opencode-workflow-guard 1.18.1 → 1.19.1

package/src/lib/dogfood.ts

@@ -0,0 +1,147 @@
+import { dogfoodEvidence } from "./evidence.ts";
+import { getDogfoodDeployMatrix, getDogfoodRecordsForWorkspace, isDogfoodRequired } from "./state.ts";
+import { getCurrentGitCommitHash, getTrackedWorktreeFingerprint } from "./verify.ts";
+import type { DogfoodResult } from "./types.ts";
+
+export interface DogfoodGateResult {
+	required: boolean;
+	/** Matrix hosts still missing a fresh passing record. */
+	missingHosts: string[];
+	/** The record that satisfied the gate, when one did. */
+	matched?: DogfoodResult;
+	/** Every record counted toward the gate, one per host. */
+	matchedRecords?: DogfoodResult[];
+	/** Why the gate is unsatisfied, cause-attributed. */
+	reason?: string;
+	/** Evidence id of the matched record, for audit correlation. */
+	evidenceId?: string;
+}
+
+/**
+ * Why one record cannot count for this worktree, or undefined when it can.
+ *
+ * Each cause is named separately because they have different remedies. A
+ * missing fingerprint is an environment problem, a fingerprint mismatch is a
+ * stale run, and a commit mismatch is an unrecorded commit. Collapsing them
+ * into one message sends the agent looking for the wrong fix.
+ */
+function stalenessReason(record: DogfoodResult, commitHash: string | undefined, fingerprint: string | undefined): string | undefined {
+	if (!fingerprint) {
+		return "Worktree fingerprint could not be computed (git unavailable or worktree unreadable), so dogfood evidence cannot be bound to this worktree; resolve worktree readability and re-run the dogfood scenario.";
+	}
+	if (!record.worktreeFingerprint) {
+		return `The recorded dogfood run ('${record.scenarioId}') has no worktree fingerprint binding (recorded against an unreadable worktree); re-run the dogfood scenario and record it with record_dogfood.`;
+	}
+	if (record.worktreeFingerprint !== fingerprint) {
+		return `The recorded dogfood run ('${record.scenarioId}' on '${record.host.label}') does not match the current worktree contents (tracked content changed after the run); re-run the dogfood scenario and record it with record_dogfood.`;
+	}
+	if (record.commitHash && commitHash && record.commitHash !== commitHash) {
+		return `The recorded dogfood run ('${record.scenarioId}' on '${record.host.label}') is bound to commit ${record.commitHash.slice(0, 12)} but this worktree is at commit ${commitHash.slice(0, 12)}; re-run the dogfood scenario at the current commit and record it with record_dogfood.`;
+	}
+	return undefined;
+}
+
+/**
+ * Judges the dogfood gate for one worktree.
+ *
+ * Shared by PR preflight and `guard_status` so the two can never disagree about
+ * whether the gate is satisfied. Freshness is content-scoped, matching review:
+ * a record covers the tracked tree it ran against, so untracked scratch
+ * cleanup cannot invalidate it while any tracked edit or new commit does.
+ */
+export function evaluateDogfoodGate(root: string): DogfoodGateResult {
+	if (!isDogfoodRequired(root)) return { required: false, missingHosts: [] };
+	const matrix = getDogfoodDeployMatrix(root);
+	const records = getDogfoodRecordsForWorkspace(root);
+	const commitHash = getCurrentGitCommitHash(root);
+	const fingerprint = getTrackedWorktreeFingerprint(root);
+
+	if (records.length === 0) {
+		return {
+			required: true,
+			missingHosts: matrix.length > 0 ? matrix : ["this host"],
+			reason: "Passing dogfood evidence is required (requireDogfood); run the dogfood runner and record the result with record_dogfood.",
+		};
+	}
