# Git through Straza

Let agents run plain git against GitHub with no GitHub credential on their machines, while Straza decides each fetch and push on ghapp with the roles, repositories and approvals of any tool call.

- Who: You, as the admin of ghapp, and the people whose agents run git
- Where: A terminal with strazactl, ghapp's settings, and an agent's Linux, macOS or Windows machine
- Profile: Standalone and enterprise

In short: An agent runs plain git against GitHub with no GitHub credential on its machine. `straza service` asks Straza for a grant per fetch or push, which Straza decides as a call of ghapp's `git_fetch` or `git_push` with the roles, repositories and approvals of any tool call. ghapp then runs it with a GitHub token that never leaves ghapp.


Anagentrunsplain`gitclone`,`gitfetch`and`gitpush`againstGitHub,andnoGitHubcredentialexistsonitsmachine.Githandseachcommandto`strazaservice`,whichasksyourStrazaserverforagitgrantforthatonerepository.Strazadecideseachfetchandpushasacallofghapp's`git_fetch`or`git_push`tool,withthesameroles,repositoriesandapprovalsasanyothertoolcall.ghappthenrunsthefetchorthepushwithaGitHubtokenthatneverleavesit.Thispageturnsthatonforghapp,theGitHubAppserverwhoserepositories[Limitaroletosomeobjects](https://docs.straza.ai/guides/serve-mcp-apps/limit-a-role-to-some-objects/index.md)pinsandlists.Youmapgittotwoofghapp'stools,giverolesthosetoolsontherightrepositories,andcanholdeachpushforaperson.Nothingisconfiguredontheagents'machines.Attheend,anagentpushestoarepositoryitsrolecovers,andapushtoanyotherrepositoryisrefusedbeforegitsendsanyofit.##Beforeyoustart{.nostep}-ghappaddedtoStrazawithitsrepositoriespinnedandlisted,andtheroles`ghapp-read`and`ghapp-write-payments`,as[Limitaroletosomeobjects](https://docs.straza.ai/guides/serve-mcp-apps/limit-a-role-to-some-objects/index.md)setsthemup.-Anhttpsaddressatwhichtheagents'machinesreachghapp'sgitendpoint,suchas`https://ghapp.example.com`.ghapp'sMCPendpointstayswherestrazadreachesit.-EveryreplicaofyourStrazaserveratthisversion.Areplicaofanearlierversionrefusesamanifestwithagitblock,andonethatreopensastoredmanifestdropstheblock.-AgentsonLinuxmachineswith`strazaservice`fromthe`straza`deborrpmpackage,whichalsoinstalls`/usr/bin/git-remote-straza`,oronWindowsmachineswith`strazaservice`fromtheStrazaMSI.TheMSIalsoinstalls`C:\ProgramData\straza\bin\git-remote-straza.exe`andaddsthatfoldertothemachinePATH.Macsrun`strazaservice`fromtheStrazapackageformacOS,whichlinks`/usr/local/bin/git-remote-straza`toitsbinary,andgittherefindsthehelperonlythroughthePATHoftheagent'sprocesses.ATerminal'sPATHholds`/usr/local/bin`.launchd'sbarePATHdoesnot,sogitstartedwithitstopswithgit'sown"'remote-straza'isnotagitcommand",asafireonmacOS26showed.ClaudeCodeiswiredas[ClaudeCode](https://docs.straza.ai/guides/govern-an-agent/claude-code/index.md)shows,witheitherinstall,andgitisversion2.31orlater.-AftertheMSIinstalls,peoplesignoutandinonce,soagentprocessesstartedafterwardseethenewPATH.Anagentwindowthatwasopenbeforetheinstallcannotfind`git-remote-straza.exe`,anditsgitfailsuntilthewindowstartsagain.-Ashellpolicythatallowstheagents'`git`commands.Theharnesshookdecides`gitpush`asashellcommandbeforegitstarts,andundertheenterpriseprofilealocaltoolthatnoruleallowsisdenied,as[theprofilecomparison](https://docs.straza.ai/reference/standalone-and-enterprise/index.md#no-rule)shows.Thestarterof[Giveagentstheirlocaltools](https://docs.straza.ai/guides/operate/enterprise-shape/index.md#give-agents-their-local-tools)allowsshellcommandsfortheholdersofitsrole.