Reject Git graft and shallow ancestry metadata

Author: mchwang

README.md

@@ -45,10 +45,10 @@ Inputs such as `planText` and the ledger must come from the caller. The future `
 
 ## Current limits and safety
 
-- History must be linear and descend from the requested base. Merge histories are rejected with a rebase instruction; repositories using object alternates or symlinked object storage are rejected (storage inspection is limited to 100,000 entries). Reads are bounded to 500 commits, 32 MiB per Git response, 64 MiB of unique blob bytes across the history (callers may lower `maxBlobBytes`), 8 MiB of cumulative diff output, 20,000 cumulative file records (including the final diff), and a shared 30-second monotonic deadline for a read. Git children receive only the remaining time and are killed on timeout. Filesystem inspections check the deadline between operations; a blocked filesystem syscall still requires an external worker supervisor. Oversized work fails explicitly.
+- History must be linear and descend from the requested base. Merge histories are rejected with a rebase instruction; repositories using grafts, shallow ancestry, object alternates, or symlinked object storage are rejected (storage inspection is limited to 100,000 entries). Reads are bounded to 500 commits, 32 MiB per Git response, 64 MiB of unique blob bytes across the history (callers may lower `maxBlobBytes`), 8 MiB of cumulative diff output, 20,000 cumulative file records (including the final diff), and a shared 30-second monotonic deadline for a read. Git children receive only the remaining time and are killed on timeout. Filesystem inspections check the deadline between operations; a blocked filesystem syscall still requires an external worker supervisor. Oversized work fails explicitly.
 - Linking separately bounds cumulative split lines and candidate segments to 100,000 each, reference/work operations to 1,000,000, and text/origin strings to 32 Mi UTF-16 code units. It checks before expanding lines/origin sets; grouping no longer repeatedly splits accumulated content. Callers may lower these budgets. Linking has a 30-second overall deadline and each line diff uses at most 2 seconds or the remaining total, whichever is smaller.
 - The caller selects and trusts the repository and its Git administrative directory. Normal Git discovery, linked-worktree gitfiles, and symlinked gitdirs are supported; object-storage links and alternates inside that selected gitdir are rejected. This adapter is not a filesystem-containment boundary for untrusted repository roots.
-- Object storage must remain unchanged during a read; these library checks do not isolate a concurrently hostile filesystem.
+- Git administrative metadata and object storage must remain unchanged during a read; these library checks do not isolate a concurrently hostile filesystem.
 - Ownership uses line diffs, not semantic inference. Within one replacement block, new lines inherit all affected owners conservatively. Function context comes from Git hunk headers, not an AST.
 - The importer requires accurate typed base entries, stable plan identity, a selected issue, and a trusted checkout path-identity function. It rejects path traversal, Git metadata paths, and traversal through a listed file/symlink/submodule. Runtime symlink and write-scope enforcement belong to the future container/runner; plan validation alone is not a sandbox.
 - Allowed commands restrict accidents, not hostile programs or changed scripts. Parsing returns argv and never executes it. An unlisted valid command is a warning and must not run until allowed.

docs/implementation/build-step-1.md

@@ -104,3 +104,7 @@ File metadata retains the whole rename path lineage, so a later deletion include
 ## Merged-contract review round 4
 
 The review had no inline findings, but its summary identified lost metadata after deleting and recreating a path. A real binary-file regression reproduced only the recreating owner being retained. Metadata updates now combine existing path evidence before storing/propagating it, so prior deletion owners survive reuse and subsequent renames. Owned deletion plus recreation is Ambiguous; foreign deletion plus recreation stays Unplanned. Both regressions pass.
+
+## Merged-contract review round 5
+
+Reproduced a repository-local graft making an unrelated root commit appear descended from the selected base. The adapter now rejects Git-resolved graft and shallow metadata before object/ancestry reads and pins the child graft file to `/dev/null` as defense in depth. Git resolves administrative paths so linked worktrees share the same check. Caller isolation must keep all Git metadata, not just blobs, stable during a read. Full shallow-clone support is deliberately outside this linear immutable-history slice.

git/history.ts

@@ -36,7 +36,7 @@ export function readHistory(repo: string, baseRef: string, headRef = 'HEAD', lim
       result = execFileSync('git', ['--no-pager', '--no-replace-objects', '-c', 'core.hooksPath=/dev/null', '-c', 'protocol.allow=never', ...args], {
         cwd: repo, maxBuffer: 32 * 1024 * 1024, timeout, killSignal: 'SIGKILL',
         env: { ...environment, GIT_OPTIONAL_LOCKS: '0', GIT_TERMINAL_PROMPT: '0',
-          GIT_NO_LAZY_FETCH: '1', GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: '/dev/null' },
+          GIT_NO_LAZY_FETCH: '1', GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: '/dev/null', GIT_GRAFT_FILE: '/dev/null' },
         stdio: ['ignore', 'pipe', 'pipe'],
       });
     } catch (error) {
@@ -46,6 +46,14 @@ export function readHistory(repo: string, baseRef: string, headRef = 'HEAD', lim
     remaining();
     return result;
   };
+  // Parent-rewriting files are not immutable commit ancestry. Resolve via Git so
+  // linked worktrees use the common administrative directory as well.
+  const commonDirectory = resolvePath(repo, run('rev-parse', '--git-common-dir').toString().trim());
+  for (const name of ['info/grafts', 'shallow']) {
+    const path = join(commonDirectory, name);
+    if (lstatSync(path, { throwIfNoEntry: false }))
+      throw new Error(`Review repositories must not use graft or shallow ancestry metadata (${name}).`);
+  }
   // Inspect storage without following links before any object-resolving command.
   const objects = resolvePath(repo, run('rev-parse', '--git-path', 'objects').toString().trim());
   const pending = [objects];

test/history.test.ts

@@ -315,3 +315,16 @@ it.each(['P1', undefined])('retains deletion and recreation owners on reused-pat
   expect(card.owners).toEqual([owner ?? null, 'P2']);
   expect(card.row).toBe(owner ? 'Ambiguous' : 'Unplanned');
 });
+
+it('rejects local grafts that make an unrelated commit appear descended from the base', () => {
+  const f = fixture(); f.git('checkout', '--orphan', 'unrelated'); f.git('rm', '-rf', '.');
+  f.write('a.txt', 'unrelated history\n'); const head = f.commit('P1');
+  f.write('.git/info/grafts', `${head} ${f.base}\n`);
+  expect(() => readHistory(f.dir, f.base, head)).toThrow(/graft/i);
+});
+
+it('rejects shallow parent rewriting before loading history', () => {
+  const f = fixture(); f.write('a.txt', 'changed\n'); const head = f.commit('P1');
+  f.write('.git/shallow', `${head}\n`);
+  expect(() => readHistory(f.dir, f.base, head)).toThrow(/shallow/i);
+});