fix(safecommit): bound and batch peer WIP reference attribution

[anthony-chaudhary]

Observed failure

While finishing independently green Astra guard issue #11548, an exact two-file fak commit remained active for more than 15 minutes without a completion/refusal. Process readback identified repeated git log -1 --format=%B refs/fak/wip/... work. No commit success is claimed. Coordinator requested cancellation of its owned pending command; the sanctioned managed-worktree landing path will be attempted only after termination and state verification.

Code evidence

internal/safecommit/peerwip.go resolveGitPeerOwner enumerates all refs/fak/wip refs then launches per-ref log and diff-tree commands for each target path. This admits O(paths * refs) subprocess amplification. Existing lock acquisition timeout is not a whole-operation deadline.

Bounded outcome and witness

Batch/cache ownership lookup for the invocation and propagate a whole-operation context deadline. Preserve peer ownership protections and fail closed on incomplete evidence; do not skip attribution or delete refs. One deterministic fake-Runner regression with many refs must assert bounded subprocess count and cancellation; a bounded real Git fixture must exercise the same attribution path.

Tier 3 harness / Enabling. For coding agents shipping explicit-path fixes; Problem long silent finish step; Today per-path per-ref scanning; Better because bounded, witnessed attribution without weakening gates. Include scan/setup cost in efficiency claims. Search open/closed resolveGitPeerOwner and safecommit WIP refs scanning found no duplicate. Related #11308 general subprocess cancellation, #11553 Astra guard comparison. No implementation yet.

[anthony-chaudhary]

Bounded uncommitted candidate ready for independent review at base 2f20858. Exactly peerwip.go and peerwip_test.go changed. Attribution scans refs once and reads each message/delta at most once, reusing results across paths: O(refs) subprocesses, not O(paths*refs). One table regression exercises fake and real Git fixtures (scope stamp, unstamped delta, self exclusion), default/inherited deadlines, cancellation, and lookup failures. WSL test.ps1 red exit 1 / green exit 0: 33 refs and four paths, 258 original versus 66 candidate subprocesses including status/enumeration (fixture construction excluded). 30-second budget covers attribution, not the entire commit operation. Full package has TestDetachedHead_isOffTrunk failure also reproduced with original source; not claiming package green. Diff, exact source hashes and logs preserved locally under _scratch/astra-guard-reliability/preserved-11812. No commit/land or worktree metadata change; mandatory landing blocker #11502 remains with repair peer. Source SHA256 peerwip.go ebd13ba8746968bc059e24e9857d28691a44ca4c37cb22e04f86fe287d710ca2; peerwip_test.go 8027dee1fd0ea5063db388c850169382c9f12d5f56671a972b831bc4c9effba5.

[anthony-chaudhary]

Operating-envelope review: read-only current repository enumeration found 9,648 refs/fak/wip entries. First candidate reduces repeated per-path scans (258 to 66 subprocesses on 33 refs/four paths) and fails closed on deadline, but still O(refs) subprocesses. Not accepted as usable recovery: could turn multi-minute stalls into 30-second refusals. Worker revising to batch metadata/delta queries across refs with a realistic roughly 10,000-ref fixture. No commit/land or completion claim.

[anthony-chaudhary]

V2 frozen for independent review; no commit/land. Supersedes v1 operating-envelope evidence: one ordered ref/object manifest plus length-framed metadata batch; immutable object deltas in 128-object chunks with root terminator. One table regression now uses 10,001 refs: real packed-ref fixture takes 5 attribution subprocesses; 10,000 distinct fake peer objects take 83. WSL test.ps1 green; strengthened real budget and callback-cancellation rows red on v1. Includes whole-record truncation, errors/cancellation, self sharing peer object, earlier delta over later scope. 30s attribution budget retained; not a whole-commit timeout and not a live-repository benchmark. Package NOT green: baseline detached-HEAD failure plus obsolete DiscoveredViaGitCheckpointsRefuses mock in safecommit_test.go. Exact two-file scope retained: coordinator must authorize migrating that third-file mock, preserving its assertion. v1 evidence retained distinctly; v2 patch/logs/hashes at _scratch/astra-guard-reliability/preserved-11812/v2. Frozen SHA256 peerwip.go 215633917d0d9a540f70b887de76d54ae087616e7947f2ad306d70b75e3d3c01; peerwip_test.go b8c0c2809732217aa69bb86056365af295e5693117a4600ea178323cf3a41075.

[anthony-chaudhary]

Coordinator independently witnessed frozen v2 hashes and WSL regression PASS (0.308s). Approved scope expansion only to internal/safecommit/safecommit_test.go, DiscoveredViaGitCheckpointsRefuses mock replies, with all existing collision/no-commit assertions unchanged. Exact three-path DOS lease re-admitted to issue-11812-astra-v3. No detached-HEAD behavior edits; no commit/land. Will preserve original-base assertion RED, rerun targeted/package checks, and freeze all three hashes.

[anthony-chaudhary]

V3 frozen, exact three approved paths. Production peerwip.go unchanged from reviewed v2. Old DiscoveredViaGitCheckpointsRefuses mock migrated; all original assertions retained and explicit no-git-commit-command assertion added. Strengthened SAME regression real fixture: 10,001 refs / 10,000 DISTINCT peer objects with 10,000-commit history and real delta per commit, constructed by one temporary-repo fast-import. Attribution 83 subprocesses in 752.876138ms; construction separately 7.764358798s; fixture total 8.517243924s. Not a five-call general envelope. Original-base overlay gives named real-git and callback-cancellation assertion RED, not build failure; all targeted tests GREEN. Full safecommit package GREEN 4.403s via canonical FAK_FAST=1 test.ps1 mirror /tmp/fak-safecommit-11812-v3-a8314e; exact three mirror hashes match. Earlier detached test failure depended on worker-marker CWD: baseOpts.Dir is /repo; production os.Getwd fallback and isSanctionedWorkerWorktreeDir(empty) permit that worker. Non-worker mirror exercises intended rejection with production/assertions unchanged. V3 receipts/diff/hash files preserved under _scratch/astra-guard-reliability/preserved-11812/v3. Frozen hashes: peerwip.go 215633917d0d9a540f70b887de76d54ae087616e7947f2ad306d70b75e3d3c01; peerwip_test.go 3a26293b1f73e73562513fba07411c513b2390e40af07354d1528c7634edb91b; safecommit_test.go 3c8f8a528f30bfb92805e003b9b4484b5c01fdf6fc6b1cfe1f38f71ad0881fdb. No commit/land; awaits independent review and separate #11502 repair.

[anthony-chaudhary]

Independent coordinator WSL full-package rerun now PASS 5.043s (source hashes bound to frozen v3); final independent review accepts v3 with all three review blockers closed. Representative fixture contains 10,000 distinct real checkpoint commits/history, bounded delta batches and original-base named assertion RED. Existing mock migrated without weakening collision/no-commit assertions. No commit/land yet: mandatory WSL landing adapter #11502 remains separate. Earlier detached negative test CWD sensitivity tracked #11828; canonical non-worker WSL mirror tests intended negative/positive contexts.