# address checkpoint policy feedback

`b01442a`·
  pfleidi·3w ago·6 files·+145 added/-11 removed

Preserve local policy history when updating and reject true divergence before rewriting the policy ref.

Accept SHA-256 object IDs from remote policy refs and keep policy upgrade warnings enabled for hidden user aliases while still excluding hidden infrastructure commands.

## Sessions

2bfd7535ed16View transcript

[?\
Implement Checkpoint Policy Management SystemCodex·GPT-5.5·2 steps](/content/gh/entireio/cli/session/019ef111-70d5-7203-b653-e4834b8b92c0#timeline-2bfd7535ed16/index.html)

## Changes

6

- cmd/entire/cli

- Mcheckpoint_policy_warning.go+10/-1

- Mcheckpoint_policy_warning_test.go+8

- checkpointpolicy

- Mremote.go+24/-3

- Aremote_internal_test.go+28

- Mupdate.go+15/-2

- Mupdate_test.go+60/-5

```
15 unmodified lines

...
```

```go
func isCheckpointPolicyWarningExcludedCommand(name string) bool {
    switch name {
    case "hooks", "__send_analytics", "curl-bash-post-install":
        return true
    default:
        return false
    }
}
```

```go
func WarnCheckpointPolicyIfNeeded(ctx context.Context, w io.Writer, currentVersion string) {
    repo, err := gitrepo.OpenCurrent(ctx)
    if err != nil {

```

```go
func Sync(ctx context.Context, repo *git.Repository, target Target) (State, error) {

```

```go
func parseRemotePolicyHash(raw string) (plumbing.Hash, error) {
    if !isSupportedRemotePolicyHashLength(raw) {
        return plumbing.ZeroHash, fmt.Errorf("invalid remote checkpoint policy hash %q", raw)
    }
    hash, ok := plumbing.FromHex(raw)
    if !ok {
        return plumbing.ZeroHash, fmt.Errorf("invalid remote checkpoint policy hash %q", raw)
    }
    return hash, nil
}
```

```go
func TestUpdateRejectsDowngradeFromRemoteWithoutForce(t *testing.T) {
    t.Parallel()
    remoteDir, remoteRepo, bareDir := initPolicyRemoteFixture(t)
    remoteHash, err := checkpointpolicy.WriteLocal(t.Context(), remoteRepo, plumbing.ZeroHash, checkpointpolicy.Policy{
    ...
}
}

...