+
+	// Only the newest record per host can count. An older pass is superseded by
+	// a newer run of the same host, including a newer HOLD, so a stale pass
+	// cannot hide a regression the same host later found. A same-millisecond
+	// tie resolves to the HOLD regardless of arrival order: re-running is cheap,
+	// and trusting a stale pass is the failure that matters.
+	const newestPerHost = new Map<string, DogfoodResult>();
+	for (const record of records) {
+		const seen = newestPerHost.get(record.host.label);
+		if (!seen || record.timestamp > seen.timestamp) {
+			newestPerHost.set(record.host.label, record);
+		} else if (record.timestamp === seen.timestamp && seen.verdict === "pass" && record.verdict === "hold") {
+			newestPerHost.set(record.host.label, record);
+		}
+	}
+
+	const unmatched: string[] = [];
+	const held: DogfoodResult[] = [];
+	const stale: Array<{ record: DogfoodResult; reason: string }> = [];
+	const matchedRecords: DogfoodResult[] = [];
+	for (const [host, record] of newestPerHost) {
+		// A host outside the deploy matrix cannot block the gate, so its HOLD or
+		// staleness must not be reported as the reason: that would name the wrong
+		// remedy. Only in-scope hosts collect their cause.
+		const inScope = matrix.length === 0 || matrix.includes(host);
+		if (record.verdict !== "pass") {
+			if (inScope) {
+				held.push(record);
+				unmatched.push(host);
+			}
+			continue;
+		}
+		const reason = stalenessReason(record, commitHash, fingerprint);
+		if (reason) {
+			if (inScope) {
+				stale.push({ record, reason });
+				unmatched.push(host);
+			}
+			continue;
+		}
+		if (!inScope) continue;
+		matchedRecords.push(record);
+	}
+
+	if (matrix.length > 0) {
+		for (const host of matrix) if (!newestPerHost.has(host)) unmatched.push(host);
+	}
+
+	if (unmatched.length > 0) {
+		const missingHosts = [...new Set(unmatched)];
+		// A HOLD is more actionable than a matrix gap, so name it first.
+		if (held.length > 0) {
+			const first = held[0];
+			return {
+				required: true,
+				missingHosts,
+				reason: `The most recent dogfood run for host '${first.host.label}' ('${first.scenarioId}') returned HOLD${first.taxonomyClass ? ` with class '${first.taxonomyClass}'` : ""}; fix the finding and re-run before opening a PR.`,
+			};
+		}
+		if (stale.length > 0) {
+			return { required: true, missingHosts, reason: stale[0].reason };
+		}
+		const outsideMatrix = [...newestPerHost.keys()].filter((host) => !matrix.includes(host));
+		if (matrix.length > 0 && matchedRecords.length === 0 && outsideMatrix.length > 0) {
+			return {
+				required: true,
+				missingHosts,
+				reason: `Dogfood evidence was recorded for host(s) ${outsideMatrix.join(", ")}, which are not in the deploy matrix (${matrix.join(", ")}); run the dogfood scenario on each matrix host and record each result.`,
+			};
+		}
+		return {
+			required: true,
+			missingHosts,
+			reason: `Dogfood evidence is missing for host(s) ${missingHosts.join(", ")} in the deploy matrix (${matrix.join(", ")}); run the dogfood scenario on each and record each result with record_dogfood.`,
+		};
+	}
+
+	// Satisfied. Report the newest contributing record, and keep the per-host
+	// set so the caller can journal every host that was actually covered.
+	const newest = matchedRecords.reduce<DogfoodResult | undefined>((best, record) => !best || record.timestamp > best.timestamp ? record : best, undefined);
+	return { required: true, missingHosts: [], matched: newest, matchedRecords, evidenceId: newest ? dogfoodEvidence(newest).id : undefined };
+}