##TurnonStraza'sgitgrantsinghappghappcheckseverygitgrantitself,soitneedstwosettingsbesidetheonesitalreadyrunswith:|Setting|Value||---|---||`GHAPP_PUBLIC_URL`|Theaddressofghapp'sgitendpoint,here`https://ghapp.example.com`.Everygrantnamesitasitsaudience,sothemanifest's`straza.git.url`inthenextstepnamesthesameaddress.||`GHAPP_GIT_GRANT_ISSUER`|YourStrazaserver's`server.publicUrl`,characterforcharacter.ghappreadsStraza'ssigningkeysatthataddressfollowedby`/.well-known/straza/jwks.json`,soghappmustbeabletoreachit.|Restartghappwiththem.Itsstartlogthennamesthegitendpointinalineoftheform`gittransportat<url>/git/to<upstream>,pushesupto<n>bytes,<t>perrequest`,andthegrantsinalineoftheform`gittransporttakesStrazagrantsfrom<issuer>,withkeysfrom<jwksurl>`.ghapp'sgitendpointtakesStraza'sgitgrantsonly.Its`git_fetch`and`git_push`toolshandoutnoticket:theychecktherepositoryandanswerwiththeplaingitcommandforit.ghappnolongerhasgittickets,soleave`GHAPP_GIT_TICKETS`out.Adeploymentthatstillsetsitto`false`startswithaloglinethatsaysthesettingdoesnothingandcanberemoved,andghapprefusestostartwhenitis`true`.Withitsgitendpointon,ghappalsolists`git_fetch`and`git_push`,eachmarkedwiththeargument`repo`.Untilthenextsteppinsthem,Strazareadsbothasreachingeveryrepository,soonlyaroleoneveryrepositorycouldcallthem.##Mapgittoghapp'stoolsAmanifest's`straza.git`blocktellsStrazawhichgithostaserverservesandwhichtooldecideseachgitoperation.Addittoghapp'smanifest,andpin`git_fetch`and`git_push`totheargument`repo`intheobjectsblock,becauseeachgitgrantnamesonerepository.Startfromthemanifestfileyoukeepforghapp,orfrom`strazactlappsexportghapp`,whosemaskedvalues[Theappsdirectory](https://docs.straza.ai/guides/serve-mcp-apps/gitops-apps-directory/index.md)tellsyouhowtorestore.Withtherestofthemanifestasitwas,itsobjectsblockandthenewgitblockread:```yamlstraza:objects:type:repolist:tool:repo_listattributes:-{name:team,setBy:org}tools:branch_list:{argument:repo}file_get:{argument:repo}git_fetch:{argument:repo}git_push:{argument:repo}issue_comment:{argument:repo}issue_create:{argument:repo}issue_get:{argument:repo}issue_list:{argument:repo}pr_comment:{argument:repo}pr_create:{argument:repo}pr_get:{argument:repo}pr_list:{argument:repo}pr_merge:{argument:repo}repo_get:{argument:repo}repo_list:allsearch_code:{argument:repo}search_issues:{argument:repo}git:url:https://ghapp.example.comupstream:https://github.comops:fetch:git_fetchpush:git_push````url`isghapp'sgitaddress,thevalueof`GHAPP_PUBLIC_URL`.`upstream`isthegithostwhoserepositoriesghappserves.StrazatakesarepositoryURLasghapp'swhenitstartswith`https://github.com/`,readstheownerandthenamefromthenexttwopathsegments,andfindsthatrepositoryinghapp'slistwithoutregardtocase.`ops`decidesafetchasacallof`git_fetch`andapushasacallof`git_push`.BothURLsusehttps,orhttponaloopbackhostonly,andStrazastoresthemwithalower-casehost,nodefaultportandnotrailingslash.Checkthefile,thenproposeitasadraft:Yourterminal,administration:```shstrazactldraftscheck-fghapp.yamlstrazactldraftscreate-fghapp.yaml--note"Servegitforgithub.comthroughStraza'sgitgrants"````draftscreate`printsthenewdraft'snumber.Apersonpublishesthedraftintheconsoleunder**Drafts**,becausestrazactlrunsonanadminAPItokenandatokenneverpublishes.strazad'smanifestparser,whichthecheckand`strazactlspecvalidateapp`bothrun,refusesagitblockthatnamesatooltheobjectsblockdoesnotpintoanargument.Foramanifestthatleaves`git_push`outof`objects.tools`,itsays`git.ops.pushnamesgit_push,whichobjects.toolsdoesnotpin,soitreacheseveryrepo.Agitgrantnamesonerepo,sopingit_pushunderobjects.toolsto{argument:<name>}withtheargumentthatcarriestherepo`.Withoutanobjectsblockitsays`thegitblockneedsanobjectsblockbesideit,becauseeachgitgrantnamesonerepofromtheserver'sobjectlist.Addobjectswiththeobjecttype,thelistingtooland{argument:<name>}foreachtoolundergit.ops`.Fromthepublishon,everysessionstartandsessionrenewalanswerseachagentmachinewith`https://github.com`asagithost,and`strazaservice`writesitintothemachine'shostfile.