Skip to main content

Git repositories

Kule needs no git, but when a workspace is a git repository, Kule reads .git as a repository, not as files. Otherwise every git status would look like a change: it rewrites .git/index, every ref update appends to the logs, and git maintenance adds and removes lock files in the background.

What an agent's git work looks like​

An agent that edits main.rs and commits in the copy:

1 file changes: +0 ~1 -0
  ~ main.rs
      ~ function main
      + function check
git: main 86eba66 → 82180a4 · fast-forward · 1 commit
git: 3 new object files · index changed

With kule commit, the branch moves in your real repository too, after the policy and your review.

How each part is judged​

PartHow Kule judges it
ObjectsOnly ever added. Undo leaves them for git gc.
References (branches, tags)Checked by value. A human commit on the branch the agent moved is a conflict; git pack-refs, or switching branches and back, is not.
The indexCompared by its entries, not its stat data, so git status in the workspace blocks neither commit nor undo.
Staged filesWhat the task stages must be what its files hold. An entry staged with other content (or taken out of the index while its file stays) waits for you, since the next git commit would record what nobody reviewed.
Config and hooksReported on lines of their own, because they make the next git command run code.
git: config changed (it can make the next git command run code)
git: hook pre-commit changed (it runs on the next matching git command)

What the policy says about git​

With the balanced policy:

  • moving a branch forward (fast-forward) and creating a new branch pass on their own;
  • history rewrites, deleting a branch, switching HEAD, tags, notes and replacements wait for you;
  • git config changes wait for you;
  • git hooks are denied, a nested repository's too: they would run on your next git command, as you.

Git hosts are not package registries: a connection to github.com waits for you, because inside TLS a push cannot be told apart from a fetch.

Git config and hooks protect your terminal too​

While a task has changed the copy's git config or hooks, Kule refuses to open a terminal in the copy (and kule shell), and refuses to open the copy in an editor: your prompt's git status would run them outside the sandbox. kule path warns on stderr. Review and commit or roll them back first.

Worktrees​

A worktree's repository next to the workspace stays readable to the task, so git works in the copy as it does in the folder.