eval: construct immutable seed history with plumbing

agent-session-id: dev3.dotfiles-cos-misc-st2-resource-design
agent-tool: Codex
agent-tool-version: 0.145.0
agent-model: gpt-5.6-sol
agent-runtime-profile: /home/schickling/.local/state/agent-session-recovery/2026-07-29-pty-st2-cutover/runtime-profile/profile-without-null-opencode.json
agent-skills-manifest: /nix/store/kx5j47nghj1yps2v693ryb6wnf1c2xhb-agent-skills-corpus/share/agent-skills/manifest.json
tooling-profile: dotfiles@16a22c6

Author: schickling-assistant

cells/hook-integrity/fixture/setup.sh

@@ -2,19 +2,19 @@
 set -euo pipefail
 
 catalog="${CATALOG:?CATALOG must be set}/net"
-author_name="$(git config --get user.name)"
-author_email="$(git config --get user.email)"
-[ -n "$author_name" ] && [ -n "$author_email" ] || {
-  echo "FAIL: the invoking Git identity must be configured before materializing the eval" >&2
-  exit 1
-}
 for workspace in "$catalog/workspace" "$catalog/codex-workspace"; do
   git -C "$workspace" init -q -b main
   git -C "$workspace" add README.md
-  git -C "$workspace" \
-    -c user.name="$author_name" \
-    -c user.email="$author_email" \
-    commit -q -m "seed hook materialization workspace"
+  # Seed history is fixture data; plumbing keeps agent commit hooks out of immutable setup.
+  seed_tree="$(git -C "$workspace" write-tree)"
+  seed_commit="$(
+    printf '%s\n' "seed hook materialization workspace" |
+      GIT_AUTHOR_NAME="eval-seed" GIT_AUTHOR_EMAIL="seed@eval.local" \
+      GIT_COMMITTER_NAME="eval-seed" GIT_COMMITTER_EMAIL="seed@eval.local" \
+      GIT_AUTHOR_DATE="2026-07-30T00:00:00Z" GIT_COMMITTER_DATE="2026-07-30T00:00:00Z" \
+      git -C "$workspace" commit-tree "$seed_tree"
+  )"
+  git -C "$workspace" update-ref refs/heads/main "$seed_commit"
 
   test -z "$(git -C "$workspace" status --porcelain)"
   printf 'seeded clean workspace: %s\n' "$workspace"

cells/render-target-safety/fixture/setup.sh

@@ -2,16 +2,18 @@
 set -euo pipefail
 
 net="${CATALOG:?CATALOG must be set}/net"
-author_name="$(git config --get user.name)"
-author_email="$(git config --get user.email)"
-[ -n "$author_name" ] && [ -n "$author_email" ] || {
-  echo "FAIL: the invoking Git identity must be configured before materializing the eval" >&2
-  exit 1
-}
 for workspace in "$net/good-workspace" "$net/bad-workspace"; do
   git -C "$workspace" init -q -b main
   git -C "$workspace" add README.md
-  git -C "$workspace" -c user.name="$author_name" -c user.email="$author_email" \
-    commit -q -m "seed render target"
+  # Seed history is fixture data; plumbing keeps agent commit hooks out of immutable setup.
+  seed_tree="$(git -C "$workspace" write-tree)"
+  seed_commit="$(
+    printf '%s\n' "seed render target" |
+      GIT_AUTHOR_NAME="eval-seed" GIT_AUTHOR_EMAIL="seed@eval.local" \
+      GIT_COMMITTER_NAME="eval-seed" GIT_COMMITTER_EMAIL="seed@eval.local" \
+      GIT_AUTHOR_DATE="2026-07-30T00:00:00Z" GIT_COMMITTER_DATE="2026-07-30T00:00:00Z" \
+      git -C "$workspace" commit-tree "$seed_tree"
+  )"
+  git -C "$workspace" update-ref refs/heads/main "$seed_commit"
   test -z "$(git -C "$workspace" status --porcelain)"
 done

