Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@CLAUDE.md`:
- Line 138: The note incorrectly points at git_url_validator; update the wording
to point readers to GitCloneTool (the class responsible for injecting
http.curloptResolve) instead, clarifying that git_url_validator only returns
validation data and helpers while GitCloneTool performs the actual HTTPS clone
path resolution; change the reference text to mention GitCloneTool (and
optionally its module synthorg.tools.git_tools) and explain that the
curloptResolve injection occurs there so future maintainers edit the correct
location.

In `@src/synthorg/tools/git_tools.py`:
- Around line 685-692: The branch that returns early when
validation.resolved_ips is empty is emitting GIT_COMMAND_START even though no
git subprocess is launched; change this to emit a dedicated skip event (e.g.,
GIT_MITIGATION_SKIPPED or GIT_CLONE_MITIGATION_SKIPPED) instead of
GIT_COMMAND_START in the logger.debug call inside the if not
validation.resolved_ips block, keeping the same metadata (hostname and note) and
returning args as before; add the new event constant if it doesn't exist and
update any event consumers/tests accordingly to expect the mitigation-skip event
rather than a git.command.start event.
- Around line 694-706: The DNS-pinning branch currently unconditionally injects
http.curloptResolve (in the block using validation.is_https,
build_curl_resolve_value, and logging GIT_CLONE_DNS_PINNED) but must first
verify the Git binary supports that config (support added in Git v2.37.0); add a
runtime capability check (e.g., call a helper like get_git_version or run `git
--version` and parse/compare to 2.37.0) before returning ["-c",
f"http.curloptResolve={resolve_value}", *args], and if the Git version is older,
raise/return a clear error explaining that DNS-pinning requires Git >= 2.37.0
(do not silently fall back). Ensure the check happens at clone time in the same
code path so the clone fails fast with a descriptive message when unsupported.

In `@src/synthorg/tools/git_url_validator.py`:
- Around line 310-312: Before raising the ValueError in the block that checks
"if not ips" (the code that sets msg = "ips must not be empty" then raises
ValueError), log the error with context at WARNING or ERROR level (e.g.,
logger.error or logger.warning) including the message and relevant context (the
ips variable and any request/remote info available) and then raise the
ValueError as before; ensure you use the module logger (logger =
logging.getLogger(__name__) if not already defined) and keep the log message and
the raised msg consistent.

In `@tests/unit/tools/git/test_git_clone.py`:
- Around line 341-366: The test test_mitigation_disabled_skips_pinning currently
never verifies that GitCloneTool forwards
GitCloneNetworkPolicy(dns_rebinding_mitigation=False) into
validate_clone_url_host because the stubbed _mock_validate returns
resolved_ips=() unconditionally; update the test so the validator stub asserts
it received the policy (or make _mock_validate accept an expected_policy and
raise/assert if received.policy.dns_rebinding_mitigation is not False) or
replace the stub with the real validator and mock DNS resolution; ensure the
assertion verifies that validate_clone_url_host was called with a policy whose
dns_rebinding_mitigation is False (referencing GitCloneTool,
GitCloneNetworkPolicy, validate_clone_url_host, _mock_validate, and captured).

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@docs/design/operations.md`:
- Around line 514-515: The docs incorrectly state that git >= 2.22 supports
http.curloptResolve; update the text to require git >= 2.37.0 and adjust the
sentence referencing `http.curloptResolve=host:port:ip` (and any other
occurrences of "git >= 2.22") to read "git >= 2.37.0" so the documented minimum
Git version matches the actual introduction of that feature.

In `@src/synthorg/tools/git_url_validator.py`:
- Around line 564-568: This path that returns for an invalid https port should
log a WARNING with context before returning: when raw_port is not None and
raw_port <= 0, emit a warning (using the same logger used elsewhere in this
module, e.g., logger.warning or process_logger.warning) including the clone URL
and the invalid raw_port value, then return the error string; mirror the
wording/format used in the other error paths (lines ~543-560) for consistency
while keeping the return value unchanged.

In `@tests/unit/tools/git/test_git_clone.py`:
- Around line 165-174: The helper _mock_validate currently types the inner
coroutine parameter policy as Any; update the signature so policy is typed as
GitCloneNetworkPolicy to match the real validate_clone_url_host and catch future
signature mismatches—i.e., change the async def _inner(url: str, policy: Any) ->
DnsValidationOk to use GitCloneNetworkPolicy for policy (and add/import the type
where needed) while keeping the returned DnsValidationOk and the
monkeypatch.setattr(git_tools_module, "validate_clone_url_host", _inner) logic
unchanged.

