fix(git-push-setup): presence probes fail closed + drop orphan ParseGitHost export — final Codex pass

- A transport error on the .git presence read (configured pairs) now
  refuses instead of proceeding: fail-open left needsReconstruct=false, so
  the self-heal could mint a marker-only repo masking the reconstruction
  the pair needed, and the tokenless recall could report
  already-configured on wiring it couldn't verify. Both sites pinned by
  TestGitPushSetupContainer_PresenceProbeError_FailsClosed.
- ops.ParseGitHost export deleted: F3's final gate is ops.IsGitHubRemote;
  the exported wrapper had no callers left. Stale comment/spec/plan
  references corrected (GLC-3 row now names the fail-closed gate).
- Live-verification ledger corrected (Codex catch): the standard
  self-deploy e2e commits before deploying, so it never proved dirty-tree
  delivery — replaced with the dedicated dirty-tree probe results:
  no-git cold start → deploy → build ACTIVE → count=1/'zcp init'/identity
  survived -g round-trip/tree honestly dirty/content served.

Author: krls2020

docs/spec-workflows.md

@@ -1121,7 +1121,7 @@ Managed runtime services carry a `/var/www/.git/` that direct `zerops_deploy` tr
 |----|-----------|
 | GLC-1 | Every runtime service added to the project via bootstrap or adopt has `/var/www/.git/` initialized **container-side** (via `ops.SSHDeployer.ExecSSH`, never SFTP MKDIR), owned by `zerops:zerops`, with identity filled set-if-absent (default `user.email = agent@zerops.io`, `user.name = Zerops Agent`) and a reachable HEAD. Enforced by `autoMountTargets` post-mount hook: after `ops.MountService` succeeds it calls `ops.InitServiceGit`. The SSH-exec path matters because zembed's SFTP MKDIR regression creates root-owned directories, which would corrupt `.git/objects/` and break subsequent git operations. Errors are logged but do not mark the mount FAILED — GLC-2 is the safety net. |
 | GLC-2 | `deploy_ssh.go::buildSSHCommand` must tolerate a missing `.git/` as the migration/recovery fallback. The init guard stays inside the OR branch (`test -d .git || git init -q -b main`); identity is set-if-absent OUTSIDE it (never stomping a user-set value — the B13 fix's actual requirement was "identity exists", not "identity is ZCP's"); a HEAD guarantee follows so zcli's archiver always has a commit to diff against. Direct deploy mints NO other commit — the dirty tree ships via zcli's ephemeral stash-archive. Same identity-ensure shape in `BuildGitOriginSyncCommand` (GAP4-1). Pinned by `ops/deploy_git_test.go` + `ops/git_identity_test.go`. |
-| GLC-3 | `ops.DeployGitIdentity` is the single source of the default identity value, consumed only through the single-owner fragment builders in `ops/git_identity.go`. No code path writes identity unconditionally or persists the HEAD-guarantee marker commit's identity into repo config. **Human attribution (F3)**: at git-push-setup, `ops.DeriveGitHubIdentity` derives name/email from the PAT for github.com remotes only (`ops.ParseGitHost` is the gate); the result seeds repo-local config IFF the current value is absent or EXACTLY equals the robot identity (`ops.BuildGitIdentitySeedCommand`) — a genuinely custom value is preserved and reported, never overwritten. This migration fires ONCE per value: a later PAT rotation to a different GitHub account does NOT re-seed, because the now-human identity no longer exactly-matches the robot default (identity is user-owned once set). A buildFromGit clone carrying a recipe-baked non-robot identity is likewise never auto-migrated (neither absent nor exactly-robot) — same preserved/reported treatment. Reconstruction (`BuildGitReconstructCommand`) takes the derived identity directly when available, landing a rebuilt repo human-attributed from its first init rather than robot-then-migrate; the tokenless recall path has no PAT to derive from, so it only detects a still-exactly-robot identity and prompts a one-time re-run with `gitToken` — it never fabricates one. Release tags, export commits, and flatten commits carry no inline identity of their own (`git tag -a` / plain `git commit`) — they read ambient repo config, so they inherit the seeded human identity automatically once F3 has run. |
+| GLC-3 | `ops.DeployGitIdentity` is the single source of the default identity value, consumed only through the single-owner fragment builders in `ops/git_identity.go`. No code path writes identity unconditionally or persists the HEAD-guarantee marker commit's identity into repo config. **Human attribution (F3)**: at git-push-setup, `ops.DeriveGitHubIdentity` derives name/email from the PAT for github.com remotes only (`ops.IsGitHubRemote` — fail-closed exact-host gate — decides); the result seeds repo-local config IFF the current value is absent or EXACTLY equals the robot identity (`ops.BuildGitIdentitySeedCommand`) — a genuinely custom value is preserved and reported, never overwritten. This migration fires ONCE per value: a later PAT rotation to a different GitHub account does NOT re-seed, because the now-human identity no longer exactly-matches the robot default (identity is user-owned once set). A buildFromGit clone carrying a recipe-baked non-robot identity is likewise never auto-migrated (neither absent nor exactly-robot) — same preserved/reported treatment. Reconstruction (`BuildGitReconstructCommand`) takes the derived identity directly when available, landing a rebuilt repo human-attributed from its first init rather than robot-then-migrate; the tokenless recall path has no PAT to derive from, so it only detects a still-exactly-robot identity and prompts a one-time re-run with `gitToken` — it never fabricates one. Release tags, export commits, and flatten commits carry no inline identity of their own (`git tag -a` / plain `git commit`) — they read ambient repo config, so they inherit the seeded human identity automatically once F3 has run. |
 | GLC-4 | The ZCP-host container has no git state. `/var/www` there is the SSHFS mount base, not a code directory; no `.git/` is ever initialized on it, and no `git config --global` is written. `zcp init` in container mode (`init_container.go::containerSteps`) performs only Claude config + optional VS Code setup. Developer-side git workflows (e.g. `zcp sync recipe push-app`) run on developer laptops with the developer's own `~/.gitconfig` and are never expected to pass through a Zerops-deployed ZCP service. |
 | GLC-5 | Mount-side `git init` (from the ZCP-host into a managed service's SSHFS-mounted `/var/www/{hostname}/`) is forbidden agent behavior, covered by `develop-first-deploy-write-app.md` guidance. zembed's SFTP MKDIR would produce root-owned `.git/objects/` which poisons every subsequent deploy. Recovery: `ssh {host} "sudo rm -rf /var/www/.git"` and let GLC-2's safety net re-init. |
 | GLC-6 | Local-env `strategy=git-push` requires a user-owned git repo with ≥1 commit (verified against `zcli@v1.0.61` `handler_archiveGitFiles.go:67-75`). ZCP does **not** auto-init git in the user's working directory — identity, default branch and `.gitignore` conventions are personal. `develop-platform-rules-local.md` instructs the agent to ask the user to run `git init && git add -A && git commit -m '<msg>'` themselves; `handleLocalGitPush` pre-flight catches the case as a hard fallback. The default `zerops_deploy` strategy uses `zcli --no-git` and needs no git state. The container-mode default path (GLC-2) depends on the same zcli floor for its `--workspace-state=all` archiver — no runtime probe, containers ship platform-maintained zcli. |

internal/ops/deploy_git_push.go

@@ -109,9 +109,3 @@ func parseGitHost(rawURL string) string {
 
 	return defaultGitHost
 }
-
-// ParseGitHost is the exported form of parseGitHost for callers outside
-// this package (e.g. tools deciding whether a remote qualifies for GitHub
-// identity derivation — F3). Single owner: host extraction never gets a
-// second implementation.
-func ParseGitHost(rawURL string) string { return parseGitHost(rawURL) }

internal/ops/github_user.go

@@ -25,7 +25,7 @@ const githubAPIHost = "api.github.com"
 
 // IsGitHubRemote reports whether remoteURL's host is EXACTLY github.com —
 // the strict, fail-CLOSED gate for GitHub PAT derivation (F3, Codex
-// diff-review finding 1a). Deliberately NOT ops.ParseGitHost: that helper
+// diff-review finding 1a). Deliberately NOT parseGitHost (ops-internal, credential scoping): that helper
 // fail-OPENs to "github.com" on any parse failure or malformed host, which
 // is safe for its actual owner (url-scoping an already-validated
 // credential-helper config key) but would be a PAT-confinement bug here —

internal/tools/workflow_git_push_setup.go

@@ -714,7 +714,7 @@ func classifyGitIdentitySeedLine(line, seededTok, preservedTok, writeFailedTok s
 // gitPushSetupDeriveAndSeedIdentity implements F3 human attribution:
 // derives a git identity from the GitHub PAT (github.com remotes only —
 // ops.IsGitHubRemote is the single owner, a strict fail-CLOSED host check
-// deliberately distinct from ops.ParseGitHost's fail-open credential-
+// deliberately distinct from parseGitHost's fail-open credential-
 // scoping default; other hosts skip derivation and keep the robot
 // fallback), then — unless reconstruction is about to run,
 // which fills identity itself as part of its own init (there is no .git
@@ -812,9 +812,19 @@ func gitPushSetupDeriveAndSeedIdentity(
 // call itself fails transport-wise.
 func gitPushSetupPreProbeSelfHeal(ctx context.Context, sshDeployer ops.SSHDeployer, pushHost string, meta *workflow.ServiceMeta) (needsReconstruct bool, blocker *mcp.CallToolResult) {
 	if meta.GitPushState == topology.GitPushConfigured {
-		if presentOut, presentErr := sshDeployer.ExecSSH(ctx, pushHost, "test -d /var/www/.git && echo present || echo absent"); presentErr == nil {
-			needsReconstruct = strings.Contains(string(presentOut), "absent")
+		presentOut, presentErr := sshDeployer.ExecSSH(ctx, pushHost, "test -d /var/www/.git && echo present || echo absent")
+		if presentErr != nil {
+			// Fail CLOSED: with the presence unknown, proceeding would let
+			// the self-heal below create a marker-only repo that masks the
+			// reconstruction a configured pair may need (the exact defect
+			// the pre-probe ordering exists to prevent) — refuse instead.
+			return false, convertError(platform.NewPlatformError(
+				platform.ErrSSHDeployFailed,
+				withSSHStderr(fmt.Sprintf("git-push-setup: could not determine whether %q still carries /var/www/.git", pushHost), presentErr),
+				"Verify SSH to the push source is healthy, then re-call. NO remote ref, secret, origin, or meta state was modified.",
+			), WithRecoveryStatus())
 		}
+		needsReconstruct = strings.Contains(string(presentOut), "absent")
 	}
 
 	if !needsReconstruct {
@@ -990,7 +1000,17 @@ func gitPushReconstruct(ctx context.Context, sshDeployer ops.SSHDeployer, pushHo
 // robot identity — deriving from GitHub needs a PAT (F3 item 4).
 func gitPushConfiguredRecall(ctx context.Context, sshDeployer ops.SSHDeployer, input WorkflowInput, meta *workflow.ServiceMeta) *mcp.CallToolResult {
 	presentOut, presentErr := sshDeployer.ExecSSH(ctx, meta.Hostname, "test -d /var/www/.git && echo present || echo absent")
-	if presentErr == nil && strings.Contains(string(presentOut), "absent") {
+	if presentErr != nil {
+		// Fail CLOSED: "already-configured" promises working wiring; with
+		// the presence read failing we cannot make that claim, and a
+		// vanished .git would silently skip its reconstruction.
+		return convertError(platform.NewPlatformError(
+			platform.ErrSSHDeployFailed,
+			withSSHStderr(fmt.Sprintf("git-push-setup: could not verify /var/www/.git still exists on %q", meta.Hostname), presentErr),
+			"Verify SSH to the push source is healthy, then re-call. NO remote ref, secret, origin, or meta state was modified.",
+		), WithRecoveryStatus())
+	}
+	if strings.Contains(string(presentOut), "absent") {
 		divergence, reconErr := gitPushReconstruct(ctx, sshDeployer, meta.Hostname, meta.RemoteURL, ops.DeployGitIdentity)
 		if reconErr != nil {
 			return convertError(platform.NewPlatformError(
@@ -1034,7 +1054,7 @@ func gitPushConfiguredRecall(ctx context.Context, sshDeployer ops.SSHDeployer, i
 // anything itself — it can only detect the still-robot state and point at
 // the fix; it never fabricates an identity. Gated to github.com remotes
 // (ops.IsGitHubRemote — the same strict fail-closed check the derivation
-// gate uses, not ops.ParseGitHost's fail-open credential-scoping default):
+// gate uses, not parseGitHost's fail-open credential-scoping default):
 // F3 only derives identity from GitHub, so prompting the same re-run for a
 // GitLab/other/malformed remote would be a false promise. Read failure
 // (SSH down, malformed output) is silent — this is advisory, never a

internal/tools/workflow_git_push_setup_container_test.go

@@ -527,6 +527,73 @@ func TestGitPushSetupContainer_RotationWithToken_MissingGitStillReconstructs(t *
 	}
 }
 
