Repository navigation

fix(ship): refuse to ship a change that touches a protected path - #992

Merged

thewrz merged 11 commits into

mainfrom

Oct 6, 2026

Merged

fix(ship): refuse to ship a change that touches a protected path#992
thewrz merged 11 commits into
mainfrom
fix/issue-986

Commits on Oct 6, 2026
- fix(plan): protect subpaths of a bare AGENT_PROTECTED_PATHS entry
  
  mergetest
  and
  claude
  committed
  b8b86ef
- fix(ship): refuse protected paths before committing or pushing
  
  mergetest
  and
  claude
  committed
  6312267
- test(plan): pin protected_hit semantics per entry shape
  
  mergetest
  and
  claude
  committed
  c6010db
- fix(ship): match protected paths literally and through renames
  
  mergetest
  and
  claude
  committed
  7a9024b
- fix(ship): fail closed when the base cannot be listed
  
  mergetest
  and
  claude
  committed
  86cb159
- fix(ship): read protected entries the way ak plan does
  
  mergetest
  and
  claude
  committed
  b3f4fa5
- fix(ship): harden the protected-path guard
  
  mergetest
  and
  claude
  committed
  b4237c3
- fix(ship): refuse when the protected-path policy file is unreadable
  
  mergetest
  and
  claude
  committed
  9248f75
- Merge remote-tracking branch 'origin/fix/issue-988' into fix/issue-986
  mergetest
  committed
  5d0ce73
- fix(plan): refuse to plan when the protected-path policy is unreadable
  
  mergetest
  and
  claude
  committed
  c6e22d0
- Merge remote-tracking branch 'origin/main' into fix/issue-986
  
  mergetest
  and
  claude
  committed
  f59bfb5