Git notes

cli/assets/generated/config/schema/sce-config.schema.json

@@ -58,6 +58,31 @@
           },
           "additionalProperties": false
         },
+        "agent_trace": {
+          "description": "Agent Trace hook policy. Controls where post-commit Agent Trace JSON is mirrored as a git note and whether that notes ref is auto-pushed.",
+          "type": "object",
+          "properties": {
+            "git_notes_ref": {
+              "description": "Git notes ref used for Agent Trace JSON persistence. Defaults to refs/notes/sce-agent-trace.",
+              "default": "refs/notes/sce-agent-trace",
+              "type": "string",
+              "minLength": 1
+            },
+            "push_notes": {
+              "description": "Agent Trace git-notes push policy. Notes auto-push is enabled by default.",
+              "type": "object",
+              "properties": {
+                "enabled": {
+                  "description": "Enable best-effort Agent Trace git-notes auto-push after local note persistence. Defaults to true when omitted; set false to disable.",
+                  "default": true,
+                  "type": "boolean"
+                }
+              },
+              "additionalProperties": false
+            }
+          },
+          "additionalProperties": false
+        },
         "database_retry": {
           "type": "object",
           "properties": {

cli/src/services/config/render.rs

@@ -35,6 +35,7 @@ pub(super) fn format_show_output(runtime: &RuntimeConfig, report_format: ReportF
                     &runtime.workos_client_id,
                 ),
                 format_bash_policies_text(&runtime.bash_policies),
+                format_agent_trace_policy_text(runtime),
                 format_database_retry_text(&runtime.database_retry),
                 format_validation_warnings_text(&warnings),
             ];
@@ -70,6 +71,7 @@ pub(super) fn format_show_output(runtime: &RuntimeConfig, report_format: ReportF
                         "workos_client_id": format_optional_auth_resolved_value_json(WORKOS_CLIENT_ID_KEY, &runtime.workos_client_id),
                         "policies": {
                             "bash": format_bash_policies_json(&runtime.bash_policies),
+                            "agent_trace": format_agent_trace_policy_json(runtime),
                             "database_retry": format_database_retry_json(&runtime.database_retry),
                         }
                     },
@@ -369,6 +371,48 @@ fn abbreviate_text_value(value: &str) -> String {
     format!("{prefix}...{suffix}")
 }
 
+fn format_agent_trace_policy_text(runtime: &RuntimeConfig) -> String {
+    [
+        format!("  {}:", style::label("policies.agent_trace")),
+        format!(
+            "    {}",
+            format_resolved_value_text(
+                "git_notes_ref",
+                &runtime.agent_trace_git_notes_ref.value,
+                runtime.agent_trace_git_notes_ref.source,
+            )
+        ),
+        format!(
+            "    {}",
+            format_resolved_value_text(
+                "push_notes.enabled",
+                if runtime.agent_trace_push_notes_enabled.value {
+                    "true"
+                } else {
+                    "false"
+                },
+                runtime.agent_trace_push_notes_enabled.source,
+            )
+        ),
+    ]
+    .join("\n")
+}
+
+fn format_agent_trace_policy_json(runtime: &RuntimeConfig) -> Value {
+    json!({
+        "git_notes_ref": format_resolved_value_json(
+            &runtime.agent_trace_git_notes_ref.value,
+            runtime.agent_trace_git_notes_ref.source,
+        ),
+        "push_notes": {
+            "enabled": format_resolved_value_json(
+                runtime.agent_trace_push_notes_enabled.value,
+                runtime.agent_trace_push_notes_enabled.source,
+            ),
+        },
+    })
+}
+
 fn retry_policy_display(policy: &crate::services::resilience::RetryPolicy) -> String {
     format!(
         "{} attempts, {}ms timeout, {}..{}ms backoff",

