feat(sidecar,shell): HGW runtime stack #80–#84 (project write policy, project_create, 24-step turns, auto-approve, git safety)

[SaulBuilds]

Lands the whole HGW runtime stack in one squash (owner decision 2026-10-15): #80 project write policy + git in the sandbox (HGW-W2), #81 project_create (HGW-W3), #82 24-step turns + failure output (HGW-W5/W6), #83 auto-approve list + build e2e (HGW-W11), and this PR's git cleanup + member commit identity. Each was reviewed and approved on its own PR; #80–#83 close as landed here. Retargeted to main after #79; the merge of main changes no files relative to the approved head.

Follow-up to the HGW-W2 stack (#79 → #83), carrying the owner's runtime decisions of 2026-10-15 on #79–#83 (recorded in the HUP owner-decisions log).

1. Risky git state a run adds is reverted (was: reported)

After every shell_run (and every runner) run, citrate-agent-shell reverts what the run added that would make git start a program outside the sandbox later, and reports each revert in RunReport.git_warnings (the shell_run summary says the changes were undone):

• config entries: core.hooksPath, core.fsmonitor, core.sshCommand, core.pager/editor/askPass/gitProxy, alias.*, filter.*, diff/merge drivers, credential.*, include.path/includeIf.*.path, non-https url.*.insteadOf, protocol.*.allow=always, gpg.program, tool cmd/path, upload/receive-pack hooks; plus trailer.*, commit.cleanup, core.commentChar/commentString (they could drop the Hermes trailer);
• new hook files (not *.sample); a hooks folder or .git/config swapped for a symbolic link is put back.

Normal config (user.*, remote.*, branch.*, core.autocrlf, https mirrors) stays. What was there before the run is never touched. A .git the run turned into a pointer (gitdir: file or symlink) is reported with the risky state where it points, not changed (it may be the member's own folder).

2. Commit identity + Co-authored-by: Hermes trailer

New agent-sidecar/src/git_identity.rs:

• Author/committer = the identity the app passes (CITRATE_HERMES_GIT_USER_NAME + CITRATE_HERMES_GIT_USER_EMAIL, both set and valid; this is the input core will wire), else the member's own global git config (user.name/user.email, read once at startup with the real git, empty env but HOME), else Hermes <hermes@citrate.invalid>. Passed as GIT_AUTHOR_*/GIT_COMMITTER_*, which outrank every config file.
• git commit gets --trailer "Co-authored-by: Hermes <hermes@citrate.invalid>" after the subcommand. Command-scope config (outranks the repo's) forces trailer.ifmissing=add, ifexists=addIfDifferent (global and for co-authored-by) and core.commentChar=#, next to the existing hooks/fsmonitor-off pair ([v0.5.1 HGW-W11] Auto-approve safe-command list (amended D-16) #77).
• Refused before the member is asked, saying why (so it can't be dropped silently): -c/--config-env for user.*, author.*, committer.*, trailer.*, include*, core.commentChar/commentString, commit.cleanup; in git commit, --author, --cleanup, -C/-c/--reuse-message/--reedit-message (git's unique-prefix abbreviations included; option values such as -m "--author=x" are not mistaken for options); git commit-tree.

The approval card still shows the model's exact argv; the trailer is added by the runtime.

Scope limits: commits from merge/cherry-pick/revert/am carry the member identity but no trailer. A non-git program (e.g. a member-approved sh -c "git commit") gets neither. A repo config from before the run that aliases another trailer token to Co-authored-by with its own ifMissing could still suppress the trailer.

Tests (red first)

• agent-shell: a_git_pointer_made_by_the_run_is_reported_not_followed_into_changes (new); the revert tests in tests/sandbox.rs (incl. real git under Seatbelt); git_state unit tests for the trailer keys.
• agent-sidecar: git_runs_carry_the_commit_identity_and_other_programs_do_not, the_commit_identity_resolves_app_then_member_git_config_then_hermes, the_app_sets_the_commit_identity_through_the_environment, the_members_global_git_config_is_read_for_the_identity, a_commit_carries_the_member_identity_and_the_hermes_trailer (real git; the repo's trailer.ifmissing=doNothing + commentChar=C do not drop it), a_commit_that_would_change_the_author_or_drop_the_trailer_is_refused_before_asking; 4 unit tests in git_identity.
• Local: cargo test --workspace 2317 passed / 0 failed (macOS). clippy has no findings in agent-sidecar/agent-shell, and fmt is clean for both. The audit check fails on main as well, from new upstream advisories; a separate PR fixes it.

