Configure Git identity inside container from host git config

docs/podbot-design.md

@@ -611,6 +611,48 @@ or whitespace-only, the operation fails with a semantic
 resolved layered configuration (`AppConfig.image`) at request-construction
 time, so this validation happens before any engine create call is attempted.
 
+## Git identity configuration
+
+After container creation and credential injection, podbot configures Git
+identity within the container so that commits made by agents carry the
+correct author information. This corresponds to Step 3 in the execution
+flow above.
+
+### Reading host identity
+
+The host Git identity is read by invoking `git config --get user.name` and
+`git config --get user.email` as subprocesses. This approach respects the
+full Git configuration precedence chain (system, global, local, worktree,
+command-line, includes, and conditional includes) without reimplementing
+Git's configuration resolution logic.
+
+The reading is abstracted behind a `GitIdentityReader` trait so that tests
+can inject deterministic values without depending on the host Git
+installation.
+
+### Applying identity to the container
+
+For each present field, podbot executes `git config --global user.<field>
+<value>` within the container using the existing `ContainerExecClient`
+trait seam. The commands run in detached mode with `tty = false`.
+
+### Graceful degradation
+
+Missing identity fields produce warnings rather than errors. The following
+cases are handled:
+
+- **Neither field configured**: a single warning is emitted and no exec
+  calls are made. Agent execution continues normally.
+- **One field missing**: the present field is applied; a warning is emitted
+  for the absent field.
+- **Container exec failure**: each field is applied independently. If one
+  exec fails, the other is still attempted. Failures are reported as
+  warnings rather than aborting orchestration.
+
+This design ensures that operators without Git configuration (such as CI
+environments where identity is managed externally) are not blocked from
+using podbot.
+
 ## Error handling
 
 Podbot defines semantic error enums in `src/error.rs` for configuration,

docs/podbot-roadmap.md

@@ -266,17 +266,17 @@ Operations continue working after token refresh without intervention.
 Wire together the complete execution flow from container creation through agent
 startup.
 
-### Step 4.1: Git identity configuration
+### Step 4.1: Git identity configuration ✅
 
 Configure Git identity within the container using host settings.
 
 **Tasks:**
 
-- [ ] Read user.name from host Git configuration.
-- [ ] Read user.email from host Git configuration.
-- [ ] Execute git config --global user.name within the container.
-- [ ] Execute git config --global user.email within the container.
-- [ ] Handle missing Git identity with a warning rather than failure.
+- [x] Read user.name from host Git configuration.
+- [x] Read user.email from host Git configuration.
+- [x] Execute git config --global user.name within the container.
+- [x] Execute git config --global user.email within the container.
+- [x] Handle missing Git identity with a warning rather than failure.
 
 **Completion criteria:** Git commits within the container use the configured
 identity. Missing identity produces a warning but does not block execution.

docs/users-guide.md

@@ -546,6 +546,38 @@ Verification notes:
 3. Compare permission bits for a representative file between host and
    container, for example, with `stat` on each side.
 
+### Git identity configuration
+
+After creating the container and injecting credentials, podbot configures
+Git identity inside the container by reading the host's `user.name` and
+`user.email` from Git configuration and executing `git config --global`
+within the container for each present field.
+
+**Behaviour:**
+
+- If both `user.name` and `user.email` are configured on the host, both
+  are applied to the container.
+- If only one field is configured, the present field is applied and a
+  warning is emitted for the missing field.
+- If neither field is configured, a warning is emitted and the container
+  uses its default Git identity. Agent execution continues normally.
+- If the `git config --global` command fails inside the container (for
+  example, because `git` is not installed), a warning is emitted. The
+  failure does not prevent agent execution from proceeding.
+
+This step requires no user configuration. Podbot reads the identity from
+the host's Git configuration automatically using `git config --get`.
+
+**Possible warning messages:**
+
+| Warning                                                | Cause                                      |
+| ------------------------------------------------------ | ------------------------------------------ |
+| "host Git user.name is not configured; skipping"       | No `user.name` in host Git configuration   |
+| "host Git user.email is not configured; skipping"      | No `user.email` in host Git configuration  |
+| "no Git identity configured on the host"               | Neither `user.name` nor `user.email` found |
+| "failed to create exec for git config user.name: ..." | Container exec failed for name field       |
+| "failed to create exec for git config user.email: ..." | Container exec failed for email field      |
+
 ## Security model
 
 Podbot's security model is based on capability-based containment: