Fix: lifecycle commits stage only what the change owns, never git add -A

[0xLeif]

Summary

• Bug: specsync change check --commit and specsync change ship --push committed through git_commit_all, which ran git add -A. That staged every untracked, non-ignored file in the project, and --push published it. This week that put a private debug zip into a pushed arcsite commit, and .agents/ and exp2.sh into corvid-bot commits.
• Fix: the staging path (git_commit_lifecycle in src/commands/change.rs) stages two things, using explicit git --literal-pathspecs add -- <paths>:
  • every edit to a tracked file, because verification digests the working tree and a verified tracked edit has to be committed;
  • the untracked paths the change domain says the change owns, from the new change::lifecycle_commit_scope: its workspace .specsync/changes/<id>/, its archive package, each affected spec's canonical *.spec.md and companions, and the lifecycle ledgers (change-sequence.json, workflow-v2-baseline.json, archive/legacy-baseline.json, bootstrap.json, hashes.json).
• Never staged: any other untracked file. Those files are listed once per run on stderr with what to do about them. After check --commit the warning also says that removing one stales the recorded verification, and names the command that re-records it. --format json stdout is unchanged. The lock and transaction journal are neither committed nor listed, and unmerged entries are not staged, so an unresolved conflict still stops the commit.
• Not owned on purpose: the change's affected_paths prefixes (src/, ., …) and whole spec directories, because owning them would bring the sweep back.
• Behavior change for authors: a brand-new untracked source file is no longer swept in, so git add it before check --commit. This is documented in docs/ADOPTING.md and the AGENTS.md quick reference.
• Doc comment: run_checked_commit said "nothing is committed unless verification passes", which is true for the first pass only. I took the "fix the comment" option rather than auto-rewinding a commit. The comment now describes what happens, and when the second-pass verification fails the error names the materialize commit it left in place and the resume command.
• Found while testing: change new writes .specsync/workflow-v2-baseline.json in a freshly adopted project. It is a lifecycle ledger, so it stays in the commit (asserted in the check test).
• SpecSync change: lifecycle-commits-stage-only-what-the-change-owns-never-every-untracked-file (bug-fix; specs cmd_change and change). Deltas: MODIFIED REQ-cmd-change-012 (drops the git add -A wording), ADDED REQ-cmd-change-017, ADDED REQ-change-102, and the Public API rows for LifecycleCommitScope / lifecycle_commit_scope. The change is a draft awaiting your definition approval; see below.

Test Plan

• check_commit_never_commits_an_unrelated_untracked_file: run_checked_commit over a tree with debug-dump.zip, .agents/scratch.md and exp2.sh. No stray appears anywhere in history and all stay untracked. Controls: the untracked workspace, the workflow-v2 baseline and the tracked delivery edit are committed.
• ship_push_never_commits_an_unrelated_untracked_file: check --commit → review → run_ship --push into a bare remote. No stray in the remote's history, the archive package is pushed, and the vacated workspace is gone from the pushed tree.
• Discrimination: with staging put back to git add -A, both tests fail (debug-dump.zip was committed). With only the archive commit put back, the ship test still fails.
• Unit tests: lifecycle_commit_scope_names_exactly_what_the_change_owns (exact set), staging_reads_each_porcelain_entry_once_and_stages_only_tracked_edits (rename parsing; fails if the source field is misread), a_lifecycle_scope_owns_its_subtree_and_not_a_prefix_sibling, the_left_out_warning_names_the_files_and_what_to_do, and the renamed lifecycle_commit_raises_a_stale_ledger_before_staging_it.
• fledge lanes run verify: fmt, clippy -D warnings, check, full cargo test (2504 unit and 437 integration tests, 0 failures), release build, strict spec check 62/62 at 100% coverage, and the RC tests.
• fledge lanes run pre-push and fledge trust verify pass (Augur risk 48, "review" tier; provenance is soft and gets attested on main by CI).
• Rehearsed the post-approval lifecycle in a throwaway clone with a fake actor, never pushed. approve → check --commit (stray left out and warned about) → change audit --strict → review → ship → archive all pass, and audit --strict passes after the archive commit.
• Definition approval, check --commit, review, and ship (steps below)
• CI green. The lifecycle gate (change audit --strict) fails until the change is approved and checked, because a draft covers no paths.

For @0xLeif: SpecSync steps (not recorded by the agent)

I did not record a definition approval or a review under your identity. From a checkout of this branch:

specsync change approve lifecycle-commits-stage-only-what-the-change-owns-never-every-untracked-file --actor user:0xLeif
cargo run --quiet -- change check lifecycle-commits-stage-only-what-the-change-owns-never-every-untracked-file --commit
git push
# wait for CI, review the PR
specsync change review lifecycle-commits-stage-only-what-the-change-owns-never-every-untracked-file --reviewer user:0xLeif
cargo run --quiet -- change ship lifecycle-commits-stage-only-what-the-change-owns-never-every-untracked-file --push
# wait for CI green, then merge

cargo run -- runs this branch's binary, so the lifecycle commits themselves use the fixed staging.

Human intent

This relates to SHIP-1.d ("I can commit the verified result in the same step…"). A candidate criterion, not captured because it needs your words: "Committing the verified result never sweeps in files I did not put there."

🤖 Generated with Claude Code

https://claude.ai/code/session_01V3ZZAEiUP7xRJPozhZb6rL

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[github-actions]

✅ Corvin says...

      _
    <(^\  .oO(Caw! ^v^)
     |/(\
      \(\\
      " "\\

"Caw! Your code sparkles like a dropped french fry."

CI Summary

Check	Status
Validate action.yml	✅ Passed
Packaged Action Consumer	✅ Passed
Dependency Audit	✅ Passed
Code Coverage	✅ Passed
Format Check	✅ Passed
Human intent check	✅ Passed
Docs Site	✅ Passed
Spec Validation	✅ Passed
Tests (build, test, clippy)	✅ Passed
VS Code Extension	✅ Passed

📋 Spec Validation Details

✅ SpecSync: Passed

Metric	Value
Specs checked	62
Passed	62
Errors	0
Warnings	0
File coverage	100% (107/107)
LOC coverage	100% (149230/149230)

---

Generated by specsync · Run specsync check --format github to reproduce

---

_{Powered by corvid-pet}