[HowgitreachesStraza](#how-git-reaches-straza)sayswhatthatfiledoes.##GiverolesthegittoolsArolethatbinds`git_fetch`letsitsholderscloneandfetchtherepositoriesitcovers,and`git_push`letsthempushthere.Add`git_fetch`to`ghapp-read`,whichcoverseveryrepository,and`git_push`to`ghapp-write-payments`,whichcoversthetworepositoriesoftheteam`payments`:Yourterminal,administration:```shmkdir-pghapp-rolescat>ghapp-roles/ghapp-read.yaml<<'EOF'apiVersion:straza.dev/v1beta1kind:Rolemetadata:name:ghapp-readspec:kind:applicationdescription:Readtoolsofghapponeveryreposerver:ghappbindings:-app:ghapptools:-branch_list-file_get-git_fetch-issue_get-issue_list-pr_get-pr_list-repo_get-search_code-search_issuescovers:everyEOFcat>ghapp-roles/ghapp-write-payments.yaml<<'EOF'apiVersion:straza.dev/v1beta1kind:Rolemetadata:name:ghapp-write-paymentsspec:kind:applicationdescription:Writetoolsofghapponthepaymentsreposserver:ghappbindings:-app:ghapptools:-git_push-issue_comment-issue_create-pr_comment-pr_create-pr_mergecovers:objects:-ghapp-straza-test/pay-api-ghapp-straza-test/pay-webEOFstrazactldraftscheck-fghapp-roles/strazactldraftscreate-fghapp-roles/--note"Gitfetchoneveryrepo,gitpushonthepaymentsrepos"```Publishthedraftasbefore.Anagentthatholdsbothrolescannowcloneeveryrepositoryghapplistsandpushto`ghapp-straza-test/pay-api`and`ghapp-straza-test/pay-web`.Apushtoanyotherrepositoryisrefusedatitsfirststep,beforegitsendsacommit,withtheobjectcheck'ssentence,suchas`Straza:git_pushonghapp-straza-test/sitewasrefused:noneofyourrolesonghappcoversthatrepo.Yourrolescovergit_pushonghapp-straza-test/pay-apiandghapp-straza-test/pay-web.Checktherepo'sname,oraskanadminforarolethatcoversit.`Apersonwhoserolesbind`git_fetch`andnot`git_push`reads`Strazarefusedthisgitpush:noneofyourrolesallowsgit_pushontheMCPserverghapp.Askanadministratorforarolethatallowsgit_pushonghapp,thenrungitagain.`Strazaservesarepositorytoapersononlywhenoneoftheirrolesbindsagittoolonghappandghapp'slistholdstherepository.AnyotherrepositorygoestoGitHubdirectly,throughgit'sownhttpstransport.Apublicrepositorythenclonesasitalwaysdid,andaprivateoneorapushfailsatGitHubwithgit'sownmessage,becausethemachineholdsnoGitHubcredential.Whenghappcouldservetherepositorybutitslistdoesnotholdityet,Strazaalsoasksghappforitslistagain,atmostonceaminute,soarepositorycreatedamomentagoworkswhengitrunsagainaminutelater.##HoldapushforapersonThisstepisoptional.Aruleon`git_push`with`mode:approve`holdseachpushuntilapersonallowsit,hereaholderoftheapproverrole`release-approvers`that[Holdacallforaperson](https://docs.straza.ai/guides/write-policy/hold-for-a-human/index.md)setsup:```yamlapiVersion:straza.dev/v1beta1kind:PolicySetmetadata:name:ghapp-git-push-holddescription:Areleaseapproverallowseachgitpushthroughghappspec:priority:10match:roles:[ghapp-write-payments]rules:-id:hold-git-pushevents:[tool.pre]tools:[mcp.call]apps:[ghapp]toolNames:allow:["git_push"]effect:allowmode:approveapprove:roles:[release-approvers]timeoutSeconds:300reason:"Straza:areleaseapproverallowseachgitpushthroughghapp"```Yourterminal,administration