Feature recommendation: harness-enforced adversarial commit review - a layered design beyond pre-commit hooks (working reference implementation + measured data)

Summary

Recommendation: ship harness-enforced adversarial commit review as a first-class ZCode feature — an independent fresh-context reviewer must pass the exact staged diff before any agent commit, wrapped in a layered enforcement stack that goes well beyond a pre-commit hook. This is not a theoretical design: we run the full stack in production across our repos. Working reference implementation and measured data are available on request.

The problem

• Agents inject defects even into remediation commits written to fix a defect just found, and voluntary/self-requested review gets skipped under deadline pressure.
• Every client-side gate is advisory to the agent that holds the shell. The bypass classes are documented publicly: anthropics/claude-code#40117 (agents running git commit --no-verify, stash, and quiet flags despite instructions), plus community mitigations for exactly that one flag (claude-cookbooks#346, claude-agent-sdk-python#703, Superset discussion).
• The bypasses go far beyond a flag: git plumbing (commit-tree + update-ref) never runs commit hooks; core.hooksPath can be re-pointed; hook files in .git/hooks are untracked and deletable; a fresh clone is unarmed.
• And the trivial bypass is not a flag at all: an agent can compute the staged sha256s and write the gate's own clearance/state file directly, forging the record the hook checks.

The community's block-no-verify guards are regex over one command form. The rest of the attack surface is untouched, and none of it produces durable evidence that review happened.

The honest claim (design principle)

No client-side scheme can prevent; it can only raise the cost and make bypass detectable. The layers need to be airtight against agents operating through the harness, and detect everything else after the fact. A human at their own shell is the owner — they get an audited one-shot OVERRIDE, not a wall.

The layered design (running in production)

Layer 3 is the trust anchor: absence of a note is the violation signal, so notarization is fail-closed — on any mismatch it writes nothing. It reads immutable OUTPUT (committed blobs), not process behavior, so no local trick escapes it.

The details that make it work

• Severity threshold: correctness/security/data-loss findings block; style never does.
• Baseline recorded at arming time — history before notarization isn't false-alarmed.
• notes.rewriteRef configured so amend/rebase carries notes to rewritten commits: unchanged blobs keep valid clearance, conflict-resolved blobs correctly flag.
• One-shot OVERRIDE with provenance: consuming it snapshots the staged shas; it can only bless the commit carrying those exact blobs — a lingering override file blesses nothing.
• Enforcement config itself is gated: .githooks/ and .github/workflows/ paths require their own independent CLEAR to change (an edit to the gate is the highest-value attack).
• A parity selftest asserts the vendored auditor's duplicated path rules can never drift from the gate's.
• Residual risks documented, not hidden: a determined fraudster can forge a note with correct shas and fabricated verdict text — but the embedded artifact makes fraud checkable (re-run a review against the same bytes). Detection, not prevention, by design.

Measured results (production)

• ~$0.006–$0.012 per review with current mid-tier models; seconds of latency; the author addresses findings and commits — normal workflow friction, dramatically fewer shipped defects.
• It blocks real bugs, not noise — most recent live example: it BLOCKED a commit whose diff could not prove a cross-file invariant (path-rule parity between gate and auditor) — a genuine drift defect class — then cleared it after verifying the author's factual rebuttal against on-disk facts.
• The reviewer runs with a rebuttal channel (--context): findings are addressable with evidence, not vetoes.

The ask

Z.ai owns the harness — the one place enforcement can be first-class instead of bolted on. Ship "arm the commit gate" as a product feature: harness-level interception at the tool layer (beyond what any git hook or plugin regex can do), an independent reviewer verdict on the exact staged bytes, notarization into the repo as durable evidence, and a CI audit check for teams. For teams buying agentic coding, an enforced independent review gate is trust infrastructure — no competing agent ships it.

Working reference implementation (gate, harness guard, auditor, installer, selftests — the complete four-layer stack) and measured data available on request.

Start by reviewing the proposed pre-commit hook, commit driver, harness guard, post-commit auditor, and CI check, then inspect the named .githooks/, .github/workflows/, and refs/notes/adversary paths. Request the working reference implementation and measured data mentioned in the issue. Done means the product has an agreed, independently reviewed design covering exact staged bytes, durable notarization, bypass detection, and CI enforcement.