claude-dev-env 2.13.0 → 2.14.0

package/hooks/diagnostic/queries/AGENTS.md

@@ -0,0 +1,19 @@
+# hooks/diagnostic/queries
+
+Parameterized SQL queries for inspecting the `hook_events` Neon table. Run these directly against the Neon database to analyze hook-firing patterns.
+
+## Files
+
+| File | What it returns |
+|---|---|
+| `block_details_for_hook.sql` | Full details for all blocked events matching a given hook name |
+| `blocks_by_category.sql` | Count of blocks grouped by hook category |
+| `blocks_by_tool.sql` | Count of blocks grouped by tool name |
+| `blocks_last_7_days.sql` | All blocked events from the last 7 days |
+| `top_blockers_last_24_hours.sql` | Hook names with the most blocks in the last 24 hours |
+| `top_blockers_overall.sql` | Hook names with the most blocks across all time |
+
+## Conventions
+
+- Queries target the `hook_events` table and `blocked_commands` view defined in `diagnostic/schema.sql`.
+- Run with `psql $DATABASE_URL -f <query>.sql` or paste into the Neon console.

package/hooks/diagnostic/queries/CLAUDE.md

@@ -1,19 +1 @@
-# hooks/diagnostic/queries
-
-Parameterized SQL queries for inspecting the `hook_events` Neon table. Run these directly against the Neon database to analyze hook-firing patterns.
-
-## Files
-
-| File | What it returns |
-|---|---|
-| `block_details_for_hook.sql` | Full details for all blocked events matching a given hook name |
-| `blocks_by_category.sql` | Count of blocks grouped by hook category |
-| `blocks_by_tool.sql` | Count of blocks grouped by tool name |
-| `blocks_last_7_days.sql` | All blocked events from the last 7 days |
-| `top_blockers_last_24_hours.sql` | Hook names with the most blocks in the last 24 hours |
-| `top_blockers_overall.sql` | Hook names with the most blocks across all time |
-
-## Conventions
-
-- Queries target the `hook_events` table and `blocked_commands` view defined in `diagnostic/schema.sql`.
-- Run with `psql $DATABASE_URL -f <query>.sql` or paste into the Neon console.
+@AGENTS.md

package/hooks/diagnostic/test_hook_log_extractor.py

@@ -617,7 +617,7 @@ def test_tool_name_extracted_from_hook_name_prefix() -> None:
     assert hook_log_extractor.extract_tool_name("UserPromptSubmit") is None
 
 
-def test_run_summary_prints_no_new_blocks_when_cursor_empty(
+def test_run_summary_prints_zero_blocked_events_when_cursor_empty(
     capsys: pytest.CaptureFixture[str],
 ) -> None:
     fake_cursor = MagicMock()
@@ -632,7 +632,7 @@ def test_run_summary_prints_no_new_blocks_when_cursor_empty(
 
     captured = capsys.readouterr()
     assert exit_code == 0
-    assert "No new blocks since last run." in captured.out
+    assert "Blocked events recorded in the last 24 hours: 0." in captured.out
 
 
 def test_run_summary_prints_table_when_rows_returned(

package/hooks/git-hooks/AGENTS.md

@@ -0,0 +1,31 @@
+# hooks/git-hooks
+
+Native git hooks that run outside the Claude Code lifecycle — invoked directly by git at commit and push time. The installer copies these scripts into the user's shared git-hooks directory (`core.hooksPath`).
+
+## Key files
+
+| File | Git hook | What it does |
+|---|---|---|
+| `pre_commit.py` | `pre-commit` | Runs the CODE_RULES gate (`precommit_code_rules_gate.py`) over staged changes; exits 1 when any staged file has a blocking violation |
+| `pre_push.py` | `pre-push` | Blocks a push that would land a non-`main` local branch onto remote `main` (or `master`), then runs the CODE_RULES gate. An existing branch's gate base is the merge base with the remote default branch; the gate process still diffs that base against checkout HEAD, so the surface matches the pushed tip only when HEAD is that tip. |
+| `pre_push_base_reference.py` | — | Resolves a usable gate base for `pre_push.py`: reads the pushed remote name from git's arguments, then turns a symbolic default-branch head into a reference that git can resolve |
+| `post_commit.py` | `post-commit` | Runs after a commit lands; performs any post-commit bookkeeping |
+| `gate_utils.py` | — | Shared helpers: resolves the gate script path, checks that the path is a safe regular file |
+| `test_config.py` | — | Test configuration helpers |
+| `test_gate_utils.py` | — | Tests for `gate_utils.py` |
+| `test_pre_commit.py` | — | Tests for `pre_commit.py` |
+| `test_pre_push.py` | — | Tests for `pre_push.py` |
+| `test_pre_push_base_reference.py` | — | Tests for the gate base resolution in `pre_push.py` |
+| `conftest.py` | — | Puts this directory on `sys.path` and clears cached `config` modules, so each test module imports the hooks at the top of the file |
+
+## Subdirectory
+
+| Directory | Role |
+|---|---|
+| `git_hooks_constants/` | Shared constants imported by the git-hook scripts |
+
+## Conventions
+
+- The installer strips the `_` and `.py` suffix when copying into the live git-hooks path (e.g. `pre_commit.py` becomes `pre-commit`).
+- Constants (exit codes, argument names, error messages) live in `git_hooks_constants/` and are imported at the top of each script.
+- Run tests with `python -m pytest git-hooks/test_<name>.py`.