cli/src/services/config/resolver.rs

@@ -16,8 +16,8 @@ use super::types::{
     parse_bool_value_from, ConfigPathSource, ConfigRequest, DatabaseRetryConfig, LoadedConfigPath,
     LogFileMode, LogFormat, LogLevel, ReportFormat, ResolvedAuthRuntimeConfig,
     ResolvedHookRuntimeConfig, ResolvedObservabilityRuntimeConfig, ResolvedOptionalValue,
-    ResolvedValue, ValueSource, ENV_ATTRIBUTION_HOOKS_DISABLED, ENV_LOG_FILE, ENV_LOG_FILE_MODE,
-    ENV_LOG_FORMAT, ENV_LOG_LEVEL,
+    ResolvedValue, ValueSource, DEFAULT_AGENT_TRACE_GIT_NOTES_REF, ENV_ATTRIBUTION_HOOKS_DISABLED,
+    ENV_LOG_FILE, ENV_LOG_FILE_MODE, ENV_LOG_FORMAT, ENV_LOG_LEVEL,
 };
 
 const DEFAULT_TIMEOUT_MS: u64 = 30000;
@@ -62,6 +62,8 @@ pub(super) struct RuntimeConfig {
     pub(super) log_file_mode: ResolvedValue<LogFileMode>,
     pub(super) timeout_ms: ResolvedValue<u64>,
     pub(super) attribution_hooks_enabled: ResolvedValue<bool>,
+    pub(super) agent_trace_git_notes_ref: ResolvedValue<String>,
+    pub(super) agent_trace_push_notes_enabled: ResolvedValue<bool>,
     pub(super) workos_client_id: ResolvedOptionalValue<String>,
     pub(super) bash_policies: ResolvedOptionalValue<BashPolicyConfig>,
     pub(super) database_retry: ResolvedOptionalValue<DatabaseRetryConfig>,
@@ -226,6 +228,8 @@ where
 
     Ok(ResolvedHookRuntimeConfig {
         attribution_hooks_enabled: runtime.attribution_hooks_enabled.value,
+        agent_trace_git_notes_ref: runtime.agent_trace_git_notes_ref.value,
+        agent_trace_push_notes_enabled: runtime.agent_trace_push_notes_enabled.value,
     })
 }
 
@@ -272,6 +276,8 @@ where
         log_file_mode: None,
         timeout_ms: None,
         attribution_hooks_enabled: None,
+        agent_trace_git_notes_ref: None,
+        agent_trace_push_notes_enabled: None,
         workos_client_id: None,
         bash_policy_presets: None,
         bash_policy_custom: None,
@@ -307,6 +313,12 @@ where
         if let Some(attribution_hooks_enabled) = layer.attribution_hooks_enabled {
             file_config.attribution_hooks_enabled = Some(attribution_hooks_enabled);
         }
+        if let Some(agent_trace_git_notes_ref) = layer.agent_trace_git_notes_ref {
+            file_config.agent_trace_git_notes_ref = Some(agent_trace_git_notes_ref);
+        }
+        if let Some(agent_trace_push_notes_enabled) = layer.agent_trace_push_notes_enabled {
+            file_config.agent_trace_push_notes_enabled = Some(agent_trace_push_notes_enabled);
+        }
         if let Some(workos_client_id) = layer.workos_client_id {
             file_config.workos_client_id = Some(workos_client_id);
         }
@@ -449,6 +461,10 @@ where
             source: ValueSource::Env,
         };
     }
+    let resolved_agent_trace_git_notes_ref =
+        resolve_agent_trace_git_notes_ref(file_config.agent_trace_git_notes_ref.as_ref());
+    let resolved_agent_trace_push_notes_enabled =
+        resolve_agent_trace_push_notes_enabled(file_config.agent_trace_push_notes_enabled.as_ref());
     let resolved_workos_client_id = resolve_optional_auth_config_value(
         WORKOS_CLIENT_ID_KEY,
         file_config.workos_client_id,
@@ -472,6 +488,8 @@ where
         log_file_mode: resolved_log_file_mode,
         timeout_ms: resolved_timeout_ms,
         attribution_hooks_enabled: resolved_attribution_hooks_enabled,
+        agent_trace_git_notes_ref: resolved_agent_trace_git_notes_ref,
+        agent_trace_push_notes_enabled: resolved_agent_trace_push_notes_enabled,
         workos_client_id: resolved_workos_client_id,
         bash_policies: resolved_bash_policies,
         database_retry: resolved_database_retry,
@@ -480,6 +498,38 @@ where
     })
 }
 