:```shstrazactlpolicyapply-fghapp-git-push-hold.yamlstrazactlpolicyactivateghapp-git-push-hold```Apushasksonce.Itsfirstgrantopensghapp'slistofbranchesandrunseverycheckbuttheapproval,andtheapprovalrunsforthegrantthatnamesthebranchupdates.Theapproval'sargumentscarrytherepository,thebranchwhenthepushnamesone,andeachupdatewithitsoldandnewcommitid,sotheapprover'scardshowsthemunless`approval.preview.enabled`isfalse.Keeptherule'sdefault`binding:call`,whichtiestheapprovaltoexactlythoseupdates.With`binding:tool`,oneapprovalwouldcover`git_push`onanyarguments,soadifferentpushtothesamerepositorycouldrunonit.Aruleon`git_fetch`holdsacloneorafetchthesameway.>Thecardcannotshowaforcepush>>Strazaandghappseeonlycommitids.Aforcepushthatrewritesabranchnamesthebranch'scurrentcommitasitsoldid,exactlyasapushthatonlyaddscommitsdoes,soitlookslikeanyotherupdateonthecardandinthegrant.BlockforcepushesatGitHub,withabranchruleonthebranchesyouprotectthattheAppcannotbypass.Whiletheapprovalisopen,gitkeepswaitingandprintsawaitlineatonceandthenevery5seconds,suchas`Straza:waitingforanapprovertoallowrefs/heads/mainongithub.com/ghapp-straza-test/pay-api(295sleft).`Oncetheapproverallowsit,thepushgoeson.Adenialendsitwith`Straza:approvaldeniedby`,theapprover'snameandtherequest'sreference,andawindowthatendswithnodecisionendsitwith`Straza:approvalrequestexpiredafter300swithnodecision`,followedbythereference.gitprintsthatsentencebesideeachbranchofthepush,ona`[remoterejected]`line.Onlyaholdkeepsgitwaiting.Arulewith`class:ticket`answersthepushatoncewitharefusalthatnamesthependingticketandthetimeapersonhastodecide,andtellsthepersonto`Runthesamegitcommandagainonceitisapproved.`Thesamepushrunagainaftertheapprovalgoesthrough.##Whatapersonsees{.nostep}Apersonsetsupnothing.Theiragentrunsgitasbefore,andgitprintsitsusualoutput.Awaitlineshowswhileanapprovalisopen,andarefusalisonesentencefromStrazathatsayswhatfailedandwhattodonext.Thesecomefromthemachine'sside:Ifthisfails:``Straza:gitcannotreach`strazaservice`onthismachine,sothisgitcommanddidnotrun.Run`strazadoctor`toseewhy.``:Theserviceisnotrunning,orthemachinehasnone.`strazadoctor`namesthecause.``Straza:the`strazaservice`onthismachinehasnogitroute,becauseitisolderthanthisstrazaorhasnotrestartedsinceanupgrade,sothisgitcommanddidnotrun.Restart`strazaservice`orupgradeStrazaonthismachine,thenrungitagain.``:`strazaservice`runsanolderbinarythangit'shelper,suchasaservicethathasnotrestartedsinceanupgrade.`Straza:theStrazaserverathttps://straza.example.comdoesnotgivegitgrantsyet.Askanadministratortoupgradeit,thenrungitagain.`:Themachine'sStrazaserverrunsaversionwithoutgitgrants,withyourserver'saddressinplaceoftheexample.`Straza:gitarchive--remotedoesnotgothroughStraza.Clonetherepoandrungitarchivelocally.`:Strazarelaysclones,fetchesandpushesonly.Eachgitgrantisboundtothekeyofthesessionthataskedforit,takenfromtheverifiedsessionandneverfromtherequest.##HowgitreachesStraza{#how-git-reaches-straza.nostep}OnLinuxandmacOSbothClaudeCodeinstalls,andonWindowsthemanagedinstall,writethesamethreeentriesintothe`env`tableoftheClaudeCodesettingstheyalreadymanage:`GIT_CONFIG_COUNT``1`,`GIT_CONFIG_KEY_0``include.path`and`GIT_CONFIG_VALUE_0`withthepathofthehostfile.Thatpathis`/run/straza-service/git/hosts.conf`onLinux,`/opt/straza/run/git/hosts.conf`onmacOSand`C:\ProgramData\straza-service\git\hosts.conf`onWindows.ClaudeCodepassesthattabletotheprocessesitstarts,sogitincludesthefileinagentprocessesonly,andaperson'sownterminalnevercarriesit.Aninstallleaveseveryotherentryofthetableasitwas.