1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
//! What:
//! Internal native cli-git implementation,
//! not yet the production executable.
//! Why:
//! The Rust rewrite preserves Git's own argument,
//! repository and transaction semantics.
//!
//! In TS you'd write (pseudocode):
//! ```ts
//! // Internal modules used by the forthcoming native entry point and consumer verification.
//! ```
/// The decision one invocation ends in:
/// become Git,
/// or print and exit.
/// Variables added to every real-Git child:
/// lock PID injection and the forward-target marker.
/// The one failure type for rejected configuration content or files.
/// Repository-root discovery and bounded reading of `cli-git.config.jsonc`.
/// Lazy configuration loading for known inspection versus mutation/ambiguous commands.
/// Whole-document JSONC validation into typed settings.
/// Validation of the `policies` section and per-policy options.
/// The `rulesFile` option:
/// a repository-relative name that stays inside the repository.
/// Typed settings and their defaults.
/// Key-naming typed readers over parsed JSONC values.
/// JSONL event rendering for wrapper-made diagnostics.
/// Worktree target classification for worktree-enforcing policies.
/// The per-invocation decision the thin executable performs.
/// Spellings of the wrapper-only escape hatches shared by several modules.
/// Starting real Git with unchanged arguments,
/// streams and exit status.
/// Captured read-only real-Git queries over raw bytes.
/// Git 2.56.0 global-argument boundaries over unchanged operating-system strings.
/// Configuration of the repository one invocation selects.
/// The `git cli-git` decision:
/// help,
/// retired commands,
/// and direct `check`/`fix`.
/// The `git cli-git` argument grammar.
/// The fixed registry of shipped policies.
/// PATH resolution of the real Git executable.
/// Wrapper self-exclusion for one PATH candidate.
/// Disposable fixtures shared by unit tests;
/// never part of the release executable.
/// Repository and worktree identity as reported by real Git.
/// Git 2.56.0 `parse-options` tokenization of one command's argument region.
/// Long-option matching:
/// exact names,
/// unique abbreviations and `no-` negation.
/// Final-state and position questions over a tokenized region.
/// Short-option clusters and their attached or following values.
/// The shared decision of which bytes are an option's value.
/// Real-Git fixtures and table oracles for command tests;
/// never in the release build.
/// Differential harness over `git rev-parse --parseopt`;
/// never in the release build.
/// Table oracle over `--git-completion-helper-all`;
/// never in the release build.
/// Facts about the arguments after `git commit`.
/// The complete Git 2.56.0 option table of `git commit`.
/// The shared result and builder of transforms that add tokens to a command line.
/// Pure core of the index-against-`HEAD` check.
/// Pure decision of the commit-only transform.
/// User-facing diagnostics of the commit-only transform.
/// Pure core of the merge,
/// cherry-pick and revert conclusion check.
/// The Git 2.56.0 option table of `git push` and its facts.
/// The Git 2.56.0 option table of `git status`,
/// its facts and the advice-key reading.
/// Pure decision of the atomic-push transform.
/// Pure decision of the status-hints transform.
/// The Git 2.56.0 option table of `git add` and its bulk-staging facts.
/// The Git 2.56.0 option table of `git clean` and its deletion facts.
/// The Git 2.56.0 option table of `git reset` and its mode.
/// `git stash` subcommand dispatch and wrapper-flag positions.
/// The Git 2.56.0 option tables of every `git stash` subcommand.
/// Branch-creation facts of `git branch`,
/// `git checkout` and `git switch`.
/// Which action a tokenized `git branch` region selects.
/// The complete Git 2.56.0 option table of `git branch`.
/// Explicit creation and the remote-guess candidate of `git checkout` and `git switch`.
/// The complete Git 2.56.0 option tables of `git checkout` and `git switch`.
/// The Git 2.56.0 option groups of `git config`.
/// The form and file scope of a `git config` region.
/// Pure decision of the require-root policy.
/// Whether a `git worktree` invocation creates or moves a worktree.
/// Wrapper-only control spellings,
/// their meanings,
/// and removal before the subcommand.
/// Removal of every wrapper control from one invocation,
/// by position.
/// Lifecycle triggers and the trigger set of every shipped policy.
/// Policy events and their JSON Lines rendering.
/// A pathname as events report it:
/// text,
/// plus base64 `pathBytes` when it is not UTF-8.
/// Ordered policy execution for one lifecycle point.
/// Slice 6: the exact grammar of one policy-proposed Git patch (`commit-transaction-patch.ts`).
/// Slice 6: one policy patch applied to the private index with `git apply --cached --3way`.
