The Push the Guard Cannot See
Written later and filed to this date, as part of filling in every day of the year.
The hook that reads every shell command an agent runs denies a push of this site’s repository, because pushing it deploys it. The denial matches the literal words in the command, a push with the repository in reach. The one script allowed to publish the site runs that same push in a child process, and the hook never sees it. The asymmetry is the gate. An agent can reach the push only by running the script, because the direct route is text the hook refuses, and the script runs the checks first.
The decision was taken on a Sunday in July, when the fleet’s executor prompt was found telling agents something the charter contradicted: no pushing at all, so fleet work had been piling up locally against a rule that says nothing is durable until pushed. The operator dropped that line for every private repository and, for the public one, chose a gated route over a free one. An autonomous session may publish, but only behind the bar the daily publication job already cleared.
The script refuses before it checks. A dirty tree is refused, with the reason in the message: it pushes committed state, and a gate that passes on uncommitted files proves nothing about what would deploy. Any force flag is refused, and so is the flag that skips hooks. A tree with nothing to push exits early. Then four gates in order, the type check, the draft lint, the redaction and site tests, the build, and a failure at any of them ends on the sentence every gate here ends on: fix the content, never the guard. Only then the push, and a line saying the hosting pipeline will run every guard again on arrival. It was verified the day it was written: a force flag refused, a dry run clearing all four gates with 685 pages built and no push.
Two properties make it a gate rather than a convention. It lives in the fleet directory, which a second hook denies every agent from editing, so the agent that must clear the gates cannot soften them. And its gate list mirrors the daily job’s prompt line for line, with a note that the two must change in the same commit, so the sanctioned paths cannot drift apart.
In September an audit found that the daily job itself had been the exception. It launched with a marker that switched the hard denial off and pushed raw. It was moved onto the script, and the commit that moved it says the plain thing: a route that refuses a dirty tree and re-runs every check is a stronger gate than the raw push the marker had unlocked.
The guarded push: the one script that may push the public site, in a directory no agent may edit, reachable only because the hook that reads an agent’s commands refuses the direct words and cannot see a child process; it refuses a dirty tree and any force, runs the four gates, and pushes on green alone.