package/hooks/git-hooks/CLAUDE.md

@@ -1,31 +1 @@
-# hooks/git-hooks
-
-Native git hooks that run outside the Claude Code lifecycle — invoked directly by git at commit and push time. The installer copies these scripts into the user's shared git-hooks directory (`core.hooksPath`).
-
-## Key files
-
-| File | Git hook | What it does |
-|---|---|---|
-| `pre_commit.py` | `pre-commit` | Runs the CODE_RULES gate (`precommit_code_rules_gate.py`) over staged changes; exits 1 when any staged file has a blocking violation |
-| `pre_push.py` | `pre-push` | Blocks a push that would land a non-`main` local branch onto remote `main` (or `master`), then runs the CODE_RULES gate. An existing branch's gate base is the merge base with the remote default branch; the gate process still diffs that base against checkout HEAD, so the surface matches the pushed tip only when HEAD is that tip. |
-| `pre_push_base_reference.py` | — | Resolves a usable gate base for `pre_push.py`: reads the pushed remote name from git's arguments, then turns a symbolic default-branch head into a reference that git can resolve |
-| `post_commit.py` | `post-commit` | Runs after a commit lands; performs any post-commit bookkeeping |
-| `gate_utils.py` | — | Shared helpers: resolves the gate script path, checks that the path is a safe regular file |
-| `test_config.py` | — | Test configuration helpers |
-| `test_gate_utils.py` | — | Tests for `gate_utils.py` |
-| `test_pre_commit.py` | — | Tests for `pre_commit.py` |
-| `test_pre_push.py` | — | Tests for `pre_push.py` |
-| `test_pre_push_base_reference.py` | — | Tests for the gate base resolution in `pre_push.py` |
-| `conftest.py` | — | Puts this directory on `sys.path` and clears cached `config` modules, so each test module imports the hooks at the top of the file |
-
-## Subdirectory
-
-| Directory | Role |
-|---|---|
-| `git_hooks_constants/` | Shared constants imported by the git-hook scripts |
-
-## Conventions
-
-- The installer strips the `_` and `.py` suffix when copying into the live git-hooks path (e.g. `pre_commit.py` becomes `pre-commit`).
-- Constants (exit codes, argument names, error messages) live in `git_hooks_constants/` and are imported at the top of each script.
-- Run tests with `python -m pytest git-hooks/test_<name>.py`.
+@AGENTS.md

package/hooks/git-hooks/git_hooks_constants/AGENTS.md

@@ -0,0 +1,21 @@
+# hooks/git-hooks/git_hooks_constants
+
+Shared constants imported by the git-hook scripts in `git-hooks/`. Centralizes exit codes, argument names, and error messages so every tunable lives in one place.
+
+## Files
+
+| File | Contents |
+|---|---|
+| `__init__.py` | Exports all constants; marks this as a package so `from git_hooks_constants import ...` resolves |
+
+## Key constants (defined in `__init__.py`)
+
+- `GATE_INFRASTRUCTURE_FAILURE_EXIT_CODE` — exit code when the gate script cannot be found or launched
+- `GATE_SCRIPT_NOT_FOUND_MESSAGE` — error message when the gate script path does not exist
+- `INVOKE_GATE_FAILURE_MESSAGE` — error message when the gate subprocess fails to start
+- `STAGED_SCOPE_ARGUMENT` — CLI argument passed to the gate script to scope it to staged changes
+
+## Conventions
+
+- Import with `from git_hooks_constants import <CONSTANT>` from within the `git-hooks/` directory.
+- Add new constants here rather than inline in the hook scripts.