package/src/lib/evidence.ts

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import type { ToolOutcome } from "./tool-outcomes.ts";
-import type { EvidenceRecord, EvidenceSubject, PolicyDecision, ReviewResult, VerifyResult } from "./types.ts";
+import type { DogfoodResult, EvidenceRecord, EvidenceSubject, PolicyDecision, ReviewResult, VerifyResult } from "./types.ts";
 import { isSameGitRepo } from "./project-config.ts";
 
 function evidenceId(kind: EvidenceRecord["kind"], observedAt: number, subject: EvidenceRecord["subject"], source: Record<string, unknown>): string {
@@ -19,6 +19,24 @@ export function reviewEvidence(result: ReviewResult): EvidenceRecord {
 	return { id: evidenceId("review", result.timestamp, subject, source), kind: "review", confidence: "attestation", observedAt: result.timestamp, subject, source };
 }
 
+export function dogfoodEvidence(result: DogfoodResult): EvidenceRecord {
+	const subject = { workspace: result.workspace, commitHash: result.commitHash, worktreeFingerprint: result.worktreeFingerprint, sessionID: result.sessionID, actor: result.host.label };
+	// The digest pair is part of the source, so replaying a passing run onto a
+	// different scenario or taxonomy changes the evidence id.
+	const source = {
+		verdict: result.verdict,
+		scenarioId: result.scenarioId,
+		scenarioSha256: result.scenarioSha256,
+		taxonomySha256: result.taxonomySha256,
+		taxonomyClass: result.taxonomyClass,
+		checks: result.checks,
+		runCount: result.runCount,
+		host: result.host,
+		gitStatus: result.gitStatus,
+	};
+	return { id: evidenceId("dogfood", result.timestamp, subject, source), kind: "dogfood", confidence: "attestation", observedAt: result.timestamp, subject, source };
+}
+
 export function toolOutcomeEvidence(outcome: ToolOutcome, observedAt: number, workspace?: string): EvidenceRecord {
 	const subject = { workspace, sessionID: outcome.sessionID, callID: outcome.callID };
 	const source = { tool: outcome.tool, status: outcome.status, durationMs: outcome.durationMs, repeatedFailureCount: outcome.repeatedFailureCount };

