spike: detect divergent / unrelated history on push

[coopernetes]

Concept

Detect when a push contains commits with no common ancestor with the target branch's current HEAD — i.e. unrelated histories being force-merged into an existing branch. This is almost always a mistake (wrong remote, wrong branch, orphan branch pushed to main).

How it would work

The proxy already maintains a local mirror of upstream. On push:

1. Extract the target refspec from the push (e.g. refs/heads/main)
2. Look up the current upstream HEAD for that ref in the local mirror
3. Run git merge-base <pushed-tip> <upstream-HEAD> — if it returns nothing, the histories are unrelated
4. Emit a warning or block depending on operator config

Known challenges

• Orphan branches (gh-pages, wiki, project-specific detached histories) — legitimate unrelated histories exist. Needs an exclude list or opt-in block mode only.
• Mirror freshness — the upstream ref must be recent; stale mirror could false-positive on a branch that was reset upstream
• First push of a brand-new repo — no upstream HEAD exists, trivially passes
• Performance — merge-base on large repos with deep history can be slow; the shallow mirror helps bound this

Motivation

Caught in the wild: pushing a large application repo to a small test repo via the proxy created a push record with 40+ commits, 40k+ LOC, and 40+ validation failures — all noise. The proxy had no way to say "these commits have nothing to do with this repository."

Status

Moonshot — needs design refinement before implementation. File under a future milestone once WARN status and diff size policy are shipped.