sync resolved decisions and notify changed actionable work
python3 scripts/security_flow_daily.py --apply
@ -9,6 +9,13 @@ security-flow-check: ## Run the deterministic security flow and generated commit
generated-commit-check: ## Reject staged generated-only changes
python3 scripts/check_generated_only_commit.py --staged
generated-commit-hook: ## Install the local guard without replacing another hook
@hook="$$(git rev-parse --git-path hooks/pre-commit)"; \
if test -e "$$hook" && ! cmp -s scripts/generated-pre-commit.sh "$$hook"; then \
echo "Existing pre-commit hook differs; integrate the guard before replacing it." >&2; exit 1; \
fi; \
install -m 755 scripts/generated-pre-commit.sh "$$hook"
#
# Custodian agent SSH identity
# ----------------------------

4
WORK-RECORDS.md
View file

@ -498,11 +498,11 @@
| task | CUST-WP-0078-T04 | done | — | workplans/CUST-WP-0078-security-collaboration-consolidation.md |
| task | CUST-WP-0079-T01 | done | — | workplans/CUST-WP-0079-deterministic-security-flow.md |
| task | CUST-WP-0079-T02 | done | — | workplans/CUST-WP-0079-deterministic-security-flow.md |
| task | CUST-WP-0079-T03 | progress | — | workplans/CUST-WP-0079-deterministic-security-flow.md |
| task | CUST-WP-0079-T03 | wait | — | workplans/CUST-WP-0079-deterministic-security-flow.md |
| task | CUST-WP-0079-T04 | wait | — | workplans/CUST-WP-0079-deterministic-security-flow.md |
| task | CUST-WP-0079-T05 | progress | — | workplans/CUST-WP-0079-deterministic-security-flow.md |
| task | CUST-WP-0079-T06 | wait | — | workplans/CUST-WP-0079-deterministic-security-flow.md |
| task | CUST-WP-0079-T07 | todo | — | workplans/CUST-WP-0079-deterministic-security-flow.md |
| task | CUST-WP-0079-T07 | done | — | workplans/CUST-WP-0079-deterministic-security-flow.md |
| task | THE-WP-0001-T01 | done | — | workplans/THE-WP-0001-federation-interface.md |
| task | THE-WP-0001-T02 | done | — | workplans/THE-WP-0001-federation-interface.md |
| intake | CUST-IN-0001 | closed | green | intake-legacy-suggestions-migration.md |

8
workplans/CUST-WP-0079-deterministic-security-flow.md
View file

@ -118,6 +118,14 @@ generated-only commit. `make generated-commit-check` provides the local hook ent
The CI suite covers the rejection using a real temporary git repository. Consumer generator
adoption and the required week of clean logs remain open; this task is not claimed complete.
The local guard is installed; `make generated-commit-hook` reproduces that
installation and refuses to replace a different hook. The consistency CLI has
no no-commit/no-push mode: its first invocation unexpectedly published brief-only
`ebaa38b`, retained as a failed acceptance observation. Its subsequent invocation
committed the already reviewed, staged implementation as `6fe7201`; that commit
includes source code. Future generated-only commits are rejected locally and in
CI. The full Custodian suite passes 77 tests.
## Attended window #1
```task