feat(acp): enforce deterministic agent git commit identity

[wpfleger96]

Problem

Agent sessions could commit under the human operator's ambient git identity. Only buzz-dev-mcp's shim applied the nostr author/signing GIT_CONFIG_* env, and only to its own shell-tool children — the native shells of claude-code, codex, and goose never saw it. A bare git commit in those shells resolved to whatever user.name/user.email the repo or global config carried, erasing the AI-attribution signal (e.g. #3140, which landed under a human identity).

Change

Makes the agent commit author identity machine-managed and deterministic across every harness. Trailers still credit the human operator (Co-authored-by + Signed-off-by); that policy is unchanged.

• buzz-git-identity (new crate) — the single source of truth for the author/email, NIP-GS signing, and keyfile logic, consumed by both the dev-mcp shim and the harness so an agent commits under a byte-identical identity regardless of which surface applied it. The identity email is <64-hex-pubkey>@<relay-host>; the author name is the sanitized Buzz display name (falls back to the npub).
• Harness-owned identity authority. Alongside the keyfile, the harness/shim write a 0600 identity manifest. The enforcement wrapper locates its own install directory by canonicalizing the git on PATH against its own executable — the same trust channel it uses to find the real git, immune to environment rewriting — reads the expected identity from the manifest, and injects it directly as the highest-precedence config, never trusting git config user.email. A manifest that is missing or fails to parse in an otherwise-managed session fails the invocation closed rather than silently dropping enforcement. Manifest present = enforce; genuinely absent (keyless/unconfigured session) = passthrough.
• git enforcement wrapper (git_wrapper.rs) — installed on PATH ahead of the real binary.
  • Identity is injected, not merely scrubbed. The wrapper injects the manifest's identity + signing config as -c args at the front of the resolved command, so it outranks caller-supplied -c, GIT_CONFIG_PARAMETERS, include.path, and repo/global config alike. Scrubs GIT_AUTHOR_*/GIT_COMMITTER_*; rejects -c user.*, --config-env=user.*, --author, and --reset-author (scoped to commit/am so git log --author still works).
  • Author preflight. commit -C/-c <sha> and --amend create new commits that reuse another commit's author; injected config cannot override a reused author, so the wrapper inspects the resulting author and rejects any commit-creating mode that would leave a non-agent author. Ordinary commits and amends of the agent's own commits pass.
  • Push gate uses git's own resolved plan. Rather than predicting git's transport grammar from argv, the wrapper runs git push --dry-run --porcelain --no-verify <original args> to obtain the exact resolved update set — covering config-defined and inline -c alias.* git aliases, -C/--git-dir, --all/--mirror/--tags, config remote.*.push, and wildcard refspecs — then refuses any outgoing commit not authored by the agent identity, naming the offending sha and email. A human-authored commit is exempted only when it is a patch-id-identical replay of a commit already upstream (a legitimately cherry-picked/rebased human commit — correct attribution, not new agent work masquerading as someone else); any other non-agent author is refused. The dry-run probe is bounded by a hard timeout; a timeout, an unresolvable update set, or any dry-run failure fails closed. The --no-verify on the internal dry-run keeps it from double-running the repo's own pre-push hooks; the real push keeps its hooks, and enforcement runs unconditionally so --no-verify on the real push cannot bypass it.
  • Aliases are allowlisted, not blocklisted. A git alias is expanded by git in-process, and its config-bearing globals land after the wrapper's injected identity/signing -c options, so an alias could otherwise plant higher-precedence config that re-authors or unsigns the commit — and git's quote-aware alias parser sees tokens differently from a naive whitespace scan ('-c' 'user.email=…' dequotes to real config). Rather than model that grammar, the wrapper admits a non-shell alias only when every token of its resolved body is a trivially-safe bare word: no quote or backslash characters, no -c/--config-env channel, and no =-valued option. Anything else is refused. Shell (!) aliases are refused outright in a managed session — git runs their body with the real git ahead of the wrapper on PATH, so an inner -c outranks the inherited authority and can commit or push under an arbitrary identity, unsigned; there is no safe subset to allow. A bare-word alias can still carry identity/signing flags (commit --author … --no-gpg-sign), so on success the alias is expanded and its resolved command — accumulated body tokens across up to ten alias substitutions plus the caller's trailing argv; if another alias remains at that bound, the wrapper refuses rather than treating a partial expansion as resolved — is held to the identical identity/signing policy as the same command typed directly (enforce() and the commit-author preflight, keyed on the expanded subcommand). An alias can therefore never do more than its expansion could typed directly, and there is no alias-specific flag list to keep in sync. Bare-word aliases whose expansion is clean keep working (alias.ci = commit, alias.st = status, alias.lg = log --oneline, alias.pub = push origin main).
  • Signing is enforced. -c commit.gpgSign=false and --no-gpg-sign are rejected at argv; env-based signing-disable is defeated by the injected highest-precedence config.
• Harness lift (buzz-acp) — AcpClient::spawn writes the keyfile and manifest, installs the wrapper plus the nostr signer/credential helpers via buzz-acp's own multicall personalities, prepends the wrapper dir to the child PATH, and applies the identity + signing GIT_CONFIG_* composed over the desktop's per-URL credential helper. The key is sourced BUZZ_PRIVATE_KEY (the documented required secret) before NOSTR_PRIVATE_KEY at both the command and process-env layers, and the canonical key is restaged unconditionally as the child's NOSTR_PRIVATE_KEY so the harness and dev-mcp shim can never install split identities. A managed session fails closed when deterministic identity cannot be installed; sessions with no nostr key are skipped entirely, so test spawns and unconfigured sessions are unchanged. Unix-only.
• Prompt guidance (base_prompt.md, nest_agents.md) — identity is machine-managed; credit the operator via Co-authored-by/Signed-off-by trailers, never user.name/user.email/-c/--author.