`strazaservice`writesthatfile,readablebyeverylocaluserandwritableonlybyitsownOSaccount,anditsurvivesarestartoftheservice.OnmacOSthefilesitsinthe`git`folderof`/opt/straza/run`,thesocketfolderthatthepackagemadefortheservice'saccount.OnWindowsthefilesitsinthe`git`folderoftheservice'sownstatefolder.SYSTEMandAdministratorsmaychangeittoo,andtheservicechecksthatfolder'sownerandrulesbeforeeverywritethere.Itwritesnothingwhenanotheraccountcouldchangethefile,becausegitcanstartaprogramthatthefilenames.With`https://github.com`astheonegithost,thefilereads:```ini[url"straza::https://github.com/"]insteadOf=https://github.com/insteadOf=git@github.com:insteadOf=ssh://git@github.com/[protocol"straza"]allow=always```GitthereforehandseveryURLunder`https://github.com/`to`git-remote-straza`,the`straza`binaryunderasecondname,andanSSHremoteofthesamehosttoo,soanagentneedsnoSSHkeyeither.Theprotocollineletssubmodulesusethesametransport.Thehelperasks`strazaservice`overitssocket,oritsnamedpipeonWindows,whetherStrazaservestherepository,andhandsarepositoryStrazadoesnotservetogit'sownhttpstransportuntouched.ForoneStrazaserves,theserviceholdsthegitgrantinmemory,nevergivesittogit,andstreamsgit'srequeststoghappwiththegrantandafreshprooffromthemachine'skey.Aninstallwhoseserverhasnogitblockchangesnothingforgit:thehostfilestaysempty,gitrewritesnoURL,andthehelperneverruns.Thefilelistsexactlythehoststhatsomeserver'sgitblocknames,nevereveryhttpsURL,soGitLFSkeepsworkingforeveryotherhost.Aserveraddedorremovedlaterreachesamachineatitsnextsessionstartorrenewal,andasessionthatkeepsworkingrenewsabout3minutesafteritslasttokenwasminted.Whenthesettingsalreadyheldanothervalueforoneofthethreeentries,theinstallreplacesitandsayssoonstderr,asin`NOTE:StrazareplacedGIT_CONFIG_COUNT=2intheenvof/etc/claude-code/managed-settings.jsonwithitsowngitsettings,anduninstallingStrazadoesnotputthemback,soifyoustillneedthem,restorethemfromabackupofthatfilebeforeyourelyonthisinstall.`AmachinethatupgradesthepackageortheMSIkeepsitsoldwiringuntilyouruntheinstallagain,`sudostrazainstall--managed--serverhttps://straza.example.comclaude-code`or`strazainstallclaude-code`.OnWindowsthemanagedinstallrunsas[InstalltheserviceonWindows](https://docs.straza.ai/guides/operate/install/index.md#install-the-service-on-windows)shows,andthe`install.cmd`of[DeploywithIntune](https://docs.straza.ai/guides/govern-an-agent/deploy-with-intune/index.md)runsitwitheachupgrade.Untilthen,the`managed-content`lineof`strazadoctor`reportsthatthemanagedwiringdoesnotmatchthisbuild.##Readtherecord{.nostep}EachgrantStrazaissuesandeachrefusalofitsdecisionwritesone`straza.audit.mcp`recordwiththeevent`grant`,thetool`git_fetch`or`git_push`,andtherepositoryin`object`.Its`arguments`holdtherepositoryand,onapush,thebranchandeachupdate.Anissuedgrantadds`grant`,withthegrant'sid,itsoperation,itsaudience,itsexpiryandtheapprovalwhenoneran.Therecordenterstheauditqueuebeforethegrantleavestheserver,soagrantwhoserecordcannotbequeuedisneverissued.Readtherecordswith`strazactlaudittail--appghapp--typestraza.audit.mcp`.ghapplogseachgitrequestonalinenamed`git`whose`grant_id`and`decision`arethegrant'sidandtherecord'sid,sothetwologsjoin.[Eventsandtheauditrecord](https://docs.straza.ai/reference/events/index.md#git-grants)listseveryfield.##Whatitdoesnotdo{.nostep}-Aforcepushisnotdetected.BlockitatGitHubwithabranchrulethattheAppcannotbypass,asthenoteabovesays.-Anagentrunsastheperson,soitcanuseanygitcredentialthepersonstored,suchasaGitHubtokeninGitCredentialManager,byrunninggitwithouttheStrazasettings.RemovestoredGitHubcredentialsfortheorganizationsStrazagovernsfrommachinesthatrunagents.