CSA git guard blocks quality-gate receipt harness via git -C

[aider4ryder]

Reproduction

bash scripts/tests/quality-gate-receipt-tests.sh invalidation-matrix

Actual

Exit 128 before the harness reaches its assertion:

CSA git-guard: blocked command: git -C <value> <command> <option>
Use a hermetic local bare fixture under $CSA_SESSION_DIR/git-fixtures and push to its direct canonical path or file:// URL.
scripts/tests/quality-gate-receipt-tests.sh: line 150: pop_var_context: head of shell_variables not a function context
FAIL contract-case suite=quality-gate-receipt-tests.sh case=invalidation-matrix exit=128

The test uses a hermetic temporary fixture; the generic guard makes this repository-owned focused test impossible to run in a CSA session.

Session evidence

• session ID: 01KZNS02MFV3XDM1NX3NMHB6GQ
• session directory: /home/obj/.local/state/cli-sub-agent/home/obj/project/github/RyderFreeman4Logos/cli-sub-agent/sessions/01KZNS02MFV3XDM1NX3NMHB6GQ
• command exit: 128
• task: one-line residual test-helper call repair on fix/3004-3006-gate-convergence

[aider4ryder]

Additional reproduction after a successful normal-hook commit:

git diff --quiet

The CSA guard blocks this read-only Git attestation too:

CSA git-guard: blocked command: git <command> <option> <option> <option> <argument>
Use a hermetic local bare fixture under $CSA_SESSION_DIR/git-fixtures and push to its direct canonical path or file:// URL.

This confirms the guard is broader than outgoing publication and also obstructs required post-commit receipts.