Bind worker Git input to its reviewed worktree representation

Decide which representation the worker needs

A fictional assistant summarizes one already admitted public maintenance note from a trusted local Git store. The review record names the stored blob B-A. The worker, however, would read an ordinary worktree file W-A. Before admitting that input, the operator needs to explain the relationship between those two representations.

This worksheet selects one regular data file, one trusted consumer and a separately supported transformation plan T-A. It supplies no checkout command, filter program, attribute file or repository. Every label and card is PROPOSED_UNRUN. The signed-release guide still owns release provenance; the diff guide still owns its restricted comparison profile. Neither is expanded here.

Keep stored and worktree content distinct

The attributes manual describes smudge converting a blob into worktree content during checkout, while clean converts worktree content on checkin. It also documents line-ending conversion, so repository and worktree byte sequences need not coincide. These are documented mechanisms, not observations about our file.

For this application, B-A and W-A therefore occupy different receipt fields. The review asks whether W-A is the exact representation the consumer was approved to understand. A visually familiar paragraph or matching release label cannot answer that byte-level association question. Likewise, a claimed round trip back to B-A is insufficient evidence about W-A or the actions of the converter.

The useful task remains an ordinary bounded summary. This review does not require running repository code to make the note readable, and it grants no converter permission merely because an input looks inconvenient. Any proposed preparation stage needs its own prior code, data and operating-authority review.

Record effective selection before interpreting an outcome

The same manual places the repository’s info/attributes file above path-level files, with global/system inputs also relevant. A filter attribute names a configured driver; a configured process filter takes precedence over single-blob filters. Our selected plan requires independently established absence of that process branch.

The configuration reference documents system, global, repository and optional worktree sources, includes and command-scope inputs. Later file values take precedence for ordinary single-valued settings; runtime configuration pairs can override files, and explicit -c values override those pairs. It separately defines clean and smudge commands. One tracked file is not the complete effective configuration.

The application receipt records the actual supported executable identity, admitted configuration revision and complete attribute-source boundary as prerequisites. It includes the relevant environment and invocation policy without exposing private paths or secret values in a shared report. Those prerequisites are unknown here; no installed configuration was inspected.

Treat fallback as a representation decision

The attributes reference says that by default a missing driver definition or nonzero driver exit becomes a no-op passthrough. A required filter instead declares that its success is necessary to make stored content usable. That declaration does not establish an observed successful result.

Our stricter application policy never substitutes B-A for expected W-A merely because a preparation stage appears to finish. If the admitted consumer expects W-A, a passthrough disposition leaves that prerequisite unresolved. If T-A requires conversion and its evidence is incomplete, withhold input. Do not quietly reclassify the plan as optional, change the expected representation or add an unreviewed converter.

Conversely, a deliberately admitted no-transformation plan can be useful when the consumer is independently approved for that exact input. That needs its own complete evidence; it is not an automatic recovery path for a failed T-A. The receipt preserves what was intended, what was established and what remains unknown.

Use one input-association sheet

The ordinary positive requires every row: the fixed note, admitted preparation plan and exact complete consumer representation agree, with current permission for the summary. Only that input plan becomes conditionally eligible for separate execution review. Actual store integrity, converter behavior, effective configuration, result capture, lifetime and current rights are unimplemented or unknown and block a real positive. Matching bytes supply no override.

Walk eight inert representation cards

Limit the assurance to the evidence

Both maintained manuals showed 2.56.0, updated 28 September 2026. No installed Git, converter, host or consumer was examined. No checkout, filter, attribute/configuration change, object operation, candidate fixture, process or model call occurred. Documentation and ordinary editorial file handling are separate activities.

This is no complete checkout sandbox, parser, encoding/LFS integration or safe-arbitrary-repository recipe. It proves no harmless code, privacy, licensing suitability or successful summary. Boundary remains prelaunch with planned request-path checks; its existing synthetic policy evidence does not implement or validate this preparation service.