package/hooks/git-hooks/git_hooks_constants/CLAUDE.md

@@ -1,21 +1 @@
-# hooks/git-hooks/git_hooks_constants
-
-Shared constants imported by the git-hook scripts in `git-hooks/`. Centralizes exit codes, argument names, and error messages so every tunable lives in one place.
-
-## Files
-
-| File | Contents |
-|---|---|
-| `__init__.py` | Exports all constants; marks this as a package so `from git_hooks_constants import ...` resolves |
-
-## Key constants (defined in `__init__.py`)
-
-- `GATE_INFRASTRUCTURE_FAILURE_EXIT_CODE` — exit code when the gate script cannot be found or launched
-- `GATE_SCRIPT_NOT_FOUND_MESSAGE` — error message when the gate script path does not exist
-- `INVOKE_GATE_FAILURE_MESSAGE` — error message when the gate subprocess fails to start
-- `STAGED_SCOPE_ARGUMENT` — CLI argument passed to the gate script to scope it to staged changes
-
-## Conventions
-
-- Import with `from git_hooks_constants import <CONSTANT>` from within the `git-hooks/` directory.
-- Add new constants here rather than inline in the hook scripts.
+@AGENTS.md

package/hooks/git-hooks/git_hooks_constants/__init__.py

@@ -49,12 +49,9 @@ NO_PARSEABLE_STDIN_LINES_MESSAGE: str = (
 NO_PARSEABLE_STDIN_LINES_SENTINEL: str = "__no_parseable_stdin_lines__"
 UNRESOLVABLE_MERGE_BASE_SENTINEL: str = "__unresolvable_merge_base__"
 UNRESOLVABLE_MERGE_BASE_MESSAGE: str = (
-    "claude-dev-env pre-push: git found no merge base between the pushed object "
-    "and the default branch, so the gate scope is unknown and "
-    "enforcement is skipped. That happens when the pushed branch and the "
-    "default branch hold unrelated histories, or when a default-branch ref "
-    "resolved and merge-base still could not name a shared commit "
-    "(for example a shallow clone missing the connecting history)."
+    "claude-dev-env pre-push: CODE_RULES validation is pending because the pushed "
+    "object and default branch have no shared merge base. Restore shared history "
+    "or provide a reachable default branch, then run the push again."
 )
 LOCAL_BRANCH_REFERENCE_PREFIX: str = "refs/heads/"
 ORIGIN_HEAD_SYMBOLIC_REFERENCE: str = "refs/remotes/origin/HEAD"
@@ -63,6 +60,7 @@ ALL_DEFAULT_BRANCH_FALLBACK_REFERENCES: tuple[str, ...] = (
     "refs/remotes/origin/main",
     "refs/remotes/origin/master",
 )
+REMOTE_BRANCH_REFERENCE_TEMPLATE: str = "refs/remotes/{remote}/{branch}"
 ALL_GIT_SYMBOLIC_REFERENCE_COMMAND_PREFIX: tuple[str, ...] = (
     "git",
     "symbolic-ref",

package/hooks/git-hooks/pre_push.py

@@ -22,9 +22,8 @@ object name is the base when no default-branch ref resolves and when the
 pushed branch is the default branch. When every remote object name is zero
 (new branch) or stdin is empty, the gate falls back to the remote's default
 branch symbolic ref. When a default-branch ref resolves and git still reports
-no merge base, the base is unknown, so CODE_RULES enforcement is skipped with
-a printed reason rather than scoped to the stdin remote object name, which on
-a rebased tip would re-flag replayed commits.
+no merge base, the base stays pending and the hook reports the infrastructure
+status with a printed reason, preserving the scope boundary for rebased tips.
 
 Gate scope: the gate process this hook launches diffs its `--base` against the
 current checkout's HEAD, so the surface is the commits between that base and
@@ -32,14 +31,13 @@ HEAD. A push whose pushed object is HEAD reads as the branch's own work; a
 push of any other object is still scoped to HEAD.
 
