Skip to content

Keep the knowledge branch out of the public repo - #37

Merged
epifanio merged 1 commit into
mainfrom
fix/agent-memory-push-guard
Nov 6, 2026
Merged

epifanio merged 1 commit into
mainfrom
fix/agent-memory-push-guard

Conversation

@epifanio

@epifanio epifanio commented Nov 6, 2026

Copy link
Copy Markdown
Collaborator

A guard that silently stopped guarding.

The agent-memory branch is never published — its history predates this project's no-attribution rule, and metno/pysent is public. The guard against pushing it lived in .git/hooks/pre-push, and installing the session system set core.hooksPath to .githooks, which made git ignore it. Nobody would have noticed: pushing that branch is still refused today, but by the commit-identity check rejecting its old authorship, not by anything protecting the branch. Clean those commits and it would publish.

The fix

The guard moves into the versioned .githooks/pre-push, so it holds on every clone and every worktree instead of only on the machine that happened to have it. It tests the destination, not the branch:

push result
agent-memory → metno/pysent (public) refused, exit 1
agent-memory → epifanio/pysent-memory (private backup) allowed, exit 0
any other branch → anywhere untouched, still identity-checked

All three verified by feeding the hook the refs git would.

One deliberate exemption

The backup push also skips the commit-identity check. Those 38 commits predate both that rule and the attribution one, and rewriting archival history to satisfy a rule written afterwards would destroy the thing being preserved. The branch never reaches the project, so the checks that guard the project's history do not apply to it.

Found while answering "what do I run on a laptop that has never seen pysent?" — the answer includes git config core.hooksPath .githooks, which is what exposed it.

The agent-memory branch is never published: its history predates this
project's no-attribution rule and metno/pysent is public. A guard
against pushing it lived in .git/hooks/pre-push - and installing the
session system set core.hooksPath to .githooks, which made git ignore
it. A guard that silently stopped guarding is worse than none, because
nobody thinks to check.

Versioned here it holds on every clone and every worktree, and tests
the destination rather than the branch: a push to the private memory
repo is a backup and is allowed, a push anywhere else is refused.

The backup push also skips the commit-identity check. Those
thirty-eight commits predate both that rule and the attribution one,
and rewriting archival history to satisfy a rule written afterwards
would destroy the thing being preserved. It never reaches the project,
so the checks that guard the project's history do not apply to it.

Verified in all three directions: agent-memory to the public remote
exits 1, agent-memory to the memory remote exits 0, an ordinary branch
to the public remote is untouched and still identity-checked.
@epifanio
epifanio merged commit 5581144 into main Nov 6, 2026
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant