# History Policy

Status: VERIFIED BY LOCAL SELF-TEST

## Rule

Generated collaboration repos must have fresh Git history.

They must not share commit SHA values with `C:\hades\Hecton8`.

History is also scanned for denied paths, blocked binary/media extensions, private
references, and common secret token shapes. Text blobs are scanned up to the same
2 MiB per-file limit as the payload gate. A deleted leak is still a leak.

Git object-store indirection is rejected before trust is assigned:
`.git/objects/info/alternates`, `.git/commondir`, `.git/modules`, worktree
`.git` files, and mismatched `git-common-dir` are blockers. Fresh refs are not
fresh isolation if the repo borrows production objects.

## Command

```powershell
powershell -NoProfile -ExecutionPolicy Bypass -File .\tools\Test-H8GitHistoryPolicy.ps1 `
  -Root C:\hades\Hecton8_PublicSDK_Export `
  -ProductionRoot C:\hades\Hecton8 `
  -DenyProfile C:\hades\Hecton8_PublicSDK_Export\profiles\public-sdk.deny
```

## Meaning

`rootCommitCount = 0` is valid before the first public commit.

Any `sharedCommitCount > 0` means the generated repo was created from production
history or the wrong repository was checked.

Any `HISTORY_*` blocker means the public history must be regenerated, not merely
fixed in the latest commit.