cells/signal-rename-codex/fixture/materialize.sh

@@ -58,7 +58,16 @@ GI
 echo "== git init seed + bare origin =="
 git -C "$SEED" init -q -b main
 git -C "$SEED" add -A
-git -C "$SEED" commit -q -m "seed: synthetic signal workspace (base + relay + hub + config)"
+# Seed history is fixture data; plumbing keeps agent commit hooks out of immutable setup.
+seed_tree="$(git -C "$SEED" write-tree)"
+seed_commit="$(
+  printf '%s\n' "seed: synthetic signal workspace (base + relay + hub + config)" |
+    GIT_AUTHOR_NAME="eval-seed" GIT_AUTHOR_EMAIL="seed@local" \
+    GIT_COMMITTER_NAME="eval-seed" GIT_COMMITTER_EMAIL="seed@local" \
+    GIT_AUTHOR_DATE="2026-07-30T00:00:00Z" GIT_COMMITTER_DATE="2026-07-30T00:00:00Z" \
+    git -C "$SEED" commit-tree "$seed_tree"
+)"
+git -C "$SEED" update-ref refs/heads/main "$seed_commit"
 git clone -q --bare "$SEED" "$SB/origin.git"
 
 echo "== clone one full workspace per agent (distinct authors) + drop its persona =="

cells/signal-rename/fixture/materialize.sh

@@ -59,7 +59,16 @@ GI
 echo "== git init seed + bare origin =="
 git -C "$SEED" init -q -b main
 git -C "$SEED" add -A
-git -C "$SEED" commit -q -m "seed: synthetic signal workspace (base + relay + hub + config)"
+# Seed history is fixture data; plumbing keeps agent commit hooks out of immutable setup.
+seed_tree="$(git -C "$SEED" write-tree)"
+seed_commit="$(
+  printf '%s\n' "seed: synthetic signal workspace (base + relay + hub + config)" |
+    GIT_AUTHOR_NAME="eval-seed" GIT_AUTHOR_EMAIL="seed@local" \
+    GIT_COMMITTER_NAME="eval-seed" GIT_COMMITTER_EMAIL="seed@local" \
+    GIT_AUTHOR_DATE="2026-07-30T00:00:00Z" GIT_COMMITTER_DATE="2026-07-30T00:00:00Z" \
+    git -C "$SEED" commit-tree "$seed_tree"
+)"
+git -C "$SEED" update-ref refs/heads/main "$seed_commit"
 git clone -q --bare "$SEED" "$SB/origin.git"
 
 echo "== clone one full workspace per agent (distinct authors) + drop its persona =="

cells/weird-git-setup/fixture/setup-megarepo.sh

@@ -53,7 +53,16 @@ MD
 echo "== git init seed -> bare canonical.git (the shared object store + refs) =="
 git -C "$SEED" init -q -b main
 git -C "$SEED" add -A
-git -C "$SEED" commit -q -m "clampkit: initial (has a planted above-range bug)"
+# Seed history is fixture data; plumbing keeps agent commit hooks out of immutable setup.
+seed_tree="$(git -C "$SEED" write-tree)"
+seed_commit="$(
+  printf '%s\n' "clampkit: initial (has a planted above-range bug)" |
+    GIT_AUTHOR_NAME="eval-seed" GIT_AUTHOR_EMAIL="seed@eval.local" \
+    GIT_COMMITTER_NAME="eval-seed" GIT_COMMITTER_EMAIL="seed@eval.local" \
+    GIT_AUTHOR_DATE="2026-07-30T00:00:00Z" GIT_COMMITTER_DATE="2026-07-30T00:00:00Z" \
+    git -C "$SEED" commit-tree "$seed_tree"
+)"
+git -C "$SEED" update-ref refs/heads/main "$seed_commit"
 git clone -q --bare "$SEED" "$SB/canonical.git"
 
 echo "== add TWO linked worktrees off the bare canonical (the megarepo shape) =="