 Exit codes:
-  0 - the push destination is allowed and its commits pass the gate (or
-      the gate is not installed, or CODE_RULES is skipped because a
-      default-branch ref resolved and git still reported no merge base).
+  0 - the push destination is allowed and its commits pass the gate, or the
+      gate is not installed.
   1 - the push would land a non-protected local branch onto a protected
       remote branch, or a commit introduces a blocking violation.
-  2 - unexpected invocation failure (e.g., subprocess could not launch),
-      stdin carried no parseable line, or a new-branch/empty-stdin base
-      could not be turned into a usable commit name.
+  2 - infrastructure attention is required because a subprocess could not
+      launch, stdin carried no parseable line, a base could not be resolved,
+      or a usable commit name could not be produced.
 """
 
 from __future__ import annotations
@@ -49,8 +47,9 @@ import sys
 from pathlib import Path
 from typing import NamedTuple
 
+from gate_utils import is_safe_regular_file, resolve_gate_script_path
 from git_hooks_constants import (
-    ALL_DEFAULT_BRANCH_FALLBACK_REFERENCES,
+    ALL_FALLBACK_REMOTE_DEFAULT_BRANCH_NAMES,
     ALL_GIT_MERGE_BASE_COMMAND_PREFIX,
     ALL_GIT_SYMBOLIC_REFERENCE_COMMAND_PREFIX,
     ALL_GIT_VERIFY_REFERENCE_COMMAND_PREFIX,
@@ -58,6 +57,7 @@ from git_hooks_constants import (
     ALL_ZEROS_OBJECT_NAME_CHARACTER,
     BASE_REFERENCE_ARGUMENT,
     DEFAULT_REMOTE_BASE_REFERENCE,
+    DEFAULT_REMOTE_NAME,
     GATE_INFRASTRUCTURE_FAILURE_EXIT_CODE,
     GIT_COMMAND_TIMEOUT_SECONDS,
     GIT_COMMAND_UNAVAILABLE_MESSAGE,
@@ -72,11 +72,10 @@ from git_hooks_constants import (
     MALFORMED_STDIN_LINE_MESSAGE,
     NO_PARSEABLE_STDIN_LINES_MESSAGE,
     NO_PARSEABLE_STDIN_LINES_SENTINEL,
-    ORIGIN_HEAD_SYMBOLIC_REFERENCE,
-    ORIGIN_REMOTE_TRACKING_REFERENCE_PREFIX,
     PRE_PUSH_GATE_SCRIPT_NOT_FOUND_MESSAGE,
     PROTECTED_BRANCH_PUSH_BLOCK_EXIT_CODE,
     PROTECTED_BRANCH_PUSH_BLOCK_MESSAGE,
+    REMOTE_BRANCH_REFERENCE_TEMPLATE,
     REMOTE_REFERENCE_FIELD_INDEX,
     STDIN_LINE_FIELD_COUNT,
     STDIN_READ_FAILURE_MESSAGE,
@@ -84,7 +83,6 @@ from git_hooks_constants import (
     UNRESOLVABLE_MERGE_BASE_MESSAGE,
     UNRESOLVABLE_MERGE_BASE_SENTINEL,
 )
-from gate_utils import is_safe_regular_file, resolve_gate_script_path
 from pre_push_base_reference import (
     resolve_remote_name_from_arguments,
     resolve_usable_base_reference,
@@ -294,24 +292,24 @@ def run_git_reference_query(all_git_arguments: tuple[str, ...]) -> str | None:
     return decoded_output.strip() or None
 
 
-def resolve_default_branch_reference() -> str | None:
+def resolve_default_branch_reference(remote_name: str = DEFAULT_REMOTE_NAME) -> str | None:
     """Return the remote-tracking ref name of the remote's default branch.
 
-    The remote's HEAD symbolic ref answers first. When it is unset, each
-    candidate default-branch remote-tracking ref answers in turn.
+    The remote's HEAD symbolic ref answers first. When it is unset, the
+    supported default-branch tracking refs answer in turn.
 
-    Resolution reads ``origin`` alone and never the remote name git passes as
-    argv[1], and its unset-``origin/HEAD`` fallback prefers ``origin/main``
-    over ``origin/master``, so a repo whose default is another branch beside a
-    legacy ``main`` resolves the wrong base ΓÇö the assumption set tracked at
-    ~/.claude/orchestrator-runs/falsify-first/parked-items.md row 3.
+    Args:
+        remote_name: Remote whose default branch provides the gate base.
 
