agent-ops
OPS-157
· child of OPS-156 Shared mutable state: agents contend over the same files with no isolation (sh.git checkout, CLAUDE.md, commons, pm/) Backlog
sh.git: one working tree per agent (worktree or clone), branch per change - decide and implement
Backlog high
bvbin-venus-cc
SOLUTION 1 of 2 for OPS-156. Elazar directive: bin-venus-cc, bin-whey-cc and bin-lezama-cc decide together which solution to use, then implement it. PROBLEM: ~/.local/bin is ONE git working tree per host, written concurrently by every bin-* and nw-* agent on that host. git tracks branches, not editors: two agents editing different files in one tree still stage each other s work, because `git add <path>` stages that file s whole on-disk content and `git add -A` stages everything. Every mitigation in gitpush.sh (--only, the hunk gate, the push-scope guard, the stray-changes disclosure) is a workaround for the absence of isolation, not a fix. STANDARD FIX: one working tree per agent. Either `git worktree add` per agent off a shared object store, or a full clone per agent. Branch per change, merge to main. Then a lane s uncommitted work is invisible to every other lane and the entire --only/hunk-gate apparatus becomes unnecessary rather than load-bearing. DECISION NEEDED (the three bin agents own this): - worktree vs clone. Worktree shares .git objects (cheap, one fetch) but a worktree cannot check out a branch another worktree holds; clone is fully independent but N copies and N remotes. - What ~/.local/bin becomes. It must stay the PATH directory, so it cannot also be an agent s editing tree - this couples to the deployment child. - Branch naming and merge policy, and what happens to the existing gitpush.sh guards: retire, keep as belt-and-braces, or keep only the push-scope guard. - Migration order across the three hosts, and what to do about in-flight uncommitted work at cutover. CONSTRAINT: sh.git is a STRICT repo and the fleet depends on it being on PATH continuously. No cutover step may leave a host without a working ~/.local/bin. Record the decision on this item before implementing.
Activity
-
parent=#3095
-
CONVERGED, bin-venus-cc + bin-whey-cc, 2026-08-31 round 1-3. Pending bin-lezama-cc ack only. 157(a) DECIDED: git worktree off ONE shared object store per host. NOT clone-per-agent. Two reasons: whey .git is 104M so clone-per-agent is 104M x N per host for zero isolation gained; and the property that reads as a worktree limitation is the actual point - no two worktrees may hold the same branch, which is a hard refusal of the exact collision we are ending. A clone lets two agents check out main and diverge silently. (bin-whey-cc, measured.) 157(c) DECIDED: keep the push-scope guard (it concerns published history, not the tree). Retire the hunk gate (it exists only because the tree is shared; never fired in 9 days). Retire the three-way "pull when convenient" DM ritual - it is shared-tree tax and the noisiest of the three. STILL OPEN on this item: branch naming + merge policy; migration order across hosts; disposition of in-flight uncommitted work at cutover.
-
FULLY CONVERGED 2026-08-31: bin-venus-cc + bin-whey-cc + bin-lezama-cc. bin-lezama-cc ack on 157(a) and 157(c) received; no dispute from any of the three. 157 decisions stand as recorded above and are now ratified, not pending. STILL OPEN and unchanged: branch naming + merge policy; migration order; disposition of in-flight uncommitted work at cutover.
-
THE TWO RATIFIED DECISIONS ARE MUTUALLY UNSATISFIABLE AS WRITTEN, and that is the finding that settles all three open items. Proved against the live repo 2026-10-06, not argued. MEASUREMENT: ~/.local/bin is the MAIN worktree and it holds the branch main (git worktree list: one entry, /home/rob/.local/bin 16d774d [main]). Created a real worktree off it on a new branch and tried to check out main there: 'fatal: main is already used by worktree at /home/rob/.local/bin'. So 157(a)'s chosen property - no two worktrees may hold the same branch - means NO AGENT WORKTREE CAN EVER HOLD main, and therefore a local merge to main can only happen in the deployed PATH directory, which OPS-158 ratified as read-only to agents. One of the two has to give, and the answer is that main must stop living in the PATH directory. PROPOSED, all three open items, for bin-whey-cc convergence: (1) BRANCH NAMING: <agent>/<bwi-ref>-<slug>, e.g. bin-venus-cc/OPS-157-worktree. The agent prefix makes two agents structurally unable to contend for one branch name, which matters MORE under worktrees than under the shared tree: a name collision is now a hard refusal to create the worktree, not a merge conflict. The bwi ref makes an orphan branch traceable to a row months later. (2) MERGE POLICY: NO LOCAL MERGE, EVER. An agent commits on its own branch in its own worktree and fast-forwards origin/main from it (git push origin HEAD:main). Dry-run from a worktree one commit ahead produced a real fast-forward (16d774d..8e8e779 HEAD -> main), so the route is viable rather than assumed - the first attempt reported 'Everything up-to-date' because the probe branch had no commit, which proved nothing, and is why it was redone with real divergence. ROUTE EXPLICITLY REJECTED, and NOT on the grounds you would expect: pushing to the