Make Git composition CI-reproducible

[adampoit]

No description provided.

[not-adam]

Mira PR Walkthrough

This PR makes Git-based composition and promotion reproducible in CI by routing Git execution through isolated configuration/environment handling, including for nested and direct low-level calls. It strengthens workflow-policy validation across composed refs, adds policy checks to promotion/diagnostics, and updates initialization and workspace operations to use the same isolation model. A focused regression test verifies that ambient global Git configuration cannot leak into direct Git calls.

graph LR
runner["src/git.ts"] --> isolation["Git isolation"]
integration["src/integration-sync.ts"] --> runner
workspace["src/workspace-list.ts"] --> runner
policy["src/workflow-policy.ts"] --> runner
promote["src/promote-sync.ts"] --> policy
init["src/init.ts"] --> runner

Loading

Confidence: 4/5   ◉◉◉◉○   Safe with minor fixes

• The changes are cohesive and include a targeted regression test for the central CI-reproducibility guarantee, though the broad integration and workflow-policy paths merit full CI validation.

Blast Radius — 2 dependent repositories, 3 total references

adampoit/mira — 1 reference
adampoit/wezterm — 2 references

9 files reviewed

---

Comment @not-adam help to get the list of available commands and usage tips.

[not-adam]

Mira Review Summary

This PR aims to make Git composition CI-reproducible, but a concern remains in src/workflow-policy.ts at line 96, where direct workflow inspection could bypass the new Git isolation contract. That pathway should be kept isolated to ensure the isolation guarantees hold under all code paths.

Key Issues

	Issue	Location
🔴	Direct workflow inspection can bypass the new Git isolation contract.	src/workflow-policy.ts:96