Module git_push 

On-disk layout shared by the git push broker (daemon side) and its agent-side tools (runtime side). Lives here because both mur-agent-runtime and mur-daemon read it and neither may depend on the other.

Two trust zones, kept as separate paths on purpose:

• <mur_home>/git-push/ is broker-owned. The daemon (or mur setup) writes it; no agent sandbox may write it. LaunchChain puts the whole directory in its write-protected set, so on Linux any write grant that overlaps it is dropped whole, on macOS SBPL denies it, and the file tools refuse it. The registry is the reason: an agent that could write it could remap a repo_id to any path and override the human’s enrollment.
• <agent_home>/inbox/git-push* is agent-owned: the agent drops signed requests and cancel markers there; the daemon verifies before acting.

The agent may READ exactly two broker paths — registry_path and its own status_dir — never the whole directory, which also holds broker-private state (pending table, per-request repos).

Constants

CANCEL_DIR

Agent-side cancel markers, relative to the agent home.

ENROLLMENTS_FILE

Human-written enrollment records, the single source of truth. Lives in PRIVATE_DIR; registry.yaml is derived from it.

GIT_PUSH_DIR

Broker-owned directory under <mur_home>.

INBOX_DIR

Agent-side request drop, relative to the agent home.

PRIVATE_DIR

Broker-private state (pending table, per-request repos). No agent grant may reach it.

REGISTRY_FILE

repo_id → sandbox repo path + enrolled remote ids. Daemon writes, agent reads.

STATUS_DIR

Per-agent status files the daemon publishes: status/<agent>/<request_id>.yaml.

Functions

broker_dir

<mur_home>/git-push.

cancel_dir

<agent_home>/inbox/git-push-cancel.

enrollments_path

<mur_home>/git-push/private/enrollments.yaml.

inbox_dir

<agent_home>/inbox/git-push.

private_dir

<mur_home>/git-push/private.

registry_path

<mur_home>/git-push/registry.yaml.

status_dir

<mur_home>/git-push/status/<agent>.