---

Duplicate comments:
In `@src/synthorg/tools/git_tools.py`:
- Around line 696-709: The DNS-pinning branch currently assumes
http.curloptResolve is supported but that option only exists in Git >= 2.37.0,
so update the logic that runs when validation.is_https (the block using
build_curl_resolve_value and returning ["-c",
f"http.curloptResolve={resolve_value}", *args]) to first check Git’s runtime
version (e.g., run and parse `git --version`) and require >= 2.37.0; if the
installed Git is older, either raise a clear error explaining the requirement or
log an explicit failure and abort the clone instead of silently returning the
config, and keep the GIT_CLONE_DNS_PINNED log to include version info so
operators know why DNS pinning wasn’t applied.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@src/synthorg/tools/git_url_validator.py`:
- Around line 562-574: The code accesses urlparse(url).port directly which can
raise ValueError for malformed ports; update the is_https branch to wrap the
port extraction in a try/except ValueError block so malformed ports are caught,
log the event via logger.warning using the existing GIT_CLONE_SSRF_BLOCKED,
hostname=normalized, port=raw_port (or the raw string), reason="invalid_port",
and return the same "Invalid port in clone URL" message; ensure port is only set
to raw_port or 443 when no exception occurs.
- Around line 303-329: The function build_curl_resolve_value currently treats
IPv6 addresses as not requiring brackets; update its implementation and
docstring to wrap any ip containing ':' in square brackets before joining into
the curl resolve string (so addresses become "[ipv6]" while IPv4 remains
unchanged), and keep the existing empty-ips check/logger behavior
(GIT_CLONE_DNS_FAILED and the ValueError) intact; ensure the returned format
from build_curl_resolve_value is "hostname:port:addr1,addr2,..." with IPv6
entries bracketed to satisfy libcurl parsing.

In `@tests/unit/tools/git/test_git_clone.py`:
- Around line 375-407: The test currently stubs verify_dns_consistency with
mock_verify that returns None but never asserts it was invoked; update the
test_scp_double_resolve_passes setup so the stub records calls (e.g. append
(hostname, expected_ips, dns_timeout) to a list or replace
verify_dns_consistency with a MagicMock) and then assert the recorded call(s)
include the expected hostname "example.com" (and/or expected_ips), or
alternately add a separate assertion or negative-case where mock_verify returns
a non-None string to exercise the TOCTOU mitigation; reference
verify_dns_consistency and mock_verify when making the changes and add an
assertion after tool.execute that the mock was called with the SCP hostname.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@src/synthorg/tools/git_tools.py`:
- Around line 696-709: Update the incorrect Git version note from "git >= 2.22"
to "git >= 2.37.0" in both places: the inline comment above the
http.curloptResolve usage in the code path that builds the curl resolve flag
(referenced via validation, build_curl_resolve_value, and GIT_CLONE_DNS_PINNED
in git_tools.py) and the module docstring in git_url_validator.py; additionally
add a runtime check (e.g., in the module that invokes git operations or in a
helper function used by git_url_validator) that queries the git version and
raises/returns an explicit error if git < 2.37.0 to avoid silent no-ops.

In `@tests/unit/tools/git/test_git_clone.py`:
- Around line 250-281: Add a `verify_calls` capture and assertion to the
`test_ssh_double_resolve_passes` test so it mirrors
`test_scp_double_resolve_passes`: create a list (e.g., verify_calls:
list[tuple[str, frozenset[str]]]) and a `mock_verify` that appends (hostname,
expected_ips) to it, monkeypatch `verify_dns_consistency` to that `mock_verify`,
run the test using `GitCloneTool(...).execute(...)` as already done, then assert
`verify_calls` contains the expected tuple for "example.com" to prove the TOCTOU
hook ran for SSH URLs too.

---

Duplicate comments:
In `@docs/design/operations.md`:
- Around line 514-515: Update the documentation sentence that references git
version support for http.curloptResolve: replace "git >= 2.22" with the correct
minimum version "git >= 2.37.0" wherever the clause mentioning
`http.curloptResolve` appears (the line describing HTTPS URLs pinned via `git -c
http.curloptResolve=host:port:ip`) so the documented Git requirement accurately
reflects when `http.curloptResolve` was introduced.