     Returns:
         A remote-tracking ref name, or None when no default-branch ref
         resolves.
     """
+    remote_head_reference = REMOTE_BRANCH_REFERENCE_TEMPLATE.format(
+        remote=remote_name, branch="HEAD"
+    )
     symbolic_reference = run_git_reference_query(
-        (*ALL_GIT_SYMBOLIC_REFERENCE_COMMAND_PREFIX, ORIGIN_HEAD_SYMBOLIC_REFERENCE)
+        (*ALL_GIT_SYMBOLIC_REFERENCE_COMMAND_PREFIX, remote_head_reference)
     )
     if symbolic_reference is not None:
         verified_symbolic_target = run_git_reference_query(
@@ -319,7 +317,10 @@ def resolve_default_branch_reference() -> str | None:
         )
         if verified_symbolic_target is not None:
             return symbolic_reference
-    for each_candidate_reference in ALL_DEFAULT_BRANCH_FALLBACK_REFERENCES:
+    for each_branch_name in ALL_FALLBACK_REMOTE_DEFAULT_BRANCH_NAMES:
+        each_candidate_reference = REMOTE_BRANCH_REFERENCE_TEMPLATE.format(
+            remote=remote_name, branch=each_branch_name
+        )
         verified_reference = run_git_reference_query(
             (*ALL_GIT_VERIFY_REFERENCE_COMMAND_PREFIX, each_candidate_reference)
         )
@@ -360,7 +361,9 @@ def find_branch_update_push(stdin_text: str) -> PushLine | None:
 
 
 def resolve_default_branch_merge_base(
-    remote_branch_name: str, pushed_object_name: str
+    remote_branch_name: str,
+    pushed_object_name: str,
+    remote_name: str = DEFAULT_REMOTE_NAME,
 ) -> str | None:
     """Return the merge base of the pushed object and the default branch.
 
@@ -371,6 +374,7 @@ def resolve_default_branch_merge_base(
     Args:
         remote_branch_name: The remote branch the push updates.
         pushed_object_name: The object name the push carries.
+        remote_name: The remote whose default branch provides the gate base.
 
     Returns:
         The merge-base object name; None when no default-branch ref resolves or
@@ -378,12 +382,13 @@ def resolve_default_branch_merge_base(
         no merge base applies; or the unresolvable-merge-base sentinel when a
         default-branch ref resolves and git still reports no merge base.
     """
-    default_branch_reference = resolve_default_branch_reference()
+    default_branch_reference = resolve_default_branch_reference(remote_name)
     if default_branch_reference is None:
         return None
-    default_branch_name = default_branch_reference.removeprefix(
-        ORIGIN_REMOTE_TRACKING_REFERENCE_PREFIX
+    default_branch_prefix = REMOTE_BRANCH_REFERENCE_TEMPLATE.format(
+        remote=remote_name, branch=""
     )
+    default_branch_name = default_branch_reference.removeprefix(default_branch_prefix)
     if remote_branch_name == default_branch_name:
         return None
     # Anchors to the pushed object; deferring to the gate's HEAD-based merge-base would change behavior on non-HEAD pushes.
@@ -399,7 +404,9 @@ def resolve_default_branch_merge_base(
     return merge_base_object_name
 
 
-def resolve_gate_base_reference(stdin_text: str) -> str | None:
+def resolve_gate_base_reference(
+    stdin_text: str, remote_name: str = DEFAULT_REMOTE_NAME
+) -> str | None:
     """Return the reference the gate scopes its changed lines to.
 
     A branch update reads from the merge base with the remote default branch,
@@ -414,20 +421,24 @@ def resolve_gate_base_reference(stdin_text: str) -> str | None:
 
     Args:
         stdin_text: The pre-push stdin payload.
+        remote_name: The remote whose default branch provides the gate base.
 
     Returns:
         The gate's base reference, the no-parseable-lines sentinel, the
         unresolvable-merge-base sentinel, or None when the push only deletes
         remote branches.
     """
-    return _resolve_gate_base_from_parsed(_parse_push_stdin(stdin_text))
+    return _resolve_gate_base_from_parsed(_parse_push_stdin(stdin_text), remote_name)
 
 
-def _resolve_gate_base_from_parsed(parsed_stdin: ParsedPushStdin) -> str | None:
+def _resolve_gate_base_from_parsed(
+    parsed_stdin: ParsedPushStdin, remote_name: str = DEFAULT_REMOTE_NAME
+) -> str | None:
     """Return the gate's base reference for an already-parsed stdin payload.
 