+// TestGitPushSetupContainer_PresenceProbeError_FailsClosed pins the final-
+// pass fix: when the pre-self-heal `.git` presence read on a CONFIGURED
+// pair fails at the transport level, setup must refuse — proceeding would
+// let the self-heal mint a marker-only repo that masks the reconstruction
+// the pair may need, and (on the tokenless recall) would falsely report
+// "already-configured". Both entry shapes are covered: rotation-with-token
+// and tokenless recall.
+func TestGitPushSetupContainer_PresenceProbeError_FailsClosed(t *testing.T) {
+	t.Parallel()
+	for _, tc := range []struct {
+		name     string
+		gitToken string
+	}{
+		{"rotation with token", "ghp_rotated_token"},
+		{"tokenless recall", ""},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			stateDir := t.TempDir()
+			if err := workflow.WriteServiceMeta(stateDir, &workflow.ServiceMeta{
+				Hostname:         "appdev",
+				Mode:             topology.PlanModeStandard,
+				StageHostname:    "appstage",
+				GitPushState:     topology.GitPushConfigured,
+				RemoteURL:        "https://github.com/example/app.git",
+				BootstrapSession: "test",
+				BootstrappedAt:   "2026-05-23",
+			}); err != nil {
+				t.Fatalf("WriteServiceMeta: %v", err)
+			}
+
+			ssh := &containerSSHStub{
+				dispatch: func(cmd string) ([]byte, error) {
+					if strings.Contains(cmd, "test -d /var/www/.git") {
+						return nil, errors.New("ssh transport lost")
+					}
+					return []byte("ok"), nil
+				},
+			}
+			client := platform.NewMock().
+				WithServices([]platform.ServiceStack{{ID: "svc-appdev", Name: "appdev"}})
+
+			result, _, _ := handleGitPushSetup(
+				context.Background(), client, nil, ssh, "test-project",
+				WorkflowInput{Service: "appdev", RemoteURL: "https://github.com/example/app.git", GitToken: tc.gitToken},
+				stateDir, runtime.Info{InContainer: true},
+			)
+			if !result.IsError {
+				t.Fatalf("presence-probe transport error must fail closed, got success: %s", extractText(result))
+			}
+			body := extractText(result)
+			if !strings.Contains(body, "NO remote ref, secret, origin, or meta state was modified") {
+				t.Errorf("fail-closed refusal should carry the no-mutation guarantee; got: %s", body)
+			}
+			// Nothing after the failed probe may have mutated the repo: no
+			// self-heal chain, no reconstruction, no origin sync.
+			for _, cmd := range ssh.commands {
+				for _, forbidden := range []string{"git init", "commit-tree", "git remote add origin", "set-url origin"} {
+					if strings.Contains(cmd, forbidden) {
+						t.Errorf("command ran despite unknown presence (%q): %s", forbidden, cmd)
+					}
+				}
+			}
+		})
+	}
+}
+
 // TestGitPushSetupContainer_TokenNeverEchoed pins that the token value
 // never appears in any response, regardless of probe outcome. Sentinel
 // scan against the full JSON body.

plans/git-contract-2026-07-12.md

@@ -199,8 +199,11 @@ lint-local`.
    Codex-verified: works for fine-grained PATs without extra permissions).
    HTTP via the EXISTING `ops.HTTPDoer` seam already threaded through
    `RegisterWorkflow` (Codex finding 5) — no new package-global client, no
-   parallel test hook. ONLY for remotes whose host is `github.com`
-   (`parseGitHost` is the owner); other hosts skip derivation (P1 robot
+   parallel test hook. ONLY for remotes whose host is `github.com` — via
+   the fail-closed `ops.IsGitHubRemote` (final-pass correction: the
+   original `parseGitHost` reuse was fail-open — invalid hosts default to
+   github.com for credential scoping, which must never authorize sending
+   the PAT to GitHub's API); other hosts skip derivation (P1 robot
    fallback stands).
 2. `confirmGitPushSetupContainer` (workflow_git_push_setup.go): after probe
    passes, best-effort seed via SSH: write user.name/user.email IFF current
@@ -297,10 +300,20 @@ On eval-zcp (services provisioned ad-hoc, deleted after):
   `stash create` + `archive` mechanism carries the dirty file on the real
   container; B13 class (history without identity) self-heals and
   `stash create` succeeds.
-- Item for P2 delivery end-to-end: `TestE2E_Deploy_SelfDeploy` PASS (123s)
-  — import → code written via SSH (uncommitted tree) → real
-  `zerops_deploy` through the new command → build → HTTP 200 → deleted.
-  Content shipped from a dirty tree with zero ZCP commits.
+- P2 delivery end-to-end, TWO live proofs (final-pass correction: the
+  first ledger draft over-credited `TestE2E_Deploy_SelfDeploy`, whose
+  fixture commits before deploying — Codex caught it):
+  - `TestE2E_Deploy_SelfDeploy` PASS (123s) — the standard committed-tree
+    path through the new command: build → HTTP 200 → deleted.
+  - Throwaway `TestE2E_GitDirtyTreeSelfDeploy` PASS (214s; file deleted
+    after run) — the P2 crown jewel AND the item-5 `-g` round-trip in one:
+    service imported directly (bootstrap never ran ⇒ NO `.git` at all),
+    app written via SSH, ZERO git commands issued by the test, real
+    `ops.DeploySSH` → safety-net built repo+identity+HEAD cold →
+    `ops.PollBuild` → ACTIVE. Post-deploy on the replaced container:
+    `count=1`, `msg=zcp init`, `email=agent@zerops.io` (identity survived
+    the `-g` artifact round-trip), `dirty=2` (user's work honestly
+    uncommitted), `served=yes` (the uncommitted content IS the artifact).
 - `TestE2E_InitServiceGit` PASS against the live container (new semantics).
 - Item 6 (P4 GitHub round-trip: real PAT → GET /user → seeded identity →
   push attribution visible on GitHub) NOT live-verified — requires a PAT +