First governed commit end-to-end
Full path: CAP on → classify → enforce → confidence → commit_checkpoint.
What you will learn
- Land one legal SHA
- Keep single scope
- Leave CAP intentional
Prerequisites
- Install git and IDE enforcement hooks
- Commit Authorization Protocol (CAP)
- Agent commit message schema
- Staging Engine — one Commit-Scope per commit
- Enforcement sessions
- Confidence Engine
- Atomic commits with commit_checkpoint
Surface
| MCP | commit_authorize · enforcement_begin · staging_classify · staging_enforce · confidence_enforce · commit_validate · commit_checkpoint |
|---|
What this feature does
Use a single-scope edit for the first success. Do not mix protocol docs with code. Follow the attestation pipeline exactly once.
How to call it
Call these MCP tools through your AGS / tower-gov host — commit_authorize, enforcement_begin, staging_classify, staging_enforce, confidence_enforce, commit_validate, commit_checkpoint.. Prefer scan/get before validate/diff, and enforce only when the change set is ready.
- commit_authorize state on
- enforcement_begin
- staging_classify → staging_enforce
- confidence_enforce
- commit_checkpoint
{
"message": "status/checkpoint(demo): add governed helper\n\nStatus: checkpoint\nScope: demo\nCommit-Scope: function-create\nNot-done: wire caller\nNext: module-wire\nEvidence: vitest\nToken: mid\nGraph-ids: none (infra)\nUser-approved: no\nEnforcement: mcp",
"files": ["src/demo/helper.ts"],
"dryRun": false
}What success looks like
git log -1 shows status/checkpoint
Hook accepted message
No false “done” claim
Common failure modes
Multi-scope dirty tree
Raw git commit after MCP failure
Missing User-approved trailer