     Args:
         parsed_stdin: The parsed stdin payload.
+        remote_name: The remote whose default branch provides the gate base.
 
     Returns:
         The merge base with the remote default branch for a branch update, the
@@ -440,7 +451,9 @@ def _resolve_gate_base_from_parsed(parsed_stdin: ParsedPushStdin) -> str | None:
     if branch_update is None:
         return _resolve_base_reference_from_lines(parsed_stdin)
     merge_base_object_name = resolve_default_branch_merge_base(
-        branch_update.remote_branch_name, branch_update.local_object_name
+        branch_update.remote_branch_name,
+        branch_update.local_object_name,
+        remote_name,
     )
     if merge_base_object_name is None:
         return branch_update.remote_object_name
@@ -542,7 +555,8 @@ def main() -> int:
             file=sys.stderr,
         )
         return 0
-    base_reference = _resolve_gate_base_from_parsed(parsed_stdin)
+    remote_name = resolve_remote_name_from_arguments(sys.argv)
+    base_reference = _resolve_gate_base_from_parsed(parsed_stdin, remote_name)
     if base_reference is None:
         return 0
     if base_reference == no_parseable_stdin_lines_sentinel:
@@ -550,8 +564,7 @@ def main() -> int:
         return gate_infrastructure_failure_exit_code
     if base_reference == unresolvable_merge_base_sentinel:
         print(unresolvable_merge_base_message, file=sys.stderr)
-        return 0
-    remote_name = resolve_remote_name_from_arguments(sys.argv)
+        return gate_infrastructure_failure_exit_code
     try:
         usable_base_reference = resolve_usable_base_reference(
             base_reference, remote_name, run_git_text_command

package/hooks/git-hooks/test_pre_push.py

@@ -156,11 +156,10 @@ def test_run_git_reference_query_returns_replaced_text_on_locale_invalid_bytes(
     assert resolved_output == expected_replaced_reference
 
 
-def test_unresolvable_merge_base_message_does_not_claim_dangling_origin_head() -> None:
+def test_unresolvable_merge_base_message_describes_pending_validation() -> None:
     skip_message = git_hooks_constants.UNRESOLVABLE_MERGE_BASE_MESSAGE
-    assert "origin/HEAD names a ref" not in skip_message
-    assert "unrelated histories" in skip_message
-    assert "merge-base still could not name a shared commit" in skip_message
+    assert "CODE_RULES validation is pending" in skip_message
+    assert "Restore shared history" in skip_message
 
 
 def test_run_git_text_command_raises_when_git_cannot_launch(
@@ -239,6 +238,11 @@ def resolve_remote_head_reference(monkeypatch: pytest.MonkeyPatch) -> None:
         return GIT_RESOLVED_EXIT_CODE, RESOLVED_COMMIT_OBJECT_NAME
 
     monkeypatch.setattr(pre_push, "run_git_text_command", fake_run_git_text_command)
+    monkeypatch.setattr(
+        sys,
+        "argv",
+        [HOOK_INVOCATION_NAME, git_hooks_constants.DEFAULT_REMOTE_NAME, PUSHED_REMOTE_URL],
+    )
 
 
 
@@ -994,6 +998,46 @@ def test_resolve_default_branch_reference_reads_the_origin_head_symbolic_referen
     assert pre_push.resolve_default_branch_reference() == ORIGIN_DEFAULT_BRANCH_REFERENCE
 
 
+def test_resolve_default_branch_reference_reads_the_requested_remote_head(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    repository, default_branch_tip, _topic_branch_tip = _build_default_branch_repository(
+        tmp_path
+    )
+    upstream_reference = "refs/remotes/upstream/main"
+    upstream_head_reference = "refs/remotes/upstream/HEAD"
+    _run_fixture_git(repository, "update-ref", upstream_reference, default_branch_tip)
+    _run_fixture_git(
+        repository, "symbolic-ref", upstream_head_reference, upstream_reference
+    )
+    monkeypatch.chdir(repository)
+
+    assert pre_push.resolve_default_branch_reference("upstream") == upstream_reference
+
+
+def test_resolve_default_branch_merge_base_uses_requested_remote_trunk_fallback(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    repository, default_branch_tip, topic_branch_tip = _build_default_branch_repository(
+        tmp_path
+    )
+    upstream_trunk_reference = "refs/remotes/upstream/trunk"
+    _run_fixture_git(
+        repository, "update-ref", upstream_trunk_reference, default_branch_tip
+    )
+    monkeypatch.chdir(repository)
+
+    merge_base_object_name = pre_push.resolve_default_branch_merge_base(
+        FEATURE_BRANCH_NAME,
+        topic_branch_tip,
+        "upstream",
+    )
+
+    assert merge_base_object_name == default_branch_tip
+
+
 def test_resolve_default_branch_reference_returns_none_without_remote_tracking_refs(
     tmp_path: Path,
     monkeypatch: pytest.MonkeyPatch,
@@ -1198,7 +1242,7 @@ def test_main_allows_the_push_when_origin_head_names_an_absent_reference(
     assert recorded_arguments == ["--base", remote_object_name]
 
