test(conformance): DS-2 allows the discard's unstage, still bans commits and remote git

[tlgimenes]

Why

DS-2 in delivery.cli.test.ts fails on main since c90fbe9 (#689), deterministically (also run alone). #689 made a discard on the fs storage (deco serve) bring the discarded blocks' git index entries back to HEAD (PO: "deco serve should unstage git added blocks on discard"). It does that with git reset -q HEAD -- <paths>, git rm --cached -f --quiet --ignore-unmatch -- <paths> and, to undo a failed write, git update-index. DS-2's scan treated local git as strictly read-only and matched "reset"/"update-index".

Is the scan right or too broad?

Too broad, so this changes the test, not the code:

• The docs claim behind DS-2 (draft synchronization: "Local deco serve keeps editing the developer's working tree and does not perform hosted branch synchronization") forbids GitHub calls, commits and branch work. It never said the index stays untouched; "local git read-only" was the test's own wording.
• The code does nothing the claim forbids: no commit, no ref or object write, no remote, no working-tree checkout. Its index writes are limited to the paths the discard restores (plus both sides of a staged rename), and they're PO-requested behaviour with their own tests in storage/fs/git.test.ts.

What changed

DS-2 now encodes that claim and keeps guarding against regressions:

• Anywhere in cli/serve/server.ts and protocol/storage/fs/*: no GitHub, no simple-git/isomorphic-git; only git.ts uses child_process.
• In git.ts: never commit, add, restore, checkout, switch, stash, push, fetch, pull, clone, remote, merge, rebase, write-tree, commit-tree, update-ref, tag, -w, --hard, --soft, --keep, --merge.
• Index writes (reset, rm, update-index, read-tree, apply) only inside unstage. There, rm must carry --cached and reset must be exactly -q HEAD over named paths.

Mutation-checked: each of these fails the test: an index write outside unstage, rm without --cached, reset --hard, reset HEAD~1, and a commit call.

Docs site: no change is needed, since the claim already matches. It could optionally mention that a discard also unstages the discarded blocks.

Gates

• bun run check 0, bun run build 0, skills:check + skills:readme:check 0
• Plain-Node import of every built export plus deco --help: 0
• bun run test (2 GB): 2077 passed, 2 failed, 95 skipped. The two failures are schema.test.ts 5 s timeouts under load. That file passes alone (58/58). delivery.cli.test.ts passes 11/11.

🤖 Generated with Claude Code

https://claude.ai/code/session_016ZsmzpZ2zahRBoATBb2tBu

---

Summary by cubic

Fixes the DS-2 conformance test so deco serve can unstage discarded blocks while still banning commits, remote git calls, and working-tree rewrites.

• The test now permits git index writes only inside the discard's unstage operation, matching the behavior added in fix(protocol): discard also unstages the discarded blocks #689.
• It still fails on any commit, ref or object write, working-tree checkout, or remote operation anywhere in cli/serve/server.ts or protocol/storage/fs/*.
• Within unstage, rm must carry --cached and reset must be exactly -q HEAD over named paths.
• Mutation-checked: an index write outside unstage, rm without --cached, reset --hard, reset HEAD~1, and a commit call each fail the test.

^{Written for commit 1c22a0f. Summary will update on new commits.}