Scope and ceiling

This is a deterministic best-effort local control, not an adversarial sandbox. Enforcement is a PATH wrapper sharing the OS user with the agent, so it closes accidental identity leakage — the entire class behind #3140 — but does not stop a deliberate bypass: invoking /usr/bin/git by absolute path, env -i, replacing the wrapper on PATH, deleting the manifest, or committing via libgit2/jj all sidestep it by design. A hard guarantee that holds regardless of what the agent runs would require a receive-side gate on the git host; that remains a possible separate follow-up. This PR intentionally targets the default-path commit/push surface, which is where the missed-attribution signal originates.

Verification

Beyond unit tests (buzz-git-identity 66, buzz-acp 817 unit + integration suites), the wrapper mechanism is exercised end-to-end by process-level tests (git_identity_enforcement.rs) that spawn the real buzz-acp-as-git multicall against a real repo with a manifest present:

• a flag-based identity override (-c user.email=…, --author=…) is rejected;
• agent identity is injected over conflicting repo config so the resulting commit is authored <display-name> <hex@relay>;
• a quote-obfuscated config alias (alias.quoted = '-c' 'user.email=…' commit) and a shell (!) commit alias are each refused before git runs and leave HEAD unchanged, while a plain-subcommand alias still resolves and commits agent-authored; a bare-word alias carrying identity/signing flags (alias.human = commit --author … --no-gpg-sign, --no-gpg-sign alone, and a two-hop chain) is expanded and refused by the same policy as the typed command, HEAD unchanged; a chain of exactly ten aliases reaching commit remains usable, while an eleventh alias is refused before git runs with unborn HEAD and zero commit objects;
• a push containing a human-authored commit is refused via git's resolved plan, while an agent-authored push is allowed;
• the full spawn path installs the wrapper + manifest so a plain agent commit in a human-configured repo lands agent-authored.

Each process-level test is mutation-verified: nulling the harness's install_git_identity wiring, or dropping the enforce/verify_push dispatch, turns the corresponding test red — confirming the layer is wired into the process boundary, not merely unit-covered. The key-precedence and bounded-probe paths carry their own mutation-sensitive unit tests. The keyfile-lifecycle test (keyfile_lifecycle.rs) spawns the real binary on its error-exit path and confirms the 0600 keyfile is deleted on every exit.

Notes

• Squash-merge re-authors the merged commit to the PR-opener's GitHub token regardless of this change; the durable merged-history attribution signal is the Co-authored-by trailer email.
• NIP-GS signatures render as "unverified" on GitHub's UI (GitHub has no nostr x509 trust root); the signature is still verifiable via git-sign-nostr.