Development record
Several hardenings shipped in v0.13.4 switch a repository's own git settings off for abcd's commands, and need re-assessing against the security scope rule adopted on 2026-10-11 (principle abcd-fixes-what-it-adds: abcd never changes how a repository works on its own, and prevents an existing risk only where it can do so without such a change). Known instances: a sync's merge makes every configured merge driver git's built-in merge (gitutil.MergeDriverOverrides), so a repository's own lockfile or union-style driver is ignored on abcd's sync; the pick commit runs with commit.gpgsign=false and hooks off (gitutil.ExecPins via pickGit), so it is unsigned where the repository requires signed commits; the toplevel check refuses a checkout whose core.worktree names an ancestor, which refuses a deliberately configured layout. Reads that blank content filters (gitutil.FilterOverrides) change no repository behaviour and are likely fine.
Several hardenings shipped in v0.13.4 switch a repository's own git settings off for abcd's commands, and need re-assessing against the security scope rule adopted on 2026-10-11 (principle abcd-fixes-what-it-adds: abcd never changes how a repository works on its own, and prevents an existing risk only where it can do so without such a change). Known instances: a sync's merge makes every configured merge driver git's built-in merge (gitutil.MergeDriverOverrides), so a repository's own lockfile or union-style driver is ignored on abcd's sync; the pick commit runs with commit.gpgsign=false and hooks off (gitutil.ExecPins via pickGit), so it is unsigned where the repository requires signed commits; the toplevel check refuses a checkout whose core.worktree names an ancestor, which refuses a deliberately configured layout. Reads that blank content filters (gitutil.FilterOverrides) change no repository behaviour and are likely fine.
Frontmatter
| id | iss-2610111729399920 |
|---|---|
| type | issue |
| lifecycle | resolved |
| severity | minor |
.abcd/work/issues/resolved/iss-2610111729399920-review-shipped-hardenings-against-scope.md
open on GitHub ↗ · commit history ↗
mentions3
- iss-2610120640452939Under the security scope rule (abcd never changes how a repository works on its own), abcd's lane creation (git worktree add, which runs a post-checkout hook) and a restart's reset and clean still run with core.hooksPath=/dev/null, gc.auto=0 and maintenance.auto=false through pickGit/WorkingTreeCommand, while the pick commit and sync merge were handed back to the repository's own settings by iss-2610111729399920. Found by lane C on 2026-10-12.
- iss-261025221433846734-build.md:191-193 says the pick's record commit is made 'with hooks off'. pickcommit.go:18-21 and commands/build.md:216-219 say the repository's hooks and signing run (iss-2610111729399920, resolved without updating the brief).
- spc-2609301811532881The worktree store: `abcd ahoy worktree add|list|prune`, one lane primitive, and a notes archive beside it