Add a fail-closed pre-push validation gate in GitOperations

[eshulman2]

Problem

Forge's implementation agents modify repository workspaces, while trusted Forge code owns commits, pushes, PR creation, and Jira/GitHub mutations. Code changes need one fail-closed validation boundary immediately before Git push.

This issue should not recreate Fullsend's artifact upload/download pipeline: Forge commonly uses a bind-mounted workspace or shared PVC. Driver-specific transfer validation belongs to drivers that actually transfer archives or files.

Proposed solution

Add a trusted pre-push gate in GitOperations that validates repository changes against the trusted base revision:

• protected exact/glob paths sourced from Forge configuration or the base revision
• unsafe symlinks and Git paths that escape or ambiguously resolve outside the repository
• per-file and aggregate change-size bounds
• malformed or unavailable trusted base references
• a composable validator interface for Scan agent-derived code and text for secrets before publication #77 secret scanning and future deterministic checks
• structured, redacted failure results

This boundary protects Git publication. Agent-derived Jira/GitHub text is validated by its originating workflow node before the trusted integration client is called.

Acceptance criteria

• Both synchronous and asynchronous Forge push paths use the same gate.
• Validation compares against a trusted origin/merge base.
• Protected paths support Forge defaults and trusted per-repository configuration.
• Unsafe symlinks/path resolution and bounded-size violations fail closed.
• Missing or malformed required policy/base state fails closed.
• Validators such as Scan agent-derived code and text for secrets before publication #77 compose into one pre-push decision rather than adding parallel hooks.
• Results are structured and redact sensitive values.
• Tests cover additions, modifications, deletions, malicious symlinks, protected globs, oversized changes, missing base refs, and valid changes.
• Driver-specific upload/download validation is handled separately when a driver transfers workspace data.

Related issues

• Scan agent-derived code and text for secrets before publication #77: secret scanning
• Add repository-owned deterministic validation before PR creation #174: repository-owned deterministic validation before PR creation

Estimate

AI-assisted: 3–5 engineering days, excluding #77.