package/src/lib/guard-dispatcher.ts

@@ -3,6 +3,7 @@ import { resolve } from "node:path";
 import { audit, loadVerifyCache } from "./audit.ts";
 import { isEvidenceFresh, reviewEvidence, verificationEvidence } from "./evidence.ts";
 import { findGitRoot, isSameGitRepo, projectRootKey } from "./project-config.ts";
+import { evaluateDogfoodGate } from "./dogfood.ts";
 import {
 	getLastReviewResultForWorkspace,
 	getLiveControlPlaneRoots,
@@ -23,14 +24,16 @@ import {
 import {
 	dynamicShellSyntaxIn,
 	extractCommands,
+	isLeadingEvalSegment,
+	maskDataHeredocBodies,
 	normalize,
+	planShellSegments,
 	shellWrappersChangeCwd,
 	splitShellSegments,
 	unwrapShellCommand,
 } from "./shell.ts";
 import { asRecord, extractTargetPath } from "./utils.ts";
 import type { PolicyDecision } from "./types.ts";
-import { getProjectMemoryIdentity } from "./project-memory.ts";
 import {
 	detectVerifyCommand,
 	getCurrentGitCommitHash,
@@ -41,7 +44,7 @@ import {
 	resolveVerifyTimeoutMs,
 	snipVerifyOutput,
 } from "./verify.ts";
-import { detectShellMutation, extractPatchPaths, guardShellMutation, hasUnresolvableVariable, isEnvironmentScratchTarget, isPathOutsideWorkspace, OPENCODE_SCRATCH_DIR } from "../policies/boundary.ts";
+import { detectShellMutation, extractPatchPaths, foreignSegmentMutationReason, guardShellMutation, hasUnresolvableVariable, isEnvironmentScratchTarget, isPathOutsideWorkspace, nestedPayloadMutationReason, OPENCODE_SCRATCH_DIR } from "../policies/boundary.ts";
 import { branchHasChangelogChange, checkLockfileSync, hasPrCreateInvocation, prBodyHasLiteralLineBreakEscapes, prBodyIncludesChangelog } from "../policies/changelog.ts";
 import { extractEditContent, liveMutationIn } from "../policies/destructive.ts";
 import { branchHasDocumentationChange } from "../policies/docs.ts";
@@ -55,11 +58,14 @@ import {
 	checkBranchBaseIsUpToDate,
 	checkMergeConflicts,
 	currentGitBranch,
+	findWorktreeForBranch,
 	hasUnsafeGitAlias,
 	isBranchAlreadyMergedOrClosed,
+	isGitTreeWriteText,
 	normalizeGitCommands,
 	onProtectedBranch,
 	parseGitInvocation,
+	prSourceBranch,
 	pushedProtectedBranchIn,
 	tagRefspecIn,
 } from "../policies/git.ts";
@@ -277,7 +283,7 @@ export async function guardToolCallImpl(
 							// that would restate the misattribution.
 							const tail = snipVerifyOutput(result.output, result.timedOut === true).slice(-500);
 							const reason = result.timedOut
-								? `Blocked todowrite: verification did not finish within ${formatTimeoutLimit(result.timeoutMs)} so the result is unknown rather than failing (${command}). Raise the limit in the project .opencode/workflow-guard.json (verifyTimeoutMs) or with WORKFLOW_GUARD_VERIFY_TIMEOUT_MS, then complete the tasks again; output tail: ${tail}`
+								? `Blocked todowrite: verification did not finish within ${formatTimeoutLimit(result.timeoutMs)} so the result is unknown rather than failing (${command}). Only the user can raise the limit, in the project .opencode/workflow-guard.json or .jsonc (verifyTimeoutMs) or with WORKFLOW_GUARD_VERIFY_TIMEOUT_MS set before the guard starts; ask them, then complete the tasks again. Output tail: ${tail}`
 								: `Blocked todowrite: all tasks marked done but verification is failing (${command}). Fix the failure before finishing; output tail: ${tail}`;
 							logPolicyBlock(`[workflow-guard] ${reason}`);
 							return block("verification", result.timedOut ? "verification_timed_out" : "verification_failed", reason);
@@ -447,9 +453,13 @@ export async function guardToolCallImpl(
 	if (!SHELL_TOOL_NAMES.has(toolName)) return allow();
 	const shellWorkdir = asRecord(input)?.workdir;
 	const requestedShellRoot = typeof shellWorkdir === "string" ? resolve(currentRoot, shellWorkdir) : currentRoot;
-	const shellRoot = !isPathOutsideWorkspace(requestedShellRoot, currentRoot) || getProjectMemoryIdentity(requestedShellRoot) === getProjectMemoryIdentity(currentRoot)
-		? requestedShellRoot
-		: currentRoot;
+	// A workdir outside the workspace is only usable when it is a linked
+	// worktree of the SAME repository: those commands mutate a tree of this
+	// workspace. A genuinely foreign repository cannot be judged here at all,
+	// because the command executes there while relative targets would be
+	// validated against the workspace root.
+	const foreignShellRoot = isPathOutsideWorkspace(requestedShellRoot, currentRoot) && !isSameGitRepo(requestedShellRoot, currentRoot);
+	const shellRoot = foreignShellRoot ? currentRoot : requestedShellRoot;
 
