Never synthesize a fallback Git commit identity

coilysiren commented

2026-07-26 00:33:32 +00:00

Owner

Outcome

Ward must never invent a Git author or committer identity for an adopter.

If the environment or repository does not provide a valid identity, Git must fail before commit creation and Ward must explain the missing prerequisite without configuring an example bot or another synthetic fallback.

Required behavior

Remove every example-bot name, email, default, fixture expectation, bootstrap write, and documentation recommendation from the product path.
Preserve explicit repository, global Git, environment, and authenticated actor identity according to Git's normal precedence.
Do not derive commit attribution from a shared automation credential unless the caller explicitly configures that identity.
Let commit creation fail before mutation when no valid identity exists.
Render a concise remedy that tells the adopter where Git identity may be configured without writing it automatically.

Acceptance criteria

A clean fixture with no Git identity cannot create a commit and receives no synthesized fallback.
Explicit local, global, and environment-provided identities remain unchanged.
Ward never attributes adopter work to an example bot.
Tests cover missing identity, each supported explicit source, and the absence of bootstrap-side Git configuration writes.
Product documentation contains no example-bot identity recommendation.

Headless execution boundary

Use isolated repositories, temporary Git configuration, and synthetic identities only. Do not read or mutate an adopter's real global Git configuration.

Blocked by

None.

Supersedes

Absorbs #1570 and replaces the link-only regression report previously held by #1568.

## Outcome Ward must never invent a Git author or committer identity for an adopter. If the environment or repository does not provide a valid identity, Git must fail before commit creation and Ward must explain the missing prerequisite without configuring an example bot or another synthetic fallback. ## Required behavior * Remove every example-bot name, email, default, fixture expectation, bootstrap write, and documentation recommendation from the product path. * Preserve explicit repository, global Git, environment, and authenticated actor identity according to Git's normal precedence. * Do not derive commit attribution from a shared automation credential unless the caller explicitly configures that identity. * Let commit creation fail before mutation when no valid identity exists. * Render a concise remedy that tells the adopter where Git identity may be configured without writing it automatically. ## Acceptance criteria * A clean fixture with no Git identity cannot create a commit and receives no synthesized fallback. * Explicit local, global, and environment-provided identities remain unchanged. * Ward never attributes adopter work to an example bot. * Tests cover missing identity, each supported explicit source, and the absence of bootstrap-side Git configuration writes. * Product documentation contains no example-bot identity recommendation. ## Headless execution boundary Use isolated repositories, temporary Git configuration, and synthetic identities only. Do not read or mutate an adopter's real global Git configuration. ## Blocked by None. ## Supersedes Absorbs #1570 and replaces the link-only regression report previously held by #1568.

coilyco-ops referenced this issue from a commit

2026-07-26 02:16:10 +00:00

fix(release): bake AOS native policy

coilyco-ops closed this issue

2026-07-26 02:16:10 +00:00

coilyco-ops reopened this issue

2026-07-26 04:00:23 +00:00

coilyco-ops referenced this issue from coilyco-flight-deck/agentic-os

2026-07-26 04:02:34 +00:00

Own Ward container attribution in the AOS image #756

coilyco-ops referenced this issue from coilyco-flight-deck/infrastructure

2026-07-26 04:02:54 +00:00

Keep deployment Git attribution outside Ward #648

coilyco-ops referenced this issue from a commit

2026-07-26 04:35:40 +00:00

fix(release): restore deployment-neutral artifacts

coilyco-ops added the

labels

2026-07-29 03:47:17 +00:00

coilyco-ops changed title from ~~Fix "example bot" commit attribution regression~~ to Never synthesize a fallback Git commit identity

2026-07-31 08:10:05 +00:00

coilyco-ops referenced this issue

2026-07-31 08:12:26 +00:00

remove example bot ward git email - instead we should passively fallback to git's behavior of blocking commits when not identity is set #1570

coilyco-ops added

and removed

labels

2026-07-31 08:29:36 +00:00

coilyco-ops commented

2026-08-05 10:25:08 +00:00

Member

Kai resolved the enforcement boundary on 2026-08-05.

Authoritative implementation contract

Apply Git user.useConfigOnly=true to every Ward-governed commit invocation and as container system policy. Ward must prevent Git itself from guessing an identity from the operating-system username or hostname.
Ask Git to resolve both GIT_AUTHOR_IDENT and GIT_COMMITTER_IDENT through git var. Do not duplicate or reinterpret Git identity precedence in Ward.
Validate immediately before every Ward-created commit. Also validate during every engineer launch because all four fixed workflows can create commits, including remote-branch-only.
Director, QA, read-only, and repository-free peer sessions do not require a Git identity because they cannot create commits.
Preserve native GIT_AUTHOR_*, GIT_COMMITTER_*, repository-local, and global Git identity sources according to Git precedence.
Retain WARD_GIT_NAME and WARD_GIT_EMAIL only as explicit container fallback inputs. Remove the built-in launch attribution default and never derive commit identity from a harness display name, Forgejo login, authenticated actor, or automation credential.
Do not write host repository-local or global Git configuration. A missing or incomplete identity fails before commit mutation and names the missing author or committer fields plus the supported configuration locations.
The agent Co-Authored-By trailer remains separate attribution. It never supplies author or committer identity.
Remove product defaults, bootstrap writes, documentation, and tests that expect example-bot or bot@example.com. Ordinary synthetic identities remain valid in isolated fixtures when the test explicitly configures them.

