Git Finalize
git_finalizeFinalize Git changes safely by merging selected and expected paths, blocking missing or extra files, and creating a verified security receipt before commit or push.
Instructions
Precisely finalize Git changes after a scoped release safety check: merge selected_paths with authoritative expected_paths so omitted task outputs are still eligible, include explicitly named untracked files without a second hidden switch, exclude unrelated untracked files, block missing or extra paths before creating a local commit, create and validate a content-bound security receipt, block sensitive paths or unsafe/incomplete scans, verify the committed path set again, and optionally push the exact commit. Build, tests, browser validation, Acceptance, and formal certification are not rerun.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| user_intent | Yes | Original user wording that explicitly requests commit, and push when include_push=true. | |
| include_push | No | Push after commit. Defaults to whether user_intent explicitly includes push. | |
| workspace_id | No | Optional workspace id. When omitted, CodexPro binds the authoritative conversation workspace automatically; an explicit unknown or mismatched id is rejected. | |
| security_mode | No | Security evidence mode for push. Local commits always use a bounded candidate-path scan. Default push mode: incremental; a missing baseline defers push instead of running a synchronous full scan. Explicit full mode retains the release-grade gate. | |
| commit_message | No | Optional commit subject. When provided, it is passed to Git unchanged. | |
| expected_paths | No | Authoritative exact paths expected in the new commit. These paths are merged into the eligible scope even when selected_paths omitted them. Missing or extra candidates block before a local commit and committed paths are checked again afterward. | |
| selected_paths | No | Workspace-relative candidate paths eligible for this commit. Explicitly selected untracked paths are eligible automatically. When expected_paths is also provided, both lists are merged so expected task outputs omitted here can still be included. | |
| conversation_id | No | Connector conversation id bound to this workspace. Modern MCP injects it automatically; side-effecting tools require it to match the authoritative binding. | |
| include_untracked | No | Legacy compatibility flag. Explicitly named untracked paths in selected_paths or expected_paths are eligible without this flag; unrelated untracked paths are never selected implicitly. | |
| workspace_generation | No | Optional authoritative workspace generation. When omitted, CodexPro injects the conversation-bound generation; an explicit stale generation is rejected. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| tool_result | Yes |