 	for (const raw of extractCommands(input)) {
 		const dynamicSyntax = dynamicShellSyntaxIn(raw);
@@ -470,11 +480,50 @@ export async function guardToolCallImpl(
 		}
 		const normalizedCommand = normalizeGitCommands(command);
 		if (hasUnsafeGitAlias(command)) return block("git", "unsafe_git_alias", "Blocked: per-invocation Git aliases cannot be used because they can hide guarded Git operations.");
-		const gitInvocations = splitShellSegments(command).map((segment) => parseGitInvocation(segment.trim())).filter((invocation): invocation is NonNullable<ReturnType<typeof parseGitInvocation>> => invocation !== undefined);
+		// Each segment is judged in the directory it actually runs in. A `cd`
+		// earlier in the command moves the ones that follow, so parsing them all
+		// against the shell's initial `workdir` hid a mutation in another tree:
+		// `cd <other-repo> && git commit` was judged as a commit in the session's
+		// own checkout. Plan from `raw`: `normalize` folds newlines into spaces,
+		// which erases the separator that makes a newline-separated `cd` a real
+		// directory change.
+		const segmentPlan = planShellSegments(raw, shellRoot);
+		const gitInvocations = segmentPlan
+			.map(({ segment, root }) => parseGitInvocation(segment.trim(), root))
+			.filter((invocation): invocation is NonNullable<ReturnType<typeof parseGitInvocation>> => invocation !== undefined);
 		const effectiveRoot = gitInvocations[0]?.repoDir ?? currentRoot;
+		// The command executes in `requestedShellRoot`, not in the workspace, so
+		// every relative target in it would be validated against the wrong tree:
+		// `rm -rf dist` in a foreign workdir would be checked as
+		// `<workspace>/dist`. Reads elsewhere are fine, mutations are not.
+		const mutatesTree = (invocation: NonNullable<ReturnType<typeof parseGitInvocation>>): boolean =>
+			isGitTreeWriteText(`git ${invocation.rest}`);
+		if (foreignShellRoot && (detectShellMutation(command) || gitInvocations.some(mutatesTree))) {
+			logPolicyBlock(`[workflow-guard] blocked mutation in a workdir outside workspace: ${requestedShellRoot}`);
+			return block(
+				"boundary",
+				"workspace_escape",
+				`Blocked: the shell's workdir '${requestedShellRoot}' is outside workspace root (${currentRoot}) and is not a linked worktree of this repository, so relative targets cannot be validated against the tree the command would actually change. Run the command from inside the workspace instead.`,
+			);
+		}
+		const foreignSegmentReason = foreignSegmentMutationReason(segmentPlan, currentRoot);
+		if (foreignSegmentReason) {
+			logPolicyBlock(`[workflow-guard] blocked mutation in a directory outside workspace: ${command.slice(0, 120)}`);
+			return block("boundary", "workspace_escape", foreignSegmentReason);
+		}
 		for (const invocation of gitInvocations) {
 			const normalizedInvocation = `git ${invocation.rest}`;
-			if (isPathOutsideWorkspace(invocation.repoDir, currentRoot) && (GIT_WRITE_RE.test(normalizedInvocation) || /\bgit\s+push\b/.test(normalizedInvocation))) {
+			// A linked worktree of the SAME repository is not foreign state: the
+			// shell's workdir legitimately lives there when a session works in an
+			// isolated checkout, and judging those commands is the point of the
+			// workdir-aware parse above. A genuinely different repository stays
+			// confined, exactly as before.
+			// An indeterminate repository is foreign: `findGitRoot` walks up to
+			// the nearest existing ancestor, so `git -C $OTHER_REPO commit`
+			// resolved to the workspace's own root and read as the same repo.
+			const foreignRepo = hasUnresolvableVariable(invocation.repoDir)
+				|| (isPathOutsideWorkspace(invocation.repoDir, currentRoot) && !isSameGitRepo(invocation.repoDir, currentRoot));
+			if (foreignRepo && isGitTreeWriteText(normalizedInvocation)) {
 				logPolicyBlock(`[workflow-guard] blocked git mutation on repository outside workspace: ${invocation.repoDir}`);