Acceptance must exercise each native Git source, partial author and committer identities, Git username or hostname guessing, every engineer workflow, and a no-identity commit that leaves HEAD and the index unchanged.

Kai resolved the enforcement boundary on 2026-08-05. ## Authoritative implementation contract * Apply Git `user.useConfigOnly=true` to every Ward-governed commit invocation and as container system policy. Ward must prevent Git itself from guessing an identity from the operating-system username or hostname. * Ask Git to resolve both `GIT_AUTHOR_IDENT` and `GIT_COMMITTER_IDENT` through `git var`. Do not duplicate or reinterpret Git identity precedence in Ward. * Validate immediately before every Ward-created commit. Also validate during every engineer launch because all four fixed workflows can create commits, including `remote-branch-only`. * Director, QA, read-only, and repository-free peer sessions do not require a Git identity because they cannot create commits. * Preserve native `GIT_AUTHOR_*`, `GIT_COMMITTER_*`, repository-local, and global Git identity sources according to Git precedence. * Retain `WARD_GIT_NAME` and `WARD_GIT_EMAIL` only as explicit container fallback inputs. Remove the built-in launch attribution default and never derive commit identity from a harness display name, Forgejo login, authenticated actor, or automation credential. * Do not write host repository-local or global Git configuration. A missing or incomplete identity fails before commit mutation and names the missing author or committer fields plus the supported configuration locations. * The agent `Co-Authored-By` trailer remains separate attribution. It never supplies author or committer identity. * Remove product defaults, bootstrap writes, documentation, and tests that expect `example-bot` or `bot@example.com`. Ordinary synthetic identities remain valid in isolated fixtures when the test explicitly configures them. Acceptance must exercise each native Git source, partial author and committer identities, Git username or hostname guessing, every engineer workflow, and a no-identity commit that leaves `HEAD` and the index unchanged.

coilyco-ops added

and removed

labels

2026-08-05 10:26:08 +00:00

coilyco-ops referenced this issue from a commit

2026-08-06 03:10:12 +00:00

fix: require explicit Git commit identity

coilyco-ops closed this issue

2026-08-06 03:10:12 +00:00

coilyco-ops commented

2026-08-06 03:10:26 +00:00

Member

WARD-OUTCOME: done ✅

Landed on main in b64424f4 (fix: require explicit Git commit identity).

Removed the built-in Git author and committer fallback plus every product and fixture reference to the retired example identity.
Engineer launch and every Ward-created commit ask Git to resolve GIT_AUTHOR_IDENT and GIT_COMMITTER_IDENT under user.useConfigOnly=true.
Local, global, author environment, committer environment, and explicit WARD_GIT_NAME / WARD_GIT_EMAIL sources retain Git's precedence.
Engineer launches project Git's resolved author and committer values unchanged into the private container for all four workflows.
Container bootstrap writes only user.useConfigOnly=true as identity policy. It never writes user.name or user.email.
Missing or partial identity fails before Ward stages or commits. Regression fixtures verify unchanged HEAD and index state.

Validation passed: ward exec test, test-cmd, lint, build, vet, test-policy-boundary, test-release-contract, pre-commit, and ward doctor. The final commit itself exercised the new guarded ward git commit path.

WARD-OUTCOME: done ✅ Landed on `main` in `b64424f4` (`fix: require explicit Git commit identity`). * Removed the built-in Git author and committer fallback plus every product and fixture reference to the retired example identity. * Engineer launch and every Ward-created commit ask Git to resolve `GIT_AUTHOR_IDENT` and `GIT_COMMITTER_IDENT` under `user.useConfigOnly=true`. * Local, global, author environment, committer environment, and explicit `WARD_GIT_NAME` / `WARD_GIT_EMAIL` sources retain Git's precedence. * Engineer launches project Git's resolved author and committer values unchanged into the private container for all four workflows. * Container bootstrap writes only `user.useConfigOnly=true` as identity policy. It never writes `user.name` or `user.email`. * Missing or partial identity fails before Ward stages or commits. Regression fixtures verify unchanged HEAD and index state. Validation passed: `ward exec test`, `test-cmd`, `lint`, `build`, `vet`, `test-policy-boundary`, `test-release-contract`, `pre-commit`, and `ward doctor`. The final commit itself exercised the new guarded `ward git commit` path.

Rows
Columns

Never synthesize a fallback Git commit identity #1568

Outcome

Required behavior

Acceptance criteria

Headless execution boundary

Blocked by

Supersedes

Authoritative implementation contract