P1: pre-push gate fails open — prov off PATH + git push --mirror leak private notes

[mattfogel]

Summary

Two related fail-open bypasses of the pre-push gate:

1. prov off PATH (githooks/pre-push:17-19): when command -v prov returns non-zero, the wrapper silently exit 0s with no stderr warning. PATH stripping or an uninstalled binary disables the gate without the user noticing.
2. git push --mirror: mirror's refspec includes refs/notes/prompts-private. Combined with bypass feat: Prov v1 foundation — workspace, schema/storage, redactor (U1+U2+U6) #1 (or with a chained-hook stdin bypass), private notes ship to the remote.

Severity

P1 — privacy fail-open by environment. Confidence 100.

Evidence

• githooks/pre-push:17-19 — the command -v prov defensive branch.
• git push --mirror upstream semantics — includes notes refs by default.

Possible fixes

• Wrapper: when prov is missing, write to stderr (prov pre-push hook installed but prov binary not found; aborting push) and exit 1. Treat the gate as fail-closed when its dependency is gone.
• Add a --mirror test scenario to cli_pre_push.rs.
• Consider an install-time / prov doctor check that warns when the wrapper exists but prov is unreachable.

Acceptance criteria

• Test: pre-push hook installed, PATH stripped — push aborts non-zero.
• Test: git push --mirror origin against a notes ref containing planted private content — push aborts non-zero.

Reference

/tmp/compound-engineering/ce-code-review/20260502-075634-3af3d047/adversarial.json (#3).