feat(git-shim): only block trust-root pushes to the default branch

[getappz]

Summary

Relaxes flare-git-core's trust-root push guard (classify.rs): a push carrying changes to Cargo.toml/.githooks//.agentflare/ is now only blocked when it targets the repo's default branch directly. Pushes to feature branches with trust-root changes now pass through — the same PR-review gate that already applies to every other kind of change still has to clear before anything reaches the default branch, so blocking it at push-time to a feature branch wasn't adding protection, just friction.

TrustRootTouch::Unknown (diff couldn't be verified) gets the same treatment for consistency — still fails closed (denied) when targeting the default branch, passes through on feature branches.

Direct pushes to the default branch remain blocked unconditionally, trust-root or not (unchanged).

Motivated by a real friction point: had to ask a human to manually push a branch during PR #316 purely because it added a new crate to the workspace Cargo.toml — a completely routine feature-branch change.

Test plan

• cargo test -p flare-git-core — 105 passed, 0 failed
• cargo fmt --all -- --check clean
• cargo clippy -p flare-git-core --all-targets --all-features -- -D warnings clean
• Updated/added unit tests covering: trust-root touch on feature branch (passthrough), trust-root touch on default branch (denied), unreadable-diff on both branch types, end-to-end leading-flags regression test retargeted to the new feature-branch-allowed outcome

Summary by CodeRabbit

• Policy Updates

  • Trust-root changes are now denied when pushing to the default branch.
  • Trust-root changes on non-default branches can proceed through normal review.
  • Unreadable trust-root differences follow the same branch-specific policy.

• Bug Fixes

  • Improved trust-root detection behavior when command-line flags are present.
  • Updated denial messages to clearly identify default-branch restrictions.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: aaa7d9fe-ba6d-42b3-be52-703783510dd5

📥 Commits

Reviewing files that changed from the base of the PR and between 45a6b86 and 37922c2.

📒 Files selected for processing (1)

• crates/flare-git-core/src/classify.rs

---

📝 Walkthrough

Walkthrough

Trust-root push classification now denies touched or unreadable trust-root changes only on the repository’s default branch. Feature-branch pushes pass through, with unit, integration, and regression tests updated for both outcomes.

Changes

Trust-root push policy

Layer / File(s)	Summary
Conditional trust-root classification crates/flare-git-core/src/classify.rs	classify_pure denies trust-root touches or unknown trust-root diffs on default-branch pushes and returns Passthrough for feature-branch pushes.
Branch-specific policy tests crates/flare-git-core/src/classify.rs	Tests cover touched and unreadable trust-root changes, leading-flag branch detection, and explicit default-branch targeting.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• getappz/agentflare#279: Introduced the trust-root-aware push classification policy refined here.
• getappz/agentflare#313: Also changed trust-root enforcement for default-branch pushes and unreadable diffs.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise and accurately summarizes the main change to trust-root push blocking.
Description check	✅ Passed	The description covers the Summary and Test plan well; the reviewer-notes section is missing but non-critical.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch task/330

---

_{Comment @coderabbitai help to get the list of available commands.}