docs: decision 135, row 93 bundles over a git socket (amends brief dff83c09)

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/plans/2026-09-26_lead-decisions.md

@@ -3010,3 +3010,34 @@ which stay with him. Each item names who decided it and what happened.
     - Decision 130's split stands: Filbert reviews non-sandbox rows only,
       and Dewey keeps rows 91 and 93.
     - Mos had no objection.
+
+135. **Row 93 moves commits as bundles; the host never runs git in a
+    live clone (2026-10-13, Sage on Darkwing's design,
+    agents/darkwing/work/queue-93/r1-design.md).** The brief (blob
+    dff83c09) had the host push from, and fetch into, the caller's
+    clone. That clone belongs to a running session, which can change its
+    config, attributes, hooks or `.git` links between any host check and
+    the git call. Row 91 round 2's escape came through one git child the
+    checks missed. This ruling amends the brief; its outcome is
+    unchanged.
+    - `push_working`: the runner bundles the branch inside the sandbox
+      and streams it to the host. The host caps the size, writes the
+      bundle to its own directory, and fetches it into the bare working
+      repository with object fsck, no `+`, and a ref name it builds from
+      the validated task ref. A first push must descend from the working
+      repository's `main`. `fetch_review`: the host bundles `work/<ref>`
+      and streams it back; the reviewer's own git fetches it inside its
+      sandbox.
+    - Transport: a second socket, `bus-host/git.sock`, bound only for
+      roles that hold `git.push.working` or `review.verdict`. Identity
+      and authorization work as on the launch socket. The launch socket
+      stays bound only to the role that may launch. The sandbox gains
+      this one bind; it is a sandbox change, so decision 130's review
+      split applies.
+    - Files: a new host module (Darkwing names it in the packet) in
+      place of edits to `checkout.mjs`, plus the bind in `sandbox.mjs`.
+    - `task_close`: a task with any `git.push.working` event closes only
+      by citing an `approve` verdict on the same task whose request named
+      the task's latest pushed commit. A task with no push needs none.
+    - Owner Darkwing, reviewers Dewey and Sage (decision 131). Building
+      starts when row 91 closes and Sage switches the row.