/// Slice 6: writes one corrected file into the private commit index as a blob and an index entry.
/// Slice 6: the commit path's bounded policy convergence over the private index.
/// The commit transaction in the incumbent's order, up to the settled policies.
/// The conclusion of a settled commit transaction: preparation, landing and post-landing completion.
/// The landing loop with replay, revalidation and the starvation reservation.
/// The landing lock a landing attempt takes, with the recovery every acquisition runs first.
/// Revalidation of a replayed tree outside both landing locks.
/// The normalization-only transaction for a correction that removed every change.
/// The `git commit` command: the transaction, the settled events, the post-commit gate and the backup.
/// The disposable, recoverable workspace of one commit transaction.
/// Rule facts from the real repository with candidates read from the private index.
/// The worktree completion records of selected corrections and of hook changes.
/// The replay-relevant commit options.
/// Slice 9 skeleton: the order around a landed commit and a guarded Git child; not reachable until landing is merged.
/// The bounded loop that repeats a pass after corrections changed candidate content.
/// The one query for repository identity,
/// top level and the path below it.
/// Lazily fetched repository facts behind one interface,
/// with the real-Git provider.
/// Pure decision of the linked-worktree-only policy.
/// Pure decision of the branch-worktree-only policy and its one-query remote guess.
/// Pure decision of the add-explicit policy.
/// The repository content the dependent-version planner reads, and its two failure kinds.
/// Which paths the dependent-version planner reads: manifests, configuration, source.
/// Strict JSON reading of a manifest's name, version and dependency names.
/// Patch bumps of plain release versions and `JSON.stringify` quoting.
/// The byte-preserving rewrite of a manifest's top-level version.
/// Publishable package names from the generated registry configuration.
/// Whether source text imports a package.
/// The dependency walk and the plan of dependent bumps.
/// Every workspace manifest at both states, and which versions were raised.
/// Which development dependencies each dependent bundles.
/// The dependent-version plan with exact manifest bytes before and after.
/// The decision and findings of `mono/dependent-version-bump`.
/// The dependent-version planner's view of a prepared candidate state.
/// Whether a direct fix may change a tracked file it did not select.
/// The `mono/dependent-version-bump` check over a lifecycle's candidate state.
/// An in-memory workspace that records reads; never in the release build.
/// Differential fixture reading and canonical results; never in the release build.
/// Canonical renderings of the native planner's results; never in the release build.
/// One differential case evaluated by the native planner; never in the release build.
/// The native planner against the incumbent's recorded results; never in the release build.
/// The shipped policies as checks over rule cores and repository facts.
/// What a lifecycle offers content policies,
/// and its candidates once prepared.
/// The built-in final-newline policy:
/// canonical final LF,
/// preserved paths,
/// findings.
/// The optional root-context policy:
/// no top-level `CONTEXT.md` enters the index.
/// The optional forbidden-strings policy over the linked scanner,
/// with redacted findings.
/// One child program run with a time bound and output caps,
/// through files instead of pipes.
/// Where the `markdown/autofix` policy finds `monochromatic-lint`:
/// absolute PATH entries only.
/// What one linter run printed:
/// the fixed source and the findings left,
/// or why it is unusable.
/// The one-rule linter configuration and the private temporary file it is written to.
/// The gitignore-syntax `exclude` patterns of `markdown/autofix`,
/// matched as the linter matches them.
/// The `markdown/autofix` policy over candidates,
/// behind its linter interface.
/// The executable's linter for that policy:
/// `monochromatic-lint` on PATH,
/// bounded,
/// once per candidate.
/// The executable's panic hook:
/// where an internal error happened,
/// never its message.
/// Installing a direct fix's corrections into the worktree,
/// all or none.
/// The direct fix:
/// converge corrections in memory,
/// then install them.
/// The fixed argument transforms of a forwarded command,
/// in order.
/// One complete pass:
/// built-in policies,
/// fixed transforms,
/// optional policies.
/// The names of the commands built into Git 2.56.0.
/// The work of the installed cli-git that is not ported,
/// and the refusal notice.
/// The lifecycle of one wrapped Git command,
/// from refusals to forwarding.
/// A scripted repository-facts provider for unit tests;
/// never in the release build.
/// The one failure type of the candidate layer and its closed list of causes.
/// Validated Git object names and the file modes a candidate can carry.
/// Pure framing of one `git cat-file --batch` reply.
/// Pure parsing of raw NUL-delimited changed-path records.
/// The long-lived object reader that answers every blob read of an invocation.
/// Immutable candidate versions:
/// identity,
/// pathname,
/// mode,
/// change and object per path.