 				return block(
 					"boundary",
@@ -521,13 +570,25 @@ export async function guardToolCallImpl(
 			logPolicyBlock(`[workflow-guard] blocked settings tamper: ${command.slice(0, 120)}`);
 			return block("tamper", "settings_tamper", PROTECTED_PATH_REASON);
 		}
-		for (const segment of command.split(/[\n|;&]+/)) {
+		// Mask from `raw`, not the normalized copy: `normalize` folds newlines
+		// into spaces, which erases the heredoc shape the mask needs to find.
+		for (const segment of maskDataHeredocBodies(raw).split(/[\n|;&]+/)) {
 			const secretFile = secretFileReadIn(segment.trim());
 			if (secretFile) {
 				logPolicyBlock(`[workflow-guard] blocked shell read of secret file: ${secretFile}`);
 				return block("secrets", "secret_read", `Blocked: reading sensitive credential/secret file '${secretFile}' via shell is not permitted. Reference environment variables by name or inspect safe templates (e.g. .env.example) instead.`);
 			}
 		}
+		// A nested payload changes a tree this session may not judge when it
+		// changes directory itself, or names a foreign `cwd`. The outer shell
+		// sees one word, so the top-level walk above cannot see it. Plan from
+		// `raw` for the same reason the top-level walk does: a heredoc body's
+		// own lines are real commands to the shell that consumes it.
+		const nestedTreeReason = nestedPayloadMutationReason(extractInterpreterPayload, writePathsInPayload, raw, shellRoot, currentRoot);
+		if (nestedTreeReason) {
+			logPolicyBlock(`[workflow-guard] blocked nested interpreter mutation outside workspace: ${command.slice(0, 120)}`);
+			return block("boundary", "workspace_escape", nestedTreeReason);
+		}
 		for (const payload of extractInterpreterPayload(raw)) {
 			const outsidePath = outsideWritePathInPayload(payload, currentRoot);
 			if (outsidePath) {
@@ -560,7 +621,13 @@ export async function guardToolCallImpl(
 			const secretPath = secretPathInPayload(payload);
 			if (secretPath) return block("secrets", "secret_read", `Blocked: reading sensitive credential/secret file '${secretPath}' via inline interpreter script is not permitted.`);
 		}
-		const shellMutationReason = await guardShellMutation(command, context?.sessionID, !context?.simulate);
+		// `eval` runs its body in the current shell, so a `cd` inside it moves the
+		// directory of later segments. Another launcher's payload runs in a child
+		// process and cannot move this shell, so only `eval` is forwarded. The
+		// predicate lives in the shell walk so both call sites agree on which
+		// `eval` is a command.
+		const leadingEvalBody = (s: string): string | undefined => (isLeadingEvalSegment(s) ? extractInterpreterPayload(s)[0] : undefined);
+		const shellMutationReason = await guardShellMutation(raw, context?.sessionID, !context?.simulate, shellRoot, leadingEvalBody);
 		if (shellMutationReason) {
 			logPolicyBlock(`[workflow-guard] blocked shell mutation: ${command.slice(0, 120)}`);
 			return block("boundary", "shell_mutation", shellMutationReason);
@@ -604,15 +671,40 @@ export async function guardToolCallImpl(
 			}
 		}
 		if (hasPrCreateInvocation(raw)) {
-			const prRoot = shellRoot;
+			// The PR is about a BRANCH, not about whatever the shell's checkout
+			// happens to have checked out. Resolve the branch the command names
+			// (`gh --head`, `az --source-branch`) and then the checkout that
+			// holds it: a linked worktree is the normal case, because the
+			// orchestrator session may sit in the primary checkout while the
+			// reviewed branch lives in an isolated worktree. Every preflight
+			// check then judges that tree instead of the caller's.
+			const prSegment = splitShellSegments(raw).find((segment) => hasPrCreateInvocation(segment));
+			// Quote-aware on the raw segment: `unwrapShellCommand` joins the
+			// words back without their quotes, so re-parsing the joined text