Core follow-up: pass the member's identity via the two env vars when spawning the sidecar (core wiring lane, identity passthrough).

🤖 Generated with Claude Code

https://claude.ai/code/session_018wWZZ8GRVU9USh3kKQHsFe

[SaulBuilds]

📡 DGX team: Linux bwrap run proof for the HGW stack (#79 → #84)

The owner asked DGX to run the Linux sandbox tests, since they can't run on macOS. This branch (hgw/w1-git-safety, top of the stack) contains all of #79–#84. On a Linux box with bubblewrap installed (Ubuntu: sudo apt-get install -y bubblewrap; unprivileged user namespaces must be enabled):

git clone https://github.com/CitrateNetwork/citrate-agent-runtime.git && cd citrate-agent-runtime
git checkout hgw/w1-git-safety && git rev-parse HEAD
bwrap --version
# Fail instead of skip when bwrap is missing or broken:
CITRATE_REQUIRE_BWRAP=1 cargo test -p agent-shell --test sandbox -- --nocapture 2>&1 | tee bwrap-sandbox.log
CITRATE_REQUIRE_BWRAP=1 cargo test -p agent-sidecar 2>&1 | tee bwrap-sidecar.log

Please reply here with:

1. the commit sha, distro + kernel (uname -r), and bwrap --version;
2. pass/fail lines for writes_outside_the_grant_are_denied_under_bwrap, git_init_add_and_commit_work_inside_the_grant_under_bwrap, network_is_unshared_under_bwrap;
3. the test result: summary lines from both logs, and the full output of any failure.

If a test skips with "bwrap is unusable here", check sysctl kernel.unprivileged_userns_clone and (Ubuntu 24.04+) kernel.apparmor_restrict_unprivileged_userns. Report what you found before changing any setting on a fleet node.

[BerryManifold]

The new cleanup does not yet enforce the recorded owner requirement across every affected repository. A focused real-Seatbelt regression check confirmed that a command can leave executable git configuration outside the cleanup coverage. Holding approval until that boundary is enforced and covered by a regression test. Detailed reproduction is retained privately under the organization security policy; no exploit details are posted here.

[SaulBuilds]

@BerryManifold thanks. d312bd5 widens the post-run git cleanup so it is enforced across every repository the run could write:

• Discovery: each write root is walked before and after the run (symbolic links are not followed). It finds .git folders at any depth, bare repositories, linked worktrees (.git/worktrees/*) and submodule git folders (.git/modules/**). Repositories the run creates are reverted against an empty baseline.
• Files checked per git folder: config, config.worktree and hooks/.
• Pointers: a .git file or link, and commondir, are followed into a git folder inside the write roots and cleaned there. One that points outside them is reported and not changed.
• More risky keys: core.worktree, core.alternateRefsCommand, submodule.*.update = !…, hook.*, interactive.diffFilter, the sendemail commands, gpg.ssh.defaultKeyCommand, tar.*.command, guitool.*.cmd.
• Bounds: 300,000 entries and 48 levels per walk. If a walk stops early the report says so, and a repository the before-run walk didn't reach is reported, not changed.

New tests:

• through the runner: repositories_anywhere_in_the_write_roots_are_cleaned, worktree_config_and_submodule_git_folders_are_cleaned, a_git_pointer_outside_the_write_roots_is_reported_and_one_inside_is_cleaned;
• real Seatbelt: macos::git_state_anywhere_in_the_grant_is_cleaned_under_seatbelt and macos::a_hook_written_through_a_differently_cased_git_folder_does_not_survive;
• bubblewrap: linux::git_state_anywhere_in_the_grant_is_cleaned_under_bwrap, which the DGX run above will now include;
• units in git_state: walk coverage, walk bounds, nested write roots, new keys, and a pointer at a folder that isn't a repository (nothing there is changed).

Local cargo test --workspace: 2325 passed, 0 failed. If your private reproduction covers a case this misses, I'll add it.

[BerryManifold]

Approval submitted at the owner’s explicit direction. This does not retract or resolve the previously reported git-state cleanup finding; no new verification of a fix is claimed.

[Matr0xshka]

Approval submitted at the owner’s explicit direction. This does not retract or resolve the previously reported git-state cleanup finding; no new verification of a fix is claimed.

The base branch was changed.

[BerryManifold]

Reapproval submitted at the owner’s explicit direction. No new code review or verification of the previously reported finding is claimed.

[Matr0xshka]

Reapproval submitted at the owner’s explicit direction. No new code review or verification of the previously reported finding is claimed.