// A git push is a decision: who may update which refs of this repository, decided before any byte reaches storage.
CONTRACT ForgeGitPush {
  ENFORCEMENT_MODE: enforced
  CONTEXT {
    ENTITIES GitPushRequest {
      operation: string
      repository_matches_main: bool
      repository_lands_only: bool
      requester_can_write: bool
      requester_is_agent: bool
      ref_updates: int
      refs_outside_agent_namespace: int
      default_branch_deleted: bool
      effect_hash: string
    }
    CONSTANTS {
      zero: int == 0 [SOURCE:FORGE-GIT-PUSH-V1]
      max_ref_updates: int == 64 [SOURCE:FORGE-GIT-PUSH-V1]
    }
  }
  TRIGGER { push_refs() }
  PROHIBITION {
    FORBID push_refs WHEN GitPushRequest.operation != "push" [SOURCE:push_operation]
    FORBID push_refs WHEN GitPushRequest.repository_matches_main == false [SOURCE:push_repository]
    FORBID push_refs WHEN GitPushRequest.repository_lands_only == true [SOURCE:push_landing_only]
    FORBID push_refs WHEN GitPushRequest.requester_can_write == false [SOURCE:push_write]
    FORBID push_refs WHEN GitPushRequest.ref_updates <= zero [SOURCE:push_nonempty]
    FORBID push_refs WHEN GitPushRequest.ref_updates > max_ref_updates [SOURCE:push_ref_cap]
    FORBID push_refs WHEN GitPushRequest.refs_outside_agent_namespace != zero [SOURCE:push_agent_namespace]
    FORBID push_refs WHEN GitPushRequest.default_branch_deleted == true [SOURCE:push_default_branch_delete]
  }
  OBSERVABILITY { LOG "ForgeGitPush evaluated" ON decision }
}