Part II · Mental Model · Mechanism 03 · SHIPPED · p. 31–33

The guarded commit

Any gate can stop a bad commit. The engineering problem is stopping it without teaching people to route around the gate.

Two beats you can type without thinking

securegit scan --staged
securegit commit -m "message"
securegit undo

You could gate at add. It would be worse. Staging is exploratory. Commit is the first moment the content is declared finished. That is where a gate belongs. Push is the first crossing onto shared infrastructure — the last point at which stopping is cheap. So: commit-time scanning is advisory and fast; push-time chain enforcement is blocking. Different gates, different jobs, different costs.

Commits are local and revisable. Push is the first crossing onto shared infrastructure. Gate where stopping is still cheap.

Operation	Receipt	Why
acquire / clone	Yes	Code arrives from outside
commit	Yes	Content declared finished
push	Yes	Crosses to shared infrastructure
merge	Yes	Joins two histories
scan	Yes	Findings become evidence
fetch / pull	Yes	Content arrives from outside
status, log, diff, add, checkout, branch, stash	No	No boundary crossed

A bad afternoon

It is 4:40. The branch is a mess. You staged half a fix, then half of someone else’s review comment, then a drive-by rename. You do not want a lecture. You want a path.

Command

securegit snapshot create
securegit absorb
securegit stack status
securegit undo
securegit workflow run commit-craft --dry-run