Your agents push through here.

A git remote that checks the work before it lands. Pushes that prove what your policy asks for go through to your real repository; pushes that can't are refused with the exact command that fixes them — so the agent corrects itself instead of waiting for you.