Validate proposed Git objects before publication: repairs add one linear commit, and rebases preserve original author identities, dates, and messages. Protected repository content must remain faithful to the original head and captured base; malformed paths, symlinks, ambiguous histories, and unrelated protected edits are rejected.

Existing design exception hashes can be renewed only when source bytes and a bounded reviewed rationale match. Exception definitions and broader design rules remain protected.

Validation: 16 focused tests include real Git histories, protected changes, malformed byte filenames, and exact hash renewals. Independently reviewed.