LOCAL main that the PATH dir has checked out (git push . HEAD:main) was NOT refused by the dry-run - it also reported 16d774d..8e8e779. receive.denyCurrentBranch is unset here, so git's default 'refuse' is what would apply on a real push, BUT THE DRY RUN DID NOT EXERCISE IT, so that refusal is UNVERIFIED and must not be the thing the design leans on. Reject it on its own merits instead: it advances the ref while leaving the deployed working files at the old commit, so ~/.local/bin would report every changed file as modified against its own HEAD. A silent desync of the whole fleet's PATH directory is worse than a merge conflict. (3) MIGRATION ORDER: whey FIRST, venus LAST, lezama not at all yet. Whey has two responsive seats and its residency exposure is already inventoried (OPS-280, closed). Venus goes last because it is the worst blast radius: it runs the hub, it holds the scrp senders, and it is the only host with a live -ca seat sharing the identical cwd (bin-venus-ca, roster-confirmed cwd /home/rob/.local/bin), so two sessions would be migrated under each other. Lezama cannot be scheduled until it has a registered agent seat (OPS-281, blocked). (4) IN-FLIGHT UNCOMMITTED WORK: a non-empty tree BLOCKS the cutover; it is not stashed. Stashing into a tree that is about to stop being a tree is how work disappears. Gate is 'git status --porcelain' empty, re-verified in the minute before the flip, not inherited from an earlier check. Venus measured 0 porcelain at every check this session, so on this host the question is currently moot - but that is a snapshot, and each host must gate on its own. NOT RATIFIABLE TODAY: this row says the three bin agents decide together and no lezama seat exists on the hub. Recording as a proposal with bin-whey-cc convergence sought; the lezama ack that completed the 2026-08-31 round cannot be obtained now. NOTE ON METHOD: the worktree probe created and removed a real worktree and a real branch in the live repo. Verified after cleanup - one worktree, porcelain 0, HEAD still 16d774d, probe branch deleted, nothing published. The only writes were unreachable objects.
-
CONVERGED 2026-10-06: bin-venus-cc + bin-whey-cc. All three previously-open items are now decided, plus one that was not on the list and had to be. RATIFIED THIS ROUND: (1) BRANCH NAMING: <agent>/<bwi-ref>-<slug>. (2) MERGE POLICY: no local merge, ever. Agent commits on its own branch in its own worktree and fast-forwards origin/main with 'git push origin HEAD:main'. (3) MAIN LEAVES THE PATH DIRECTORY. This was not one of the three open items - it is forced, and it is the substance of this round. (4) MIGRATION ORDER: whey first, venus last, lezama unschedulable. No dispute. (5) IN-FLIGHT WORK: a non-empty tree BLOCKS the cutover and is not stashed. No dispute. WHY (3) IS FORCED, and bin-whey-cc REPRODUCED IT INDEPENDENTLY RATHER THAN TAKING MY WORD: ~/.local/bin is the main worktree and holds main, so an agent worktree refuses with 'fatal: main is already used by worktree at /home/rob/.local/bin'. 157(a)'s chosen property therefore puts the only possible local merge point inside the deployed directory that OPS-158 ratified as read-only to agents. bin-whey-cc checked whey: one worktree holding main, same conflict, same proof. So this is a property of the model, not of venus's layout, and any future design keeping main in the PATH dir must name which of the two ratified decisions it is dropping. THE REJECTED ROUTE AND WHY THE REJECTION IS NOT WHERE IT LOOKS: 'git push . HEAD:main' - updating the local main the PATH dir has checked out - WAS NOT REFUSED BY THE DRY RUN on either host. receive.denyCurrentBranch is unset on venus AND whey (bin-whey-cc confirmed independently), so git's default 'refuse' is what would apply on a real push, but a dry run does not exercise it. That refusal is UNVERIFIED and the design does not lean on it. Rejected on its own merits: it advances the ref while leaving the deployed working files at the old commit, so ~/.local/bin reports every changed file as modified against its own HEAD. A silent desync of the fleet's PATH directory is worse than a merge conflict. METHOD CORRECTION WORTH KEEPING ON THE ROW: my first dry-run of both merge routes reported 'Everything up-to-date' because the probe branch carried no commit. That proved nothing and I nearly recorded it as viability. Redone from a branch genuinely one commit ahead, the real route printed 16d774d..8e8e779. A push route is only tested from a branch that is actually ahead. STILL NOT RATIFIABLE BY THE ROW'S OWN TERMS: this item says the three bin agents decide together, and no lezama agent seat exists on the hub (bin-lezama-cc and bin-lezama-ca both recipient_not_registered, forward recorded broken, 78-entry roster holds only two lezama-named registrations and both are scrp senders). Two of three converged with no dispute. The lezama ack that completed the 2026-08-31 round cannot be obtained today, and OPS-281 is blocked on the same gap. ROW STAYS OPEN: decisions are converged, IMPLEMENTATION IS OWED, and implementation is sequenced behind OPS-158's deploy design because (3) only lands when the PATH directory stops being the main worktree. Nothing in this round touched a file.
decision
6w ago by wi-cli-venus
6w ago