+			// read a `--head`-looking token inside a quoted `--body` as the
+			// source branch.
+			const sourceBranch = prSegment ? prSourceBranch(prSegment) : undefined;
+			let prRoot = shellRoot;
+			let branch = currentGitBranch(shellRoot);
+			let missingSourceCheckout: string | undefined;
+			if (sourceBranch) {
+				const holder = findWorktreeForBranch(shellRoot, sourceBranch) ?? findWorktreeForBranch(currentRoot, sourceBranch);
+				prRoot = holder ?? shellRoot;
+				branch = sourceBranch;
+				// Review and merge evidence bind to the CONTENT of a checkout.
+				// Substituting the caller's checkout would let an approval of one
+				// tree satisfy a PR that publishes another, so a named branch no
+				// local checkout holds is refused instead.
+				if (!holder) missingSourceCheckout = sourceBranch;
+			}
 			const isAz = /\baz\s+repos\s+pr\s+create\b/.test(normalizedCommand);
 			const prTool = isAz ? "az repos pr create" : "gh pr create";
 			const descFlag = isAz ? "--description" : "--body";
 			const preflightFailures: string[] = [];
+			if (missingSourceCheckout) preflightFailures.push(`Source branch '${missingSourceCheckout}' is not checked out in any worktree of this repository, so review and merge evidence cannot be bound to the content this PR would publish. Check that branch out (a linked worktree is fine) and re-run, or omit the source-branch flag to judge the current checkout.`);
 			if (prBodyHasLiteralLineBreakEscapes(raw)) preflightFailures.push(`PR description contains literal \\n/\\r escapes that will render as text; use real newlines, ANSI-C quoting ($'...\\n...'), or a body/description file instead.`);
-			const conflictCheck = checkMergeConflicts(prRoot);
+			const conflictCheck = checkMergeConflicts(prRoot, branch);
 			if (conflictCheck.hasConflicts) preflightFailures.push(conflictCheck.reason ?? "Branch has merge conflicts with its base branch.");
-			const branch = currentGitBranch(prRoot);
 			if (branch) {
 				if (context?.simulate) remotePrStateUnchecked = true;
 				const mergedStatus = isBranchAlreadyMergedOrClosed(prRoot, branch, !context?.simulate);
@@ -686,6 +778,35 @@ export async function guardToolCallImpl(
 				}
 			}
 			if (isDocumentationRequired(prRoot) && !branchHasDocumentationChange(prRoot)) preflightFailures.push("Documentation update is required (Policy 21); update README.md or relevant documentation in docs/.");
+			// Dogfood gate (pre-deployment evidence), off by default. The
+			// evaluation lives in lib/dogfood.ts so preflight and guard_status
+			// cannot disagree about whether the gate is satisfied.
+			const dogfoodGate = evaluateDogfoodGate(prRoot);
+			if (dogfoodGate.matched && !context?.simulate) {
+				audit({
+					ts: new Date().toISOString(),
+					sessionID: context?.sessionID,
+					tool: "pr-preflight.dogfood-binding",
+					decision: "allow",
+					phase: "event",
+					reason: "dogfood_evidence_matched",
+					evidence: {
+						evidenceId: dogfoodGate.evidenceId,
+						dogfoodScenarioId: dogfoodGate.matched.scenarioId,
+						dogfoodHost: dogfoodGate.matched.host.label,
+						// Journal every host the matrix required, not just the
+						// newest one. A single-host entry would understate a
+						// multi-host pass and mislead an auditor later.
+						dogfoodCoveredHosts: (dogfoodGate.matchedRecords ?? []).map((record) => record.host.label),
+						binding: {
+							workspace: projectRootKey(prRoot),
+							commitHash: getCurrentGitCommitHash(prRoot),
+							worktreeFingerprint: getTrackedWorktreeFingerprint(prRoot)?.slice(0, 16),
+						},
+					},
+				});
+			}
+			if (dogfoodGate.missingHosts.length > 0 && dogfoodGate.reason) preflightFailures.push(dogfoodGate.reason);
 			const branchChangelog = branchHasChangelogChange(prRoot);
 			let shellCwdKnown = true;
 			const prSegments: Array<{ segment: string; invocationRoot: string | null }> = [];

