Two-layer concurrent-push guard — EVO-26 descend, decision bs-mqoxiw8ptby (2026-06-22), Pluto HIGHEST urgency. Adopt mars's proven guard. LAYER 1 (content): drop pluto/.gitpush-strict so gitpush refuses 'git add -A'; every push MUST pass --only <paths>. LAYER 2 (sequence): wrap every spawned-worker push in 'flock -w 600 ~/.cache/evolutiva/pluto-push.lock gitpush.sh --only <paths> msg' — serializes the non-atomic bump-stage-commit-rebase-push pipeline (stops dup version-bumps + rebase-onto-half-state; git index.lock does NOT cover these). WHY Pluto highest: widest push lane (coder+coderhelp+db all bump the SAME package.json) + LIVE clinical app so a sequence collision = botched deploy. PER-ROLE --only LANES: coder=feature paths; db=its 4 ratified exception paths (db/migrations/applied/*, db/schema.md, db/reference-data.sqlite, package.json). gitpush v4.0 auto-includes the bumped package.json alongside --only, so versioning still works. CUTOVER GOTCHA: the moment pluto/.gitpush-strict lands, EVERY push without --only ABORTS (fail-safe) so the marker + ALL push call-sites (coder/coderhelp/db) must cut over in ONE coordinated step. gitpush.sh stays bin-owned/UNCHANGED (guard = repo-marker + per-repo lockfile, zero fleet blast radius). flock must be BAKED INTO the spawn/push path so an ephemeral worker CANNOT omit it — coordinate wiring with nw/bin (own spawn scripts; pluto spawn = tmux-ccs.sh per EVO-26). Execute in aro:pluto. mars = reference impl (bwi#298 + .gitpush-strict). mem:evolutiva-fleet-aro-topology mem:pluto-ondemand-worker-model mem:shared-tree-push-hazard

Sub-tickets

Questions

Activity

• wi-cli-venus created · 2026-06-22
• wi-cli-venus commented · 2026-06-22
  SPLIT per generalpm (2026-06-22, EVO-26 heads-up). LAYER 1 (.gitpush-strict + per-role --only lanes) proceeds independently — unaffected. LAYER 2 (true cannot-omit flock enforcement) HELD: env-routing alone does NOT meet the cannot-omit bar — a worker typing bare gitpush.sh bypasses a -env-default flock (venus found at b1a071f; env default != enforcement). True enforcement needs gitpush.sh to SELF-FLOCK on a GITPUSH_LOCK env var (option b), which touches fleet-shared/bin-owned gitpush.sh → generalpm escalated to Elazar for go/no-go. Pluto flagged as the LIVE driver for true enforcement. Pluto design note for option-b: the self-flock must serialize ALL push identities (coder + coderhelp + db's exception lane) since all three bump the same package.json — can't key only on a coder context. Do NOT design/build Layer-2 until Elazar's ruling lands.
• wi-cli-venus commented · 2026-06-22
  LANE-DEF GOTCHA (generalpm 2026-06-22, venus hit it): gitpush.sh --only is COMMA-separated, NOT space. Space-separated paths → 2nd path silently parsed as the commit message → that path dropped from the commit (venus self-corrected on a 2nd push, low harm but messy). Bake comma-separated --only into every per-role lane + the spawn push path. db's 4-path exception lane is the sharp edge — must be ONE comma-joined arg: 'gitpush.sh --only db/migrations/applied/*,db/schema.md,db/reference-data.sqlite,package.json "msg"'. coder/coderhelp feature lanes same comma rule.
• wi-cli-venus commented · 7w ago
  Live evidence (2026-06-26, push 1251327): gitpush v4.2 git add -A in non-strict repo swept 3 agents/*/settings.local.json into a coder feature commit despite --only intent. Benign churn, not reverted. Confirms the strict-lane/per-role --only guard is still absent.
• wi-cli-venus commented · 7w ago
  DISPATCHED 2026-06-26 (coder): Layer-1 .gitpush-strict marker — gitpush.sh confirmed to already enforce strict (refuses add -A, mandates --only, auto-includes bumped package.json for website repos). Mars MARS-49 recipe relayed (pm-mars-cc): same two layers. Triggered by today's real sweep (db migration-039 push 6d3a14c swept coder's PLUTO-211 WIP). db+coder both briefed --only becomes mandatory at cutover. Layer-2 flock pluto-push.lock convention to follow.
• wi-cli-venus commented · 7w ago
  SHIPPED f7b9c39/v1.89.6, audit PASS. Layer-1 .gitpush-strict marker live at repo root — bare gitpush now ABORTS (verified), all Pluto pushes (coder+db) must pass --only. Structurally kills the shared-tree add -A sweep that hit 6d3a14c. Layer-2 flock pluto-push.lock convention remains as a follow-on (lower urgency now content-bleed is closed).
• wi-cli-venus completed · 7w ago
  completed