enforce lifecycle contracts and scratch transport

internal/continuity/continuity.go

@@ -194,6 +194,16 @@ func ScratchCommit(root, branch, message string) error {
 	if strings.TrimSpace(message) == "" {
 		return errors.New("scratch commit message required")
 	}
+	status, err := exec.Command("git", "-C", root, "status", "--porcelain", "--", "TASK.md").Output()
+	if err != nil {
+		return err
+	}
+	if len(status) != 0 {
+		return errors.New("TASK.md is immutable")
+	}
+	if strings.TrimSpace(message) == "" {
+		return errors.New("scratch commit message required")
+	}
 	for _, args := range [][]string{{"switch", "-c", branch}, {"add", "-A"}, {"commit", "-m", message}} {
 		if err := exec.Command("git", append([]string{"-C", root}, args...)...).Run(); err != nil {
 			return err
@@ -202,6 +212,23 @@ func ScratchCommit(root, branch, message string) error {
 	return nil
 }
 
+func ScratchPush(root, branch, remote string) error {
+	if branch == "" || remote == "" {
+		return errors.New("scratch branch and remote required")
+	}
+	return exec.Command("git", "-C", root, "push", remote, branch).Run()
+}
+
+func ScratchPull(root, branch, remote string) error {
+	if branch == "" || remote == "" {
+		return errors.New("scratch branch and remote required")
+	}
+	if err := exec.Command("git", "-C", root, "fetch", remote, branch).Run(); err != nil {
+		return err
+	}
+	return exec.Command("git", "-C", root, "merge", "--ff-only", "FETCH_HEAD").Run()
+}
+
 // ScratchSync pushes/pulls a scratch branch. Pull uses fast-forward-only to
 // avoid silently merging independent WIP histories.
 func ScratchSync(root, branch, remote string, push bool) error {

internal/continuity/continuity_test.go

@@ -55,6 +55,31 @@ func TestDecodeRejectsUnknownKnowledgeFields(t *testing.T) {
 	}
 }
 
+func TestScratchCommitProtectsTask(t *testing.T) {
+	root := t.TempDir()
+	run := func(a ...string) {
+		c := exec.Command("git", append([]string{"-C", root}, a...)...)
+		c.Env = append(os.Environ(), "GIT_AUTHOR_NAME=test", "GIT_AUTHOR_EMAIL=test@example", "GIT_COMMITTER_NAME=test", "GIT_COMMITTER_EMAIL=test@example")
+		if b, e := c.CombinedOutput(); e != nil {
+			t.Fatalf("git: %s %v", b, e)
+		}
+	}
+	os.WriteFile(filepath.Join(root, "TASK.md"), []byte("fixed"), 0644)
+	run("init")
+	run("add", ".")
+	run("commit", "-m", "init")
+	os.WriteFile(filepath.Join(root, "wip.txt"), []byte("wip"), 0644)
+	if err := ScratchCommit(root, "scratch/task", "wip"); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(root, "TASK.md"), []byte("changed"), 0644); err != nil {
+		t.Fatal(err)
+	}
+	if err := ScratchCommit(root, "scratch/other", "bad"); err == nil {
+		t.Fatal("expected immutable TASK.md rejection")
+	}
+}
+
 func TestVerifyTaskFileRejectsMutation(t *testing.T) {
 	root := t.TempDir()
 	if err := os.WriteFile(filepath.Join(root, "TASK.md"), []byte("task"), 0644); err != nil {