package/src/lib/permission-seat.ts

@@ -29,6 +29,9 @@
 
 import { guardToolCallImpl } from "./guard-dispatcher.ts";
 import { getSessionBoundWorkspace, runWithRuntimeState } from "./state.ts";
+import { GIT_BRANCH_CREATE_RE, GIT_WRITE_RE, PUSH_TO_MAIN_RE, parseGitInvocation } from "../policies/git.ts";
+import { hasPrCreateInvocation } from "../policies/changelog.ts";
+import { splitShellSegments } from "./shell.ts";
 import { mcpMutationTool } from "../policies/mcp.ts";
 import type { PolicyDecision } from "./types.ts";
 
@@ -61,6 +64,55 @@ export interface PermissionSeatResult {
 
 const EDIT_ACTIONS = new Set(["edit", "write", "patch", "apply_patch"]);
 
+/**
+ * Commands whose verdict depends on WHICH checkout they run in.
+ *
+ * A bare `git push`, `git commit`, or branch creation is judged against the
+ * repository the shell's working directory resolves to, and PR preflight is
+ * judged against the branch the PR publishes. This seat sees normalized
+ * `action`/`resources` only, never the tool's `workdir`, so for those commands
+ * the repository is an assumption rather than a fact: the session-bound
+ * checkout may be the primary tree while the command targets a linked
+ * worktree. Deciding on the assumption denied legitimate pushes and PRs, so
+ * the seat defers them to `execute.before`, which sees the raw arguments.
+ *
+ * Two cases stay decisive:
+ *
+ * - An explicit `-C`/`--git-dir`/`--work-tree`/`GIT_DIR` names the repository
+ *   in the command text, so it is a fact the seat can judge.
+ * - A push whose destination is an explicitly named protected branch is a
+ *   finding in every checkout, so no `workdir` can change the verdict.
+ */
+function repositoryDependent(command: string): boolean {
+	for (const segment of splitShellSegments(command)) {
+		// PR creation names no repository at all: the checkout is cwd-derived,
+		// and a `--head`/`--source-branch` may live in another worktree.
+		if (hasPrCreateInvocation(segment)) return true;
+		const parsed = parseGitInvocation(segment);
+		if (!parsed) continue;
+		const rest = `git ${parsed.rest}`;
+		if (parsed.explicitRepoDir) continue;
+		if (PUSH_TO_MAIN_RE.test(rest)) continue;
+		const repositorySensitive =
+			/\bgit\s+push\b/.test(rest) ||
+			GIT_WRITE_RE.test(rest) ||
+			GIT_BRANCH_CREATE_RE.test(rest);
+		if (repositorySensitive) return true;
+	}
+	return false;
+}
+
+/**
+ * Policies whose verdict is derived from the selected checkout.
+ *
+ * A block from one of these may be an artifact of judging the wrong tree: the
+ * original defect was a push denied for the protected branch of the primary
+ * checkout while the command targeted a linked feature worktree. A block from
+ * any other policy (destructive, shell-safety, secrets, tamper, todo) is a
+ * finding about the command text itself, so no working directory can change it.
+ */
+const CHECKOUT_DERIVED_POLICIES = new Set(["git", "pr-preflight"]);
+
 /**
  * Map one simulated policy decision onto the seat's effect.
  *
@@ -117,12 +169,38 @@ export async function evaluatePermissionSeat(
 
 	const mapping = mappedToolFor(event.action);
 	if (mapping) {
+		let deferred: PermissionSeatResult | undefined;
 		for (const resource of resources) {
+			// Where the command runs is part of the decision for some commands,
+			// and this seat cannot see the tool's `workdir`. Both directions of a
+			// checkout-derived verdict are then unreliable: a block may be the
+			// protected branch of the wrong tree, and an allow may be a feature
+			// checkout that hides a push to a protected destination. Defer those
+			// to `execute.before`, which resolves the shell's workdir.
+			const cwdDependent = mapping.tool === "bash" && repositoryDependent(resource);
 			const decision = await decide(mapping.tool, mapping.input(resource));
 			const verdict = seatVerdict(decision, mapping.tool);
+			if (cwdDependent) {
+				// A block from any OTHER policy is a finding about the command
+				// text itself (`cat .env` or a destructive live command in the
+				// same compound command), so no working directory can change it
+				// and it keeps its denial. Everything else defers.
+				if (verdict?.effect === "deny" && !CHECKOUT_DERIVED_POLICIES.has(decision.policy ?? "")) return verdict;
+				deferred = {
+					effect: "abstain",
+					mappedTool: mapping.tool,
+					decision: {
+						status: "needs_approval",
+						policy: decision.policy ?? "git",
+						code: "repository_unidentified",
+						message: "[workflow-guard permission.evaluate] Deferred: this command's verdict depends on the directory it runs in, which the permission seat cannot see. `execute.before` resolves the shell's workdir and enforces there.",
+					},
+				};
+				continue;
+			}
 			if (verdict) return verdict;
 		}
-		return { effect: "allow", mappedTool: mapping.tool };
+		return deferred ?? { effect: "allow", mappedTool: mapping.tool };
 	}
 
 	// `<server>_<tool>` MCP actions: only the guarded live-system servers are