Reject borrowed Git object stores and verify rename evidence

Author: mchwang

README.md

@@ -43,7 +43,7 @@ Inputs such as `planText` and the ledger must come from the caller. The future `
 
 ## Current limits and safety
 
-- History must be linear and descend from the requested base. Merge histories are rejected with a rebase instruction. Reads are bounded to 500 commits, 32 MiB per Git response, and a 2-second budget per line diff; oversized work fails explicitly.
+- History must be linear and descend from the requested base. Merge histories are rejected with a rebase instruction; repositories using object alternates are rejected. Reads are bounded to 500 commits, 32 MiB per Git response, and a 2-second budget per line diff; oversized work fails explicitly.
 - Ownership uses line diffs, not semantic inference. Within one replacement block, new lines inherit all affected owners conservatively. Function context comes from Git hunk headers, not an AST.
 - The importer requires an accurate base-file list. It rejects path traversal, Git metadata paths, and traversal through a listed file/symlink/submodule. Runtime symlink and write-scope enforcement belong to the future container/runner; plan validation alone is not a sandbox.
 - Allowed commands restrict accidents, not hostile programs or changed scripts. Parsing returns argv and never executes it. An unlisted valid command is a warning and must not run until allowed.

docs/implementation/build-step-1.md

@@ -41,6 +41,12 @@ Declined the claim that repository aliases can override `rev-parse`, `rev-list`,
 
 Fixed inherited Git environment redirection. A regression with `GIT_DIR` pointing at a second repository initially returned the foreign repository's content. The adapter now drops inherited `GIT_*` variables, ignores global/system Git configuration, and disables lazy fetch and transport access. The same regression now reads only the requested repository.
 
+## Review rounds 3–4
+
+Round 3 reviewed the pre-fix commit and repeated the environment finding; the existing fix resolved it. Round 4 exposed repository-local object alternates, reproduced by reading borrowed history from a second repository. The adapter now rejects an alternates file before resolving commits.
+
+Declined adding rename-only ownership to later text edits. The approved design represents a no-content rename as a separate file-change segment. A real-Git test confirms that a foreign rename remains an Unplanned file card while the later P2 text edit belongs to P2; the rename has not disappeared from review. Text edits before a rename still retain their line ancestry. Scope tests now explicitly require nonempty P2 rows.
+
 ## Remaining gates
 
 This is a working foundation, not a completed application or a claim that all implementation tasks are done. T18's pure validation/edit core is present; its agent adapters, import UI, and persistence are pending. Ledger storage, rebase mappings, and the read-only review screen remain next. The already-fixed GitHub check belongs to the later GitHub/runner integration.

git/history.ts

@@ -1,4 +1,6 @@
 import { execFileSync } from 'node:child_process';
+import { lstatSync } from 'node:fs';
+import { resolve as resolvePath } from 'node:path';
 import type { FileDelta, FileVersion, History } from '../core/linking.ts';
 
 /** Read-only Git adapter. Never follows working-tree symlinks or runs diff helpers. */
@@ -11,6 +13,8 @@ export function readHistory(repo: string, baseRef: string, headRef = 'HEAD'): Hi
       GIT_NO_LAZY_FETCH: '1', GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: '/dev/null' },
     stdio: ['ignore', 'pipe', 'pipe'],
   });
+  const alternates = resolvePath(repo, run('rev-parse', '--git-path', 'objects/info/alternates').toString().trim());
+  if (lstatSync(alternates, { throwIfNoEntry: false })) throw new Error('Review repositories must not use object alternates.');
   const resolve = (ref: string) => run('rev-parse', '--verify', '--end-of-options', `${ref}^{commit}`).toString().trim();
   const base = resolve(baseRef), head = resolve(headRef);
   const records = run('rev-list', '--reverse', '--parents', `${base}..${head}`).toString().trim().split('\n').filter(Boolean);

test/history.test.ts

@@ -142,6 +142,7 @@ it('checks scope at each owning commit, not against both ends of a final rename'
   f.plan.items[1]!.files = [{ path: 'b.txt', kind: 'edit', renamed_from: null, change: 'Edit new name' }];
   renameSync(join(f.dir, 'a.txt'), join(f.dir, 'b.txt')); f.commit('P1');
   f.write('b.txt', 'ONE\ntwo\nthree\n'); f.commit('P2');
+  expect(f.segments().some(s => s.row === 'P2')).toBe(true);
   expect(f.segments().filter(s => s.row === 'P2').every(s => s.scope === 'in-scope')).toBe(true);
   // Declaring only the old name must not authorize edits to the new one.
   f.plan.items[1]!.files[0]!.path = 'a.txt';
@@ -152,6 +153,7 @@ it('checks scope of deletion after a rename using the deleted current path', ()
   f.plan.items[1]!.files = [{ path: 'b.txt', kind: 'delete', renamed_from: null, change: 'Delete' }];
   renameSync(join(f.dir, 'a.txt'), join(f.dir, 'b.txt')); f.commit('P1');
   rmSync(join(f.dir, 'b.txt')); f.commit('P2');
+  expect(f.segments().some(s => s.row === 'P2')).toBe(true);
   expect(f.segments().filter(s => s.row === 'P2').every(s => s.scope === 'in-scope')).toBe(true);
 });
 
@@ -173,3 +175,21 @@ it('isolates repository selection from inherited Git environment variables', ()
     if (previous === undefined) delete process.env.GIT_DIR; else process.env.GIT_DIR = previous;
   }
 });
+
+it('rejects repository-local object alternates before reading borrowed history', () => {
+  const source = fixture(); source.write('a.txt', 'borrowed content\n'); source.commit();
+  const borrower = fixture();
+  writeFileSync(join(borrower.dir, '.git/objects/info/alternates'), join(source.dir, '.git/objects') + '\n');
+  expect(() => readHistory(borrower.dir, source.base, source.git('rev-parse', 'HEAD'))).toThrow(/alternates/i);
+});
+it('keeps a foreign rename on its file card while attributing later text edits', () => {
+  const f = fixture();
+  renameSync(join(f.dir, 'a.txt'), join(f.dir, 'b.txt')); f.commit();
+  f.plan.items[1]!.files[0]!.path = 'b.txt';
+  f.write('b.txt', 'ONE\ntwo\nthree\n'); f.commit('P2');
+  const parts = f.segments();
+  expect(parts.find(s => s.kind === 'file')?.row).toBe('Unplanned');
+  const text = parts.filter(s => s.kind === 'text');
+  expect(text.length).toBeGreaterThan(0);
+  expect(text.every(s => s.row === 'P2' && s.scope === 'in-scope')).toBe(true);
+});