gate: annotate the adoption rules at their enforcement points
commit
62bdf62gate: annotate the adoption rules at their enforcement points
gate.adoption-merge and gate.same-actor-divergence are enforced by the any-parent descent check plus tip-only signature judgment; gate.adoption-no-fast-forward by the authorized-signer refusal. Tracey now shows them covered where verify() actually enforces them. gate.adoption-no-cherry-pick and gate.mandatory-hosted remain deliberately uncovered here (sync tooling and receive respectively).
Assisted-by: Claude:claude-fable-5
Reviews
No reviews of this commit yet — record a verdict below.
Start a review
crates/ents-gate/src/verify.rs
@@ -188,7 +188,11 @@
break;
}
}
- // @relation(gate.tip-signed, gate.bootstrap, scope=function)
+ // A tip whose signature belongs to no authorized member is refused
+ // even when it fast-forwards cleanly — which is exactly why
+ // fast-forwarding a canonical ref directly to a contributor's
+ // commit cannot be adoption (gate.adoption-no-fast-forward).
+ // @relation(gate.tip-signed, gate.bootstrap, gate.adoption-no-fast-forward, scope=function)
let Some((id, member)) = signer else {
return refuse(
Requirement::TipSigned,
@@ -237,7 +241,12 @@
// gate.fast-forward: the parent hash is the anti-replay freshness
// binding; the CAS precondition below pins the same old tip.
- // @relation(gate.fast-forward, scope=function)
+ // Descent through *any* parent suffices, and only the tip is
+ // signature-checked — which is what makes an authorized member's
+ // merge the adoption mechanism (gate.adoption-merge) and the
+ // resolution for a member's own racing machines
+ // (gate.same-actor-divergence).
+ // @relation(gate.fast-forward, gate.adoption-merge, gate.same-actor-divergence, scope=function)
if let Some(old) = old
&& !descends_from(objects, new, old)?
{