/// Per-invocation listing,
/// lazy bytes and invalidation of candidate versions.
/// Pure parsing of `git ls-files --stage` records and the delta between two index states.
/// The files of a commit's tree with their modes and objects.
/// A private,
/// timestamp-preserving copy of the real index,
/// removed when dropped.
/// What `git add` would stage,
/// and the worktree files a direct command selects.
/// The linked forbidden-strings scanner:
/// one load per invocation,
/// typed redacted findings.
/// Rules-file precedence and which candidates the scanner is given.
/// One scan pass over a candidate version's exact bytes.
/// Which engine failure code each candidate and scanner failure carries.
/// Process isolation and rule fixtures for scanner controls;
/// never in the release build.
/// Private,
/// crash-safe file primitives shared by every durable record.
/// Compact JSON records read and written with the incumbent's `JSON` semantics.
/// Random identifiers in the layout of the incumbent's `randomUUID`.
/// Text operations with the exact semantics of JavaScript's built-ins.
/// Process-birth identities in the incumbent's exact spelling.
/// The owner record inside every owner-lock directory.
/// Rename-published owner locks with dead-owner retirement and an unbounded wait.
/// Line-oriented debug and warning diagnostics on standard error.
/// The fail-closed failure of reading or recovering durable transaction state.
/// The owner record of one commit-transaction directory and its liveness rule.
/// The per-worktree registry of commit-transaction directories.
/// The schema-version-2 journal records of one commit transaction and their filenames.
/// The exact encoding of every journal record.
/// Strict parsers of every journal record.
/// UTC timestamps in the exact form of JavaScript's `toISOString`.
/// The filesystem identity recorded with every real `index.lock` a transaction creates.
/// Running real Git for transaction,
/// recovery and landing work.
/// The preparation and landing leases nested wrapper invocations inherit.
/// The dispatch plan of one commit transaction, its JSON spelling and the config reads it makes.
/// The hooks directory of one transaction: its plan and one entry per preparation event.
/// The hook dispatcher entered by a transaction's hook entry name, under the hook lock.
/// No-follow file operations recovery and landing share.
/// Durable evidence a dead transaction left:
/// attempt records,
/// owned locks and Git's PID file.
/// The reflog search that proves which commit an interrupted transaction landed.
/// Deciding whether a landing landed,
/// and installing its recorded post-index.
/// The `.keep` files protecting a landing's migrated pack.
/// Test-only transaction phase markers, compiled into the release executable and armed only by an environment variable.
/// Landing target comparison, nonce reflog message and compare-and-swap.
/// Migration of a prepared commit's shadow objects into a kept pack of the real store.
/// Post-index a landing installs, computed against the real index at landing.
/// One landing attempt inside the landing critical section, and its outcome.
/// The `concurrent-commit` finding for a landing that landed nothing.
/// Git commands run against a transaction's shadow repository.
/// Native conclusion cleanup reproduced in the owning worktree.
/// The per-worktree capture store:
/// location,
/// sequence and identity.
/// `captured.json`,
/// landed-capture records,
/// their recording and pruning.
/// Replay: the unified-diff parser of subsumption (`replay_patch`).
/// Replay: the exact strict reverse check of subsumption (`replay_reverse_apply`).
/// Replay: the one-sided extension of subsumption over zero-context hunks (`replay_containment`).
/// Replay: raw commit objects as bytes, the unsigned rewrite and signed-rebuild inputs (`replay_object`).
/// Replay: capture order over the landed first-parent history and the per-path decision (`replay_capture_order`).
/// Replay: the starvation reservation of the next landing slot (`replay_reservation`).
/// Replay: the shadow-repository Git runner that every replay step uses (`replay_shadow`).
/// Replay: shared paths of the landed history and the prepared commit, with their three entries (`replay_shared_paths`).
/// Replay: the text half of subsumption over index-named blobs and hunks (`replay_subsumption_text`).
/// Replay: subsumption rules and the synthetic merge base (`replay_subsumption`).
/// Replay: capture-order history and the per-path decisions from the transaction's and landed records (`replay_capture_history`).
/// Replay: the merge tree, the first conflicting landed commit, and the replayed commit rebuild (`replay_merge`).
/// Replay: the replayed index, the shadow HEAD move, and the pre-commit re-run decision of revalidation (`replay_revalidation`).
/// Replay: one replay of a prepared commit onto a moved target, the integrator's replay result (`replay_commit`).
/// The invocation capture:
/// repository layout, symbolic `HEAD`, conclusion kind, ref backend and base.
/// The capture under capture order:
/// the capture lock, the store identity, the sequence and `captured.json`.
