Force pushes wait for an exception
Force pushes and history rewrites are blocked before they run, until someone allows one.
A force push, stopped
- History stays as it was
- The rewrite never reaches the remote, so nobody has to recover the branch.
- Allowed once, on purpose
- The agent or person asks from the record. An admin allows it once or for a while, and the retry passes.
- A plain push carries on
- Pushing the work to a new branch is not a force push, so this policy leaves it alone.
The Protected branches policy
Force pushes and history rewrites on main and release branches.
- It installs as Observe, so you see your own traffic first. Turn it to Block when you are ready.
- The branch is not part of the action the adapter sees, so force pushes to any branch are watched.
- Arguments match from the start: git push --force origin main matches, git push origin main --force does not.
Related use cases and clients
- Production changesAn agent’s deploy is blocked until someone allows it, and the answer stays on the record.
- Destructive operationsRecursive deletes, cleans and drops are blocked until someone allows them.
- Set up CodexShell commands, patches and MCP tools in Codex pass the adapter before they run, and its rules hold even with hooks off.