 
-def test_main_skips_the_gate_when_no_merge_base_resolves(
+def test_main_keeps_the_gate_pending_when_no_merge_base_resolves(
     tmp_path: Path,
     monkeypatch: pytest.MonkeyPatch,
     capsys: pytest.CaptureFixture[str],
@@ -1230,13 +1274,73 @@ def test_main_skips_the_gate_when_no_merge_base_resolves(
 
     exit_code = pre_push.main()
 
-    assert exit_code == 0
+    assert exit_code == git_hooks_constants.GATE_INFRASTRUCTURE_FAILURE_EXIT_CODE
     assert not recorded_arguments_path.exists(), (
-        "the gate ran on a base the hook could not verify"
+        "the gate remains pending until the hook verifies a usable base"
     )
     assert git_hooks_constants.UNRESOLVABLE_MERGE_BASE_MESSAGE in capsys.readouterr().err
 
 
+def test_main_uses_the_pushed_remote_when_origin_has_unrelated_history(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    repository, default_branch_tip, topic_branch_tip = _build_default_branch_repository(
+        tmp_path
+    )
+    _run_fixture_git(repository, "checkout", "--orphan", "unrelated-origin")
+    _run_fixture_git(repository, "rm", "-rf", ".")
+    unrelated_origin_tip = _commit_file(repository, "unrelated.txt")
+    _run_fixture_git(repository, "checkout", FEATURE_BRANCH_NAME)
+    _run_fixture_git(
+        repository,
+        "update-ref",
+        ORIGIN_DEFAULT_BRANCH_REFERENCE,
+        unrelated_origin_tip,
+    )
+    _set_origin_head(repository, ORIGIN_DEFAULT_BRANCH_REFERENCE)
+    upstream_reference = "refs/remotes/upstream/main"
+    upstream_head_reference = "refs/remotes/upstream/HEAD"
+    _run_fixture_git(repository, "update-ref", upstream_reference, default_branch_tip)
+    _run_fixture_git(
+        repository, "symbolic-ref", upstream_head_reference, upstream_reference
+    )
+    recorded_arguments_path = tmp_path / "upstream_recorded_arguments.txt"
+    recording_gate_script_path = tmp_path / "upstream_recording_gate.py"
+    recording_gate_script_path.write_text(
+        "import pathlib, sys\n"
+        f'pathlib.Path(r"{recorded_arguments_path}").write_text('
+        "'\\n'.join(sys.argv[1:]), encoding='utf-8')\n"
+        "sys.exit(0)\n",
+        encoding="utf-8",
+    )
+    monkeypatch.setenv("CODE_RULES_GATE_PATH", str(recording_gate_script_path))
+    monkeypatch.chdir(repository)
+    monkeypatch.setattr(
+        sys, "argv", [HOOK_INVOCATION_NAME, PUSHED_REMOTE_NAME, PUSHED_REMOTE_URL]
+    )
+    monkeypatch.setattr(
+        sys,
+        "stdin",
+        io.StringIO(
+            _push_stdin_line(
+                FEATURE_BRANCH_NAME,
+                topic_branch_tip,
+                FEATURE_BRANCH_NAME,
+                NON_ZERO_REMOTE_SHA_ONE,
+            )
+        ),
+    )
+
+    exit_code = pre_push.main()
+
+    assert exit_code == 0
+    assert recorded_arguments_path.read_text(encoding="utf-8").splitlines() == [
+        "--base",
+        default_branch_tip,
+    ]
+
+
 def test_main_allows_default_branch_file_the_rebase_replayed_onto(
     tmp_path: Path,
     monkeypatch: pytest.MonkeyPatch,