Open a proposal by pushing to refs/for

If a lane requires review, a direct git push to it is refused — advancing it would land a change while bypassing the review gate. Push to the magic ref instead, and the same commits open a proposal.

git push origin HEAD:refs/for/main

git push origin my-branch:refs/for/main

What actually happens

1. The pushed commits are validated and imported, each getting a stable change id.
2. A Proposal is opened targeting the named lane. The reviewed commit is pinned to the imported commit, and the base is pinned to the Forge's own view of the lane tip — never to anything the client claimed.
3. The normal land gate runs: review coverage, required checks, secret scan.
4. No real ref is advanced. The virtual ref is reported back as accepted, so your Git client shows a successful push.

It is idempotent

Re-pushing the same commit reuses the proposal that already pins it rather than opening a duplicate. That makes git push safe to repeat, which matters because Git clients and CI retry.

Why the routing is not yours to choose

Whether a push fast-forwards, is refused, or becomes a proposal is derived from repository policy and the refs/for/ name alone. There is no client-side flag that opts into or out of the gate. A client that could elect its own routing would not be gated at all.

What is refused

• A direct push to a review-required lane: TVO-GHC-063, naming this ref as the remedy.
• A malformed magic-ref push — an empty lane name, an update that is not a create, or a proposed commit missing from the pack — is rejected per-ref.
• Everything the ordinary git push surface refuses still applies: protected paths, and a repository that requires signed commits.

Auditing

A proposal-routed push records no push audit entry, because no ref moved and claiming otherwise would be false. Its durable trace is the Proposal itself, whose author is stamped from the authenticated principal — the same as a proposal created natively.

The native equivalent

tovio change propose --target main --remote <host:port>

Same gate, same proposal. Push the change to the Forge first so its commits are there; a draft or abandoned change is not proposable until you promote or restore it. refs/for/ exists so a teammate who has not installed TOVIO can still participate in review.