Skip to main content

Source Control & Git

A coding run does not shell out to git and hope. Source control is a governed engine: repositories are connected and browsed through the Repositories console, every git operation is graded by how consequential it is, and the two genuinely destructive operations are guarded twice while the trail-rewriting ones are not exposed at all. This page covers repository support, graded git authority, and per-workspace build and dependency hygiene.

The coding run that drives these operations is documented in the coding agent; the surface a developer touches is on Software engineering on the platform.

The SCM engine​

The coding agent composes an SCM engine that also stands on its own. It provides:

  • Git sync with branch operations over three transport backends.
  • SSH commit signing, so a commit carries a verifiable signer.
  • Credential handling and pull-request execution.
  • Webhooks, and clean / smudge filters so notebooks diff sensibly.

The Repositories console exposes the read side of this: connect a repository, list bindings, browse branches, read the log, and read a diff.

Graded git authority​

Git write authority is graded by consequence, and the grading is enforced at dispatch, not by convention. Read operations are always safe; consequential operations are gated by permission mode and registered with a concrete affected-entity extractor; the two destructive operations require a dual gate; and the operations that rewrite history are simply never exposed as tools.

Figure SE2: graded git authority. Read operations (slate) are always safe. Create-branch, checkout, commit, and open-PR (cyan) are consequential and gated by permission mode, each registered with a concrete affected-entity extractor. Hard reset and branch delete (amber) require a dual gate, both an operator capability set at construction and an explicit per-call flag. Force-push, commit --amend, rebase, and filter-branch (red) are not exposed as tools at all: the strongest guard against an agent rewriting an audit trail is non-exposure. This grading is live in the SCM engine.

Table equivalent

TierOperationsGuard
Read-safegit_status, git_diff, git_log, git_branchesNone: always available
Consequentialgit_create_branch, git_checkout, git_commit, git_create_prGated by permission mode; registered with a concrete affected-entity extractor (a consequential tool without one is refused at registration)
Destructive (dual gate)git_reset (hard reset), git_branch_delete (force-delete)Requires both an operator capability set at construction (unreachable from tool arguments) and an explicit per-call flag
Not exposedForce-push, commit --amend, rebase, filter-branchNever registered as tools: non-exposure is the guard
The edge is tighter, not looser

On the disconnected Edge Agent, the same git surface carries the same dual gate and the same non-exposure, and adds a rule the connected side does not need: any caller-supplied value beginning with - is refused, so a model cannot smuggle --force through a branch-name field. Every edge process runs through one runaway-guarded execution primitive (argv, never a shell) so there is no injection surface.

Every commit is scanned before it lands​

Consequential git authority is only half the story: nothing commits until it is scanned. A fail-closed pre-commit assurance gate runs in-sandbox over the pending changeset, secrets detection, static analysis, and licence / SBOM checks, and any secret, any medium-or-high static-analysis finding, or any disallowed licence blocks the commit. The gate and the signed receipt every applied diff produces are documented in the governance with no rival counterpart.

Build and dependency hygiene​

Source control is only useful if the tree it governs can build. Two mechanisms carry that:

  • Bootstrapped environments. A fresh checkout has source and nothing else, so dependencies are installed once, before the first verify, across seven language families (Python, Node, Rust, Go, Java, and .NET), with a monorepo walk that detects and reports each sub-project separately. The install runs inside one bounded egress window whose registry host is authorised by the egress broker; an off-allowlist registry is refused, and after the window the network is sealed and the run is offline.
  • Per-workspace library and virtual-environment management carries CVE scanning on dependencies, so a known-vulnerable dependency is surfaced rather than silently pulled in.

Delivery: CI/CD​

Delivery is a stage-by-stage pipeline runner with manual approval gates, dev → staging → prod promotion, and rollback, all reachable from the CI/CD console. The CI/CD console exposes pipelines, runs, an approval queue, promotions, and rollbacks, and an operator can approve, reject, and roll back in place.

See also​