-Policydecidespertool,notperbranch.Aroleorarulenames`git_push`,norulecannameabranchyet,andanapprovalcoversexactlytheupdatesitscardshowed.-ghapprefusestags,deletes,refsoutside`refs/heads/`,pushoptionsandsignedpushes,eachwithitsownreasonbesidetheref.GitHubrefusesapushthatchangesaworkflowfile,becauseghapp'stokenlackstheworkflowspermission.-GitLFSdoesnotworkforahostinthehostfile,becausegit-lfsfollowsthesamerewriteandfails.-Gitolderthan2.31ignoresthesettingsandgoestoGitHubwithnocredential,soapubliccloneworksandapushoraprivaterepositoryfails.-Inagentprocessesthethreeentriesreplaceaperson'sown`GIT_CONFIG_COUNT`anditskeys,fromtheirenvironmentortheirsettings.-Onepushnamesatmostafewdozenbranchupdates,becauseagitgrantstaysunder8000bytes.Alargerpushstopswith`Straza:thispushnames60refupdates,whichismorethanonegitgrantcancarry,soitdidnotrun.Pushfewerbranchesatatime,forexampleonegitpushperbranch.`-Thehostfileisonepermachine,soonamachinewherepeopleenrollwithdifferentStrazaservers,itfollowstheserverthatansweredlast.-A`strazaservice`thatrunsastheuser,with`STRAZA_HOME`,writesitshostfileto`$STRAZA_HOME/service/git/hosts.conf`,whichthewiringdoesnotname,sogitonsuchamachinegoestoGitHubdirectly.-OnlyClaudeCodeonLinux,macOSandWindowsiswiredinthisversion.CodexCLIandGeminiCLIgetnogitwiringyet.-OnmacOS,ClaudeCode'ssandboxforshellcommands,whenanadministratorturnsiton,letsacommandreachonlytheUnixsocketsthatits`allowUnixSockets`settingnames.Thewiringdoesnotnametheservice'ssocket,sogitthroughStrazafailsinasandboxedcommandthere.##Next{.nostep}-[Eventsandtheauditrecord](https://docs.straza.ai/reference/events/index.md#git-grants)liststhefieldsofagrant'srecord.-[Thespec](https://docs.straza.ai/reference/spec/index.md)linksthegitgrantspecification,fortheauthorofanothergitresourceserver.-[Holdacallforaperson](https://docs.straza.ai/guides/write-policy/hold-for-a-human/index.md)setsuptheapproverroleandeveryapprovalwindow.


Walked on v1.0.0-1592-g4ede0baf on 2026-10-24, except the Windows and macOS steps, run only outside this page, and ghapp's settings and start lines, read from its code. The Linux steps were fired on the enterprise eval stack on 2026-10-24 at v1.0.0-1592-g4ede0baf with a ghapp build of the same day, as the agent joe-java-developer-agent in a Linux harness container with git 2.39.5 and no GitHub credential. The clone, the push, the hand-off of a public repo, a submodule, the refusal of a push to an uncovered repo, a held push with its wait lines and its expiry, and the grant records all ran. The git block and the roles went in through the admin API rather than this page's drafts, and the hold used a 90-second window. The manifest and the PolicySet on this page passed strazactl spec validate built from the working tree of that version, and the two manifest refusals quoted here are that build's own output. The Windows lines were written on 2026-10-24 from the working tree before their commit. On 2026-10-26 a Windows 10 machine with the MSI ran git clone, a push, the expiry of a held push and an approved push through the helper, in a run that did not follow this page's steps. The macOS lines were written on 2026-10-26 from the working tree. On 2026-10-26 a macOS 26.6.2 virtual machine with an unsigned package built from the source tree at v1.0.0-1610-g366fac50 pushed to GitHub through the helper, in a run that did not follow this page's steps. The ghapp settings and start lines were read from ghapp's code on 2026-11-01.