Agent contract

ck-git

Provider-neutral agent that manages git as a devops surface (integrate, publish, and future prune/tag/release) with evidence-based approval gates.

Role: deterministic-hybrid-integration-policy
Fibonacci level: L5
Module version: v0.1.0
Author: chiralkit
Created: 2026-08-21
Dependencies: None declared

Input

Required fields

requested_action
repository
source
destination
remote
declared_scope
expected_old_remote_oid
expected_new_local_oid
approval
lifecycle
fetch
git
gitnexus
sentrux
verification

remote: name
ref
approval: authorized_action
reason_codes
repository
source
destination
remote
declared_scope
expected_old_remote_oid
expected_new_local_oid
lifecycle: phase
lifecycle_phases: pre_merge
post_merge
post_publish
aborted
fetch: current
git: force_push_requested
remote_advanced
destination_aligned_with_remote
unrelated_changes
source_has_changes
semantic_conflict
conflict_free
scope_matches
secret_scan_clean
artifacts_expected
source_integrated
local_destination_oid
remote_destination_oid
gitnexus: risk
index_current
sentrux: status
verification: passed
post_merge_passed

Output states and sections

terminal_states: ready
approval_required
blocked
merged_local
published
no_change
aborted
policy_decision_fields: status
risk
reasons
permitted_actions
approval_action
approval_requirement
required_fields: repository
source
destination
remote
fetch
git
gitnexus
sentrux
verification
risk
lifecycle
approval
performed_actions
pending_action

Behavior and invariants

actions: assess
prepare
merge_local
publish
abort
policy_responsibility: deterministic_authorization_only
agent_responsibility: collect_normalized_evidence_and_render_full_result
provider_dependencies: false
command_execution: false

Capabilities

Required capabilities

filesystem.read: Inspect repository instructions and configuration.
shell.execute: Run bounded, non-interactive repository commands.
git.inspect: Read branches, worktrees, commits, diffs, conflicts, and remotes.
git.remote.fetch: Refresh remote-tracking references before comparison.
git.local.integrate: Commit or merge locally when policy authorizes it.
git.remote.publish: Publish only after explicit human approval.
quality.sentrux: Run quality analysis and parse its result.
code-intelligence.gitnexus: Query impact and changed execution flows.
verification.repository: Discover and run scope-appropriate checks.
approval.request: Stop and obtain explicit human authorization.

Optional capabilities

None declared

Runtime entries

Canonical entry

agent.md

Adapters

claude-code: adapters/claude-code.md
codex: adapters/codex.toml

Complete validated contract JSON

{
  "role": "deterministic-hybrid-integration-policy",
  "input": {
    "required": [
      "requested_action",
      "repository",
      "source",
      "destination",
      "remote",
      "declared_scope",
      "expected_old_remote_oid",
      "expected_new_local_oid",
      "approval",
      "lifecycle",
      "fetch",
      "git",
      "gitnexus",
      "sentrux",
      "verification"
    ],
    "remote": [
      "name",
      "ref"
    ],
    "approval": [
      "authorized_action",
      "reason_codes",
      "repository",
      "source",
      "destination",
      "remote",
      "declared_scope",
      "expected_old_remote_oid",
      "expected_new_local_oid"
    ],
    "lifecycle": [
      "phase"
    ],
    "lifecycle_phases": [
      "pre_merge",
      "post_merge",
      "post_publish",
      "aborted"
    ],
    "fetch": [
      "current"
    ],
    "git": [
      "force_push_requested",
      "remote_advanced",
      "destination_aligned_with_remote",
      "unrelated_changes",
      "source_has_changes",
      "semantic_conflict",
      "conflict_free",
      "scope_matches",
      "secret_scan_clean",
      "artifacts_expected",
      "source_integrated",
      "local_destination_oid",
      "remote_destination_oid"
    ],
    "gitnexus": [
      "risk",
      "index_current"
    ],
    "sentrux": [
      "status"
    ],
    "verification": [
      "passed",
      "post_merge_passed"
    ]
  },
  "output": {
    "terminal_states": [
      "ready",
      "approval_required",
      "blocked",
      "merged_local",
      "published",
      "no_change",
      "aborted"
    ],
    "policy_decision_fields": [
      "status",
      "risk",
      "reasons",
      "permitted_actions",
      "approval_action",
      "approval_requirement"
    ],
    "required_fields": [
      "repository",
      "source",
      "destination",
      "remote",
      "fetch",
      "git",
      "gitnexus",
      "sentrux",
      "verification",
      "risk",
      "lifecycle",
      "approval",
      "performed_actions",
      "pending_action"
    ]
  },
  "behavior": {
    "actions": [
      "assess",
      "prepare",
      "merge_local",
      "publish",
      "abort"
    ],
    "policy_responsibility": "deterministic_authorization_only",
    "agent_responsibility": "collect_normalized_evidence_and_render_full_result",
    "provider_dependencies": false,
    "command_execution": false
  }
}