/// The shadow repository `config` file and the copied repository format.
/// The shadow repository links to the real shared entries.
/// The shadow ref store: snapshot, private target, symbolic refs and `HEAD`.
/// The shadow conclusion copies at preparation.
/// Argument transforms of native preparation: normalisation, global split, `-a` removal and private arguments.
/// The private commit index: copies, selection modes, pathspec files and listings.
/// Native `git commit` in the shadow, the prepared commit read back and `prepared.json`.
/// Creation of the shadow repository of one transaction.
/// Loading many blobs through one `git cat-file --batch`.
/// Bringing added paths' worktree copies to their landed bytes.
/// Owner inspection of registry entries and the oldest-first order.
/// Recovery of one dead-owner transaction.
/// Disposal of a landed transaction: shadow removal, directory removal, then landed-capture pruning.
/// The post-commit run after a landing: author environment, hook lock, and the hook runner with inherited streams.
/// Post-landing completion of one landed commit: worktree copies, disposal, maintenance, then `post-commit`.
/// Recovery across every transaction directory of one worktree.
/// Startup recovery of interrupted commit transactions.
/// Startup recovery as a step of a wrapped or direct command.
/// Process start times for lock owners,
/// read from `/proc`,
/// `ps` or the Windows process table.
/// The Git version check run once before work that depends on Git's behavior.
/// Processes holding a lock file open,
/// found by device and inode.
/// Parsers of `lsof -F pcDi` records and Restart Manager lines,
/// matched by device and inode.
/// Evidence about a foreign `index.lock` and the verdict it supports.
/// The Git command a forwarded invocation runs,
/// after ordinary alias expansion.
/// Index-writer classification and the commands that coordinate with a landing.
/// Waiting for a foreign index.lock under the classification rules and Git's backoff schedule.
/// The host side effects of the index-lock wait:
/// /proc reads,
/// sleeps,
/// randomness and standard error.
/// The landing location a forwarded index writer coordinates with:
/// the real index and the registry.
/// Coordination of a forwarded index writer:
/// the landing lock,
/// the wait for a foreign lock and the lease.
/// Running a coordinated forwarded index writer:
/// the landing lock held while real Git runs as a child.
/// The real index.lock a landing creates,
/// identifies and releases only while it is the same file.
/// Automatic maintenance decision: config record parsing and the enable and detach rules.
/// Running automatic maintenance after a landing: the config read, then `git maintenance run --auto`.
/// Catching SIGINT, SIGTERM, SIGHUP and SIGQUIT while a Git child runs, and relaying only process-sent signals.
/// Exact removal of retired hk hook registrations from one explicit Git configuration scope.
/// The per-branch push coordination file name: a reversible, flat, case-safe key.
/// The per-branch `last-pushed` record: validation, tolerant reads and atomic publication.
/// Single-flight push coordination per branch: owner lock, record joins and the push itself.
/// Post-commit auto-push of a landed commit: the push argv, the surfaced output and the failure reporting.
/// The post-commit gate over a landed commit: its events, its blocking and the backup it allows.
/// Authoritative manual-push updates discovered by a private dry-run push and confirmed with ls-remote.
/// Published-set and range computation for manual-push scans: which pushed commits a remote does not have.
/// The manual-push candidate scope of one push: the commits and trees the destination lacks.
/// The one failure type of the linked-worktree ignored-state copy and its diagnostics.
/// Which linked worktrees a worktree-creating Git command registered, before and after it ran.
/// The ignored source paths a linked-worktree copy selects, and the path validation every selection passes.
/// The deterministic parent-first manifest of a copy, and the mode application to a staged copy.
/// Exact comparison of manifest entries against the filesystem, and the source stability check after staging.
/// The private, validated stage of one source's ignored state beside a destination worktree.
/// The exclusive creation of one destination entry from the stage, and the identity captured after it.
/// Installation of a validated stage into a new worktree, with preflight, batches and rollback on failure.
/// Removal of the paths a failed installation created, only where their identity and content still prove them cli-git's own.
/// The durable journal of one copy: exact encoding, strict validation, private storage and removal.
/// The append-only install log of one stage: per-batch intents and creations, with resumption.
/// One journaled installation to an end, resumption from the log, and synchronization of a created worktree.
/// The settlement lock that serializes copy installation and recovery, its owner record, and inherited leases.
/// Recovery of interrupted copies: registration checks, discards with notices, resumption, and the pending check.
/// The linked-worktree ignored-state copy around one forwarded Git invocation: the integrator's entry point.
/// Which forwarded invocations the copy applies to, and the child run that carries its settlement lease.