[fullsend-ai-coder]

Summary

scripts/post-fix.src.sh (and the regenerated bundle scripts/post-fix.sh) now skips the pre-push git rebase origin/<branch> replay whenever the freshly fetched origin/<branch> is already an ancestor of local HEAD. In that state the plain push is a fast-forward and there is nothing to reconcile.

Why

The replay was only skipped through narrow arms tied to the agent's rebased_onto_target/merged_target flags, the human instruction wording, or a forge-reported conflict. When the agent reconciled a stale base with an ordinary merge of the target, origin/<branch> was already an ancestor of HEAD, but the default git rebase still ran. That rebase drops the merge commit and replays target-side history onto the old PR tip, with two outcomes:

• Conflict: it re-hits the conflict the agent had already resolved, and the run fails as push-rejected (fix(#7306): keep mintcore out of behaviourtest's public graph fullsend#7308, 2 of 3 runs).
• Clean replay: it pushes a silently inflated PR (fix(#8754): treat object-form profile binaries as their scalar export fullsend#8755: 66 main-side commits replayed, 191 files).

Approach

A new arm just before the replay, active only when nothing else has already set SKIP_REMOTE_REBASE:

git merge-base --is-ancestor "origin/${BRANCH}" HEAD

• It uses only ancestry the runner computes itself, so no flag written inside the sandbox is trusted.
• For linear histories it changes nothing (the rebase was already a no-op there).
• GitLab reconstructions have diverged SHAs, so they never pass the check and still go through the existing replay.
• If the remote gained a commit that HEAD doesn't have, the replay still runs (covered by push-rebase-conflict-fails-closed).
• Merge commits in the range are still secret-scanned by the existing step earlier in the script.

Testing

• New push-preserves-unflagged-target-merge tests in scripts/post-fix-test.sh:
  • clean: the replay would apply cleanly
  • conflict: the replay would conflict
  • a signed-commits-off variant of clean
• Each test checks that no replay happens, the merge commit is kept, the target tip is an ancestor of what was pushed, and the pushed tree matches the agent's tree. All three fail on the old script and pass with the fix.
• push-history-rewrite-ordinary-append now checks only that the "to preserve" skip arms don't fire, because a linear append now takes the fast-forward skip.
• post-fix-test.sh passes against both the source and the bundled script. The exception is 3 harness-config checks that fail the same way on main because yq isn't installed in the sandbox.
• The bundle is up to date with post-fix.src.sh. skillsaw --strict passes, and shellcheck plus the pre-commit-hooks checks pass when run directly. pre-commit itself couldn't fetch its hook repos because of a sandbox TLS error.

Not included

The issue's optional richer push-rejected comment, which would mention that the agent had already recorded a verified resolution. With this skip in place, the replay only fails when the remote really did gain commits the agent never saw, and the existing message is accurate for that case.

🤖 Generated with Claude Code

---

Closes #1323

Post-script verification

• Branch is not main/master (agent/1323-skip-replay-when-ancestor)
• Secret scan passed (gitleaks — f589f2e719ba9bdda0a5915b8d4a86c45e7694e7..HEAD)
• PR body secret scan passed (gitleaks — no-git)
• Final PR description secret scan passed (gitleaks — no-git)

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:18 PM UTC · Completed 3:27 PM UTC

Commit: a72dadd · View workflow run →

Runtime: pi · Model: sonnet → claude-sonnet-5-5 · Effort: high · Cost: $1.70

[fullsend-ai-review]

<!-- fullsend:risk-assessment -->
Risk Assessment: moderate (2/5)

Details

Small, well-tested bug fix precisely matching linked issue scope, tempered by protected script modifications and historical churn without a rollback toggle.

[fullsend-ai-review]

Review

Findings

Medium

• [protected-path] scripts/post-fix.src.sh — This PR modifies protected paths: scripts/post-fix.src.sh, scripts/post-fix.sh and scripts/post-fix-test.sh (scripts/ is a governance/infrastructure path). The PR links issue post-fix.sh: skip the pre-push rebase-replay when origin/<branch> is already an ancestor of HEAD, not just after an explicit agent rebase #1323 and explains the rationale, so this is raised as medium. Human approval is always required for protected-path changes, regardless of context.

---

Labels: PR fixes a defect in the fix-agent post-script push logic.

[ravelley]

This should cover most cases. If a concurrent update causes the post-script to rebase, though, it can still drop the agent’s merge and inflate the PR diff. I’ve tracked that edge case separately in #1797.

[waynesun09]

LGTM. Checked at a72dadd:

• post-fix-test.sh passes against the source and the bundled script (195 tests), and make check-bundle is clean.
• The three new push-preserves-unflagged-target-merge tests fail against main's script, so they catch #1323.
• origin/<branch> is force-fetched right before the ancestry check. The plain push, its lease fallback and the signed path all reject a remote that moved, so nothing is overwritten.

Non-blocking test and comment nits for a follow-up:

• No bot-triggered variant, and no case where the remote moved while HEAD has a merge.
• The negative greps at post-fix-test.sh:2525/2620/2796 still match the shared "skipping rebase onto" prefix.
• The header comment at post-fix-test.sh:3395 and the merged_target wording in skills/fix-result-contract/SKILL.md are now stale.