+fn resolve_agent_trace_git_notes_ref(
+    file_value: Option<&schema::FileConfigValue<String>>,
+) -> ResolvedValue<String> {
+    if let Some(value) = file_value {
+        return ResolvedValue {
+            value: value.value.clone(),
+            source: ValueSource::ConfigFile(value.source),
+        };
+    }
+
+    ResolvedValue {
+        value: DEFAULT_AGENT_TRACE_GIT_NOTES_REF.to_string(),
+        source: ValueSource::Default,
+    }
+}
+
+fn resolve_agent_trace_push_notes_enabled(
+    file_value: Option<&schema::FileConfigValue<bool>>,
+) -> ResolvedValue<bool> {
+    if let Some(value) = file_value {
+        return ResolvedValue {
+            value: value.value,
+            source: ValueSource::ConfigFile(value.source),
+        };
+    }
+
+    ResolvedValue {
+        value: true,
+        source: ValueSource::Default,
+    }
+}
+
 fn resolve_optional_auth_config_value<FEnv>(
     key: AuthConfigKeySpec,
     file_value: Option<schema::FileConfigValue<String>>,
@@ -682,6 +732,8 @@ mod tests {
 
         Ok(ResolvedHookRuntimeConfig {
             attribution_hooks_enabled: runtime.attribution_hooks_enabled.value,
+            agent_trace_git_notes_ref: runtime.agent_trace_git_notes_ref.value,
+            agent_trace_push_notes_enabled: runtime.agent_trace_push_notes_enabled.value,
         })
     }
 
@@ -692,6 +744,67 @@ mod tests {
         assert!(resolved.attribution_hooks_enabled);
     }
 
+    #[test]
+    fn agent_trace_git_notes_ref_uses_default() {
+        let resolved = resolve_hooks_with_env_and_config(None, None).unwrap();
+
+        assert_eq!(
+            resolved.agent_trace_git_notes_ref,
+            DEFAULT_AGENT_TRACE_GIT_NOTES_REF
+        );
+    }
+
+    #[test]
+    fn agent_trace_git_notes_ref_uses_explicit_config() {
+        let resolved = resolve_hooks_with_env_and_config(
+            None,
+            Some(r#"{"policies":{"agent_trace":{"git_notes_ref":"refs/notes/custom-sce"}}}"#),
+        )
+        .unwrap();
+
+        assert_eq!(resolved.agent_trace_git_notes_ref, "refs/notes/custom-sce");
+    }
+
+    #[test]
+    fn agent_trace_push_notes_enabled_uses_default() {
+        let resolved = resolve_hooks_with_env_and_config(None, None).unwrap();
+
+        assert!(resolved.agent_trace_push_notes_enabled);
+    }
+
+    #[test]
+    fn agent_trace_push_notes_enabled_uses_explicit_config_false() {
+        let resolved = resolve_hooks_with_env_and_config(
+            None,
+            Some(r#"{"policies":{"agent_trace":{"push_notes":{"enabled":false}}}}"#),
+        )
+        .unwrap();
+
+        assert!(!resolved.agent_trace_push_notes_enabled);
+    }
+
+    #[test]
+    fn invalid_agent_trace_push_notes_shape_is_rejected() {
+        resolve_hooks_with_env_and_config(
+            None,
+            Some(r#"{"policies":{"agent_trace":{"push_notes":{"enabled":"no"}}}}"#),
+        )
+        .unwrap_err();
+    }
+
+    #[test]
+    fn blank_agent_trace_git_notes_ref_is_rejected() {
+        let error = resolve_hooks_with_env_and_config(
+            None,
+            Some(r#"{"policies":{"agent_trace":{"git_notes_ref":"   "}}}"#),
+        )
+        .unwrap_err();
+
+        assert!(error
+            .to_string()
+            .contains("policies.agent_trace.git_notes_ref"));
+    }
+
     #[test]
     fn attribution_hooks_disabled_env_truthy_opts_out() {
         let resolved =