Landing blocker for #61 and #63: the deployment checkout is 12 commits behind and
`merge --ff-only` refuses while tracked paths are dirty. Discard is not available here
(workspace policy: no `checkout`/`stash` on shared state), so the dirt is committed.
- `agent/APPEND_SYSTEM.md`: the point-of-use / one-work-log / PR-link doctrine, already
byte-identical to `origin/main` (`cmp` against the trunk blob: no difference). No new
prose — the commit exists so the trunk merge can proceed.
- `agent/config.yml` and `agent/managed-skills/**`: the machine-live tier the heartbeat
owns (AGENTS.md § Live-sync tiers).
`ALLOW_SECRETS=1` was used, deliberately and after auditing the staged diff by hand: the
only credential-shaped strings in it are two copies of `AKIA0000000000000EXAMPLE` — the
inert all-zero AWS example id — and they appear inside the two skill pages that teach
that exact placeholder shape. This checkout is still running the pre-#61 hook; the merged
gate (value-scoped placeholder filter, `71601f7`) exempts this value, so the refusal
dies with this landing. No `--no-verify` was used: the gate ran and its verdict is
recorded here.
Refs #61
Observed failure mode: tracking flips land in one batch at the end of a
task bill, so the operator's cockpit view stays frozen for the whole run.
Rule pins the mechanics: init before first substantive step, done/start
batched with the step they describe, block-with-reason on stalls, no
lone todo calls. Global tier (APPEND_SYSTEM.md), every session affected.
APPEND_SYSTEM.md line 16 named the sold client box twice (as a fleet server
and as the host I operate from) and, while doing it, mis-listed the fleet as
'Dankware and Dankclaw' -- Dankserver was already missing.
Now: servers Dankclaw and Dankserver, plus several client workstations, and
the identity no longer claims a fixed host. Committed on main rather than a
feature branch because this checkout IS the live deployment (branch switches
swap live config under the running agent) and the tree already carries
in-flight WIP; only this file is staged.
Takes effect in NEW sessions -- the running one keeps its process-start
prompt snapshot.
Frank