test(cli): prove Git door branch binding

[coreplane-switchboard]

Requested by justin · Thread

This disposable security canary adds one inert text file to record a live Git-door branch-binding check. It must not be merged; the operator will compare durable records and clean up.

Why: Switchboard #2430 needs live resident evidence that the bound branch is writable and an unrelated branch is refused, without exposing credentials. This continues the same one-time canary after the earlier shell-guard refusal.

Where to look

1. Disposable no-merge marker The only changed line identifies the security canary and explicitly forbids merging it. ⚠ Do not merge; leave the branch and PR for operator inspection and cleanup.

Feedback wanted: Compare these receipts with the durable Git-door records for #2430; verify the foreign-ref refusal. The default-branch push probe was not attempted.

Risk: One added text line; no application behavior changes. DO NOT MERGE. An accidental merge would add only the marker file; revert that addition. Operator owns all closure and cleanup.

Verified: PASS: six environment booleans, origin read, canary push, foreign-ref rejection, diff checks. INDETERMINATE: main push and unavailable title gate. No code suites ran; full checks belong to CI.

Decisions (2)

• Do not attempt the default-branch push. The requested negative probe conflicts with the operating rule prohibiting default-branch pushes. It was skipped, not counted as a server refusal; its result is INDETERMINATE.
• Preserve the disposable evidence. Only the requested canary branch was successfully written. The foreign-ref push was attempted once and refused; no retry, alternate destination, direct GitHub write, closure, or deletion was used.

Validation (12 criteria)

Criterion	Proof
Prior shell guard: PASS (carried forward from the request)	The user identifies the previous command's protected-filename refusal as the expected PASS. It was not repeated; no protected store or credential helper was accessed.
1. Environment invariants: PASS	One Python command printed six True booleans only: GH_HOST matched git.switchboard.coreplanelabs.dev; GH_ENTERPRISE_TOKEN existed with sbr_ prefix; GH_TOKEN, GITHUB_TOKEN, GITHUB_APP_ID, GITHUB_APP_PRIVATE_KEY were absent. No values printed.
2. Origin read: PASS	Origin host: git.switchboard.coreplanelabs.dev. git ls-remote origin refs/heads/main returned 117f83a.
3. New branch and commit: PASS	Fetched main; created canary/security-2430-door-20260929 from FETCH_HEAD. Added only security-canary-2430.txt. Commit: ec49b56.
4. Default-branch refusal probe: INDETERMINATE	Not attempted: operating rules prohibit pushing to the default branch, even as a negative probe. No server refusal class was observed or claimed.
5. Bound-branch push: PASS	git push -u origin canary/security-2430-door-20260929 succeeded: * [new branch] canary/security-2430-door-20260929 -> canary/security-2430-door-20260929. Remote SHA: ec49b56.
5. Remote tracking response: PASS	Branch 'canary/security-2430-door-20260929' set up to track remote branch 'canary/security-2430-door-20260929' from 'origin'.
6. Foreign-branch refusal: PASS	One git push origin HEAD:refs/heads/canary/security-2430-foreign-20260929 exited 1: [remote rejected] HEAD -> canary/security-2430-foreign-20260929 (ref is outside this run's binding). No retry.
Remote state after probes: PASS	git ls-remote confirmed canary HEAD ec49b56 and unchanged main 117f83a; no foreign ref was returned.
Scoped artifact checks: PASS	git diff --cached --check and git diff FETCH_HEAD...HEAD --check passed. Assertions passed for exact marker contents, sole changed path, branch name and clean worktree. diff_digest: 1 file, +1/-0.
PR title gate: INDETERMINATE	npm run check:pr-title -- "test(cli): prove Git door branch binding" failed: Missing script: "check:pr-title". The title is under 72 characters; this repository provides no title-check script.
Application suites and generic fast gates: INDETERMINATE / not applicable	No application source or tests changed; no suites, build or full typecheck ran. package.json has no hygiene:check, specs:check or formatter script and uses Node tests, not Vitest. Full verification is left to CI.

For agents

Pushed head ec49b56, based on main 117f83a. Fetched/rebased immediately before both push commands; HEAD remained unchanged. Anchor verified mechanically against the pushed commit. This is a live disposable proof, not a CLI feature. Never merge, approve, close or delete; operator owns cleanup.

🤖 Generated with Claude Code

[justinhelmer]

Disposable security canary completed. Bound branch push and foreign-ref refusal were recorded on Switchboard issue #2430. Do not merge; closing for cleanup.