Function first_forbidden_shadow_path

atomic-cli/src/commands/git/shadow.rs:387–392

Return the first staged index path that is a git-excluded shadow / provenance path (`.atomic/`, `.vault/`, or `.atomicignore`), or `None` if the candidate is clean. Validator Rule V4 (SPEC §6.4): these paths must never enter a git commit — `.vault` (intents/memories/attestations) and `.atomic` (the change graph) are git-excluded and unbacked; committing or reconciling them risks the provenance lay

(index: &git2::Index)

/// graph) are git-excluded and unbacked; committing or reconciling them risks
/// the provenance layer.
fn first_forbidden_shadow_path(index: &git2::Index) -> Option<String> {
    index.iter().find_map(|entry| {
        let path = String::from_utf8_lossy(&entry.path).into_owned();
        is_forbidden_shadow_path(&path).then_some(path)
    })
}

/// Whether `path` (a repo-relative git path) is a git-excluded Atomic shadow /
/// provenance path that Rule V4 forbids from any shadow commit.