Read env's Directory and Environment Options in the Write Guard - #3722

…rite Guard (#3727)

## Summary

Fixes a finding raised on promotion #3715. GNU `env` accepts a unique
abbreviation of a long option, so a constructed `env --ch=/srv/other
GIT_DIR=.git git push origin main` runs git in `/srv/other`. The write
guard read `--ch` as a no-op and resolved the push's repository from the
working directory.

- An `env` option the guard does not recognize, long or short, now
leaves the directory a push runs in unnamed for requirement 4.
`_push_repo` and the bare-push branch reader take `None` in place of the
working directory, the value `env -C "$D"` already produces, so
requirement 4 fails closed only for `main`, `master`, and `develop`, as
#3709 and #3722 treat a shape they cannot resolve. An absolute
`--git-dir`, git's own `-C`, or an absolute `cd` in a wrapper body still
names the repository. A `GIT_DIR` behind such an option is not read for
the repository, since the option may abbreviate `--unset`. Prefix
matching was decided against.
- Each unrecognized option may or may not take the next word, and a
value it takes may be an `-S` string, which reaches an abbreviated
`--split-string`. `_launches` reads every combination of up to four of
those choices. A reading past the first adds commands only and changes
no shell state, and a subshell restores the body's undetermined state
with its directory.
- A push naming no refspec or `HEAD` behind such an option, whose branch
nothing else names, reads it as if the option were absent. So it is
never weaker than before and never newly blocks a feature-branch push.
- `--null`, `--debug`, and the GNU signal options are now listed, so
they keep reading as no-ops. `-0`, `-v`, `-i` and the value letters keep
their behavior.
- Requirement 6 keeps judging the working directory. The extra readings
can only add a deny there, for example `env --chd /path/wt git commit`
run from a primary checkout.
- `host-setup/agent-safety/README.md` states the new reading in its
lexer paragraph, in requirement 4, and in requirement 6.

## Verification

- Reproduced first with `classify` on two constructed scratch checkouts,
origins `alpha/x` and `beta/y`, with a stubbed live-rules lookup
requiring a pull request on `beta/y`'s `main`. Before the fix
`--ch=<b>`, `--chd <b>`, and `-X <b>` pushes to `main` were allowed.
After it they are denied, and feature-branch pushes stay allowed.
- New self-test cases cover `--ch=<dir>`, `--chd <dir>`, an unknown
short letter, two unrecognized options of different arity, an
abbreviated split string, an unknown option ahead of `sh -c`, a subshell
in the body, absolute `-C`/`--git-dir`/body `cd` re-anchoring, a URL
remote, bare and `HEAD` pushes, `GH_REPO` not leaking from a speculative
reading, each recognized option unchanged, and allow on `feature/x`.
Each new repository and branch row fails with its fix reverted.
- `gh-write-guard.py --selftest` passes. Pinned ruff format and check,
mypy, `tests/test_guard_size.py`, and the prose gate pass.
- Seven local strict-review passes, the last raising nothing.

## Dropped findings

- `gh-write-guard.py` `_env_option`, `style`: reading an unknown short
letter as unrecognized was named as over-hardening. The decided fix for
#3725 names short options explicitly.

## Pre-existing findings, not filed

- `gh-write-guard.py` `_bare_push_branch`, `pre-existing`: its
`leading_cd` and `moved` parameters answer no caller, since every caller
passes `None` and `False`. One caller is in
`host-setup/agent-safety/claude/test_install.py`, outside this change.

Closes on promotion: #3725

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

…d Unread Moves Whole, and Name uv's No-Cache Setting (#3715)

Promotes the changes merged into `develop` since promotion #3703 to
`main`, the third round of a backlog burndown.

- [#3709](#3709) Reads a
push's remote, and the branch of a push with no refspec, in the
repository git actually uses in the write guard's owner check
(requirement 4). Before, `--git-dir` and a `GIT_DIR` on the push were
ignored, so a constructed `git --git-dir=<other>/.git push origin
develop` was checked against the working directory's repository rules
and allowed. A shape whose repository the guard cannot determine (an
earlier `GIT_DIR`, a `-c` or `--config-env` override of a `remote.` or
`url.` key, any `GIT_CONFIG*` variable, an unresolvable `--git-dir`) now
blocks `main`, `master` and `develop`. The self-test covers each shape
and `host-setup/agent-safety/README.md` states the requirement.
- [#3712](#3712) Reads a
file moved out of a source some rule never read in full for that rule in
the prose gate: a narrowed directory scope, a `home_path_exempt` file,
instruction text for `issue-ref`, and a move that changes the file's
lexer. Skips YAML block scalars when reading a Compose file's volume
entries.
- [#3707](#3707) Names
uv's no-cache setting, and its remedies, when the repo gate's resolved
PyYAML interpreter is gone at launch, rather than reporting a bare
missing-file error.
- [#3708](#3708) Moves the
section-name lookup key into one `section_key()` in
`spec/fidelity_text.py`, used by the carry, the audit, the skill build
and the review ledger, with no behavior change.

- [#3722](#3722) Applies
`env`'s directory and environment options to the command the write guard
judges, answering this promotion's first review round: `env
-C`/`--chdir` move the repository a relative `GIT_DIR` and the remote
resolve in, `env -i`/`-u` clear a `GIT_DIR` that no longer steers the
check, and `env -S` is read rather than skipped. A run-time directory
reads as undetermined, which blocks `main`, `master` and `develop`.
- [#3721](#3721) Finds a
Compose block-scalar opener through the YAML lexer the gate already uses
rather than a hand-written pattern, so a key holding `#`, quoted or not,
opens the opaque region. Also answers this promotion's first review
round.

- [#3727](#3727) Reads an
`env` option the write guard does not recognize, such as GNU `env`'s
`--ch` abbreviation of `--chdir`, as leaving the push's repository
undetermined, so `main`, `master` and `develop` fail closed, answering
this promotion's second review round. A feature-branch push is never
newly blocked.

- [#3731](#3731) Removes
the fallback #3727 kept for a push naming no refspec behind an
unrecognized `env` option, answering this promotion's third review
round. Such a push resolves its branch only through an absolute
`--git-dir`, git's own `-C`, or a `cd` in a wrapper body, and is
otherwise read as writing every protected default, so it fails closed
even from a feature branch.

Deferred review findings: #3705 (`scripts/README.md`'s uvx promise),
#3706 (`validate.py`'s exact section-name match), #3710 (whether
`section_key` should casefold), #3711 (Compose-name and directory moves
in the prose gate), #3713 (the review reader's `open review findings:`
spelling), #3714 (an edited shebang that changes a file's lexer), #3720
(the write guard's reading of `git push -o<value>`), #3723 (unused
`_bare_push_branch` parameters), #3729 (a bare push after a branch
switch earlier in the same command), #3732 (the review reader's `Review
findings remain:` spelling).

For the maintainer: #3730 asks whether every bare push whose repository
the guard cannot determine should fail closed, as #3731 now does behind
an unrecognized `env` option.

Fixes #3695
Fixes #3684
Fixes #3694
Fixes #2358
Fixes #3686
Fixes #3716
Fixes #3717
Fixes #3725
Fixes #3728

🤖 Generated with [Claude Code](https://claude.com/claude-code)