git_push_execute
Push a Git branch from a local checkout to a remote repository using a broker-held credential envelope, ensuring no token enters the sandbox and refusals are queued for human approval.
Instructions
Push branch of the checkout at checkout to remote, performed by
THIS process under the git.push envelope that governs app_id. The
brokered push (operator ruling 2026-09-10): the agent initiates, the
broker holds the credential and acts inside a signed envelope, and no
token ever enters a sandbox. repo is org/name as the envelope names
it; the checkout's remote must be that repo. force is honoured only
when the envelope grants it. A refusal is cited in FRANK with its errno
and files the ask in the human-required queue so the operator sees
"X wants to push Y to Z" while the work is still waiting. Returns the
pushed sha and citation id on success. Gated as envelope_apply: this is
an envelope application with the act attached, not a new capability.
See docs/design/brokered-push.md.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| repo | Yes | ||
| force | No | ||
| app_id | Yes | ||
| branch | Yes | ||
| remote | No | origin | |
| project | No | ||
| task_id | No | ||
| checkout | Yes | ||
| envelope_id | No |