Artifact 03180569f9a86cc27c0e2b71518cca51fdb1a74c34d7f37867a3fa3f9c8563db:
- File
docs/rfcs/0007-protected-branches.md
-
2026-08-26 21:17:55
— part of check-in
[2eff0c5d61]
on branch rfc-0007-review
— RFC 0007: fold reads the merge unconditionally; the gate owns fail-closed
Three amendments from review, now that zit#151 has shipped.
The fold's DAG-based reading applied only to protected targets, so adding or deleting a protection row re-judged every landing on that branch — the thing Disposability forbids. It is now unconditional: a DAG fact is the same fact under any policy. The merge is identified structurally (non-primary parent on the proposed branch, bounded by the open date), not by tip ancestry, which breaks for a branch merged and then continued.
zit#151 shipped with an absent header meaning no rule. Correct for a bare server; behind a front it means a gate bug silently disables protection. The RFC now records that and places three obligations on the gate: always set the header, strip the inbound one, prove both.
Test matrix gains the missing rows; What-this-is-not records the supersede interaction; build order marks phase 0 done. (user: dmestas, size: 22177) [annotate] [blame] [check-ins using]
- 2026-08-26 22:50:13 — part of check-in [c74cc272cb] on branch trunk — Accepted. The fold reads a fact; the gate owns the guarantee. (user: dmestas, size: 22177) [annotate] [blame] [check-ins using]
-
2026-08-26 21:17:55
— part of check-in
[2eff0c5d61]
on branch rfc-0007-review
— RFC 0007: fold reads the merge unconditionally; the gate owns fail-closed