README's 'every push asks' claim overstates the git guard #150

New issue

Closed

opened 2026-08-15 14:33:48 +00:00 by john · 0 comments

john commented

2026-08-15 14:33:48 +00:00

Owner

Source: strict re-review C-07
Verdict: DISPUTE - overstated, closing

Claim as reviewed

The README says "Every push it tries to run stops and asks you first" despite the documented invisible wrapper form, which is a false guarantee in operator documentation.

At HEAD `f354864` (v3.3.0)

README.md:30 does carry that sentence. But the two carve-outs are disclosed within four lines of it, by hand:

README.md:32 - "every push the hook can see still asks".
README.md:34 - "bash -c \"git push\" is invisible, and that is written down rather than discovered ... in a hook that fails open".

The mechanism limits themselves are real and tracked separately: cadence-core/bin/lib/git-segments.mjs:74 requires the command word to be git, :58-61 lists the evasions, and cadence-core/bin/git-guard.mjs:211 fails open deliberately.

Note

The isolated sentence is loose. It is not an undisclosed claim, which is what the finding asserts. Reworded prose would be an improvement, not a defect fix - reopen as a documentation issue if the wording is worth tightening on its own.

**Source:** strict re-review C-07 **Verdict:** DISPUTE - overstated, closing ### Claim as reviewed The README says "Every push it tries to run stops and asks you first" despite the documented invisible wrapper form, which is a false guarantee in operator documentation. ### At HEAD f354864 (v3.3.0) `README.md:30` does carry that sentence. But the two carve-outs are disclosed within four lines of it, by hand: `README.md:32` - "every push **the hook can see** still asks". `README.md:34` - "`bash -c \"git push\"` is invisible, and that is written down rather than discovered ... in a hook that fails open". The mechanism limits themselves are real and tracked separately: `cadence-core/bin/lib/git-segments.mjs:74` requires the command word to be `git`, `:58-61` lists the evasions, and `cadence-core/bin/git-guard.mjs:211` fails open deliberately. ### Note The isolated sentence is loose. It is not an undisclosed claim, which is what the finding asserts. Reworded prose would be an improvement, not a defect fix - reopen as a `documentation` issue if the wording is worth tightening on its own.