0 Fork 0

Files

T

Frank 8af40c402b chore(agent): commit the machine tier and the doctrine text the checkout was already running

Landing blocker for #61 and #63: the deployment checkout is 12 commits behind and
`merge --ff-only` refuses while tracked paths are dirty. Discard is not available here
(workspace policy: no `checkout`/`stash` on shared state), so the dirt is committed.

- `agent/APPEND_SYSTEM.md`: the point-of-use / one-work-log / PR-link doctrine, already
  byte-identical to `origin/main` (`cmp` against the trunk blob: no difference). No new
  prose — the commit exists so the trunk merge can proceed.
- `agent/config.yml` and `agent/managed-skills/**`: the machine-live tier the heartbeat
  owns (AGENTS.md § Live-sync tiers).

`ALLOW_SECRETS=1` was used, deliberately and after auditing the staged diff by hand: the
only credential-shaped strings in it are two copies of `AKIA0000000000000EXAMPLE` — the
inert all-zero AWS example id — and they appear inside the two skill pages that teach
that exact placeholder shape. This checkout is still running the pre-#61 hook; the merged
gate (value-scoped placeholder filter, `71601f7`) exempts this value, so the refusal
dies with this landing. No `--no-verify` was used: the gate ran and its verdict is
recorded here.

Refs #61

2026-10-21 01:44:51 -07:00

4.3 KiB

Raw Permalink Blame History

name, description

name	description
land-merged-pr-with-blocked-tree-ops	Use when a merged PR must land in a checkout whose working tree is dirty and workspace policy blocks checkout/stash — prove the delta content-free, hand the operator the two-liner, verify via live config meanwhile.

Landing a merged PR when the deployment checkout is dirty and workspace policy blocks git checkout/git stash. Use when git merge --ff-only origin/main aborts with "Please commit your changes or stash them before you merge" in a SHARED workspace where other agents have work in flight. Earned 2026-10-20 on dank/command-center (the checkout IS the deployment).

Land a merged PR with blocked tree ops

Why it blocks

--ff-only refuses when any incoming path is dirty in the worktree — it checks dirtiness against the old HEAD, not whether your content matches the target. Proven: overwriting the file so it is byte-identical to the target commit (cmp clean against git show origin/main:<path>) still aborts with the same message. So "make the file match main" is not a way in, and neither is git merge from another worktree (the branch is checked out in the dirty one).

The blocking set is what you must know, exactly:

comm -12 <(git diff --name-only HEAD..origin/main | LC_ALL=C sort -u) \
         <(git status --porcelain | awk '{print $NF}' | LC_ALL=C sort -u)

LC_ALL=C sort matters — git's own output order trips comm: file N is not in sorted order and you get garbage overlap lists. In the case this was earned on, 12 incoming paths and 57 dirty ones intersected in exactly one file.

Procedure

Fetch, don't merge yet. List incoming commits (git log --oneline HEAD..origin/main) so you can show what is waiting.
Compute the blocking set with the comm above (both inputs LC_ALL=C sort -u).
Prove the local delta is content-free, in the direction that matters — lines the working tree has that main does not:
```
diff <(git show origin/main:<path>) <path> | grep -c '^>'   # local-unique lines
```
Zero means the working tree is a strict subset of what was merged: discarding loses nothing.
Preserve before you touch: copy the current file to ~/.AGENTTRASH/ (snapshot), and copy anything you had moved into a gitignored .AGENTTRASH/ inside a build worktree to its permanent home in the deployment — otherwise pruning the worktree destroys the only copy of a quarantined page.
Do NOT work around the policy. git checkout -- <path>, git stash, and git stash push -- <path> are all blocked in a shared workspace and the block is correct: it protects other agents' in-flight work. Do not reach for git reset --soft + git restore --staged to slide the pointer past it either — that leaves the index holding staged reverts of every incoming path, one careless git commit -a away from undoing the merge.
Hand the operator the two-liner and keep working on what does not depend on it:
```
git -C ~/.omp checkout -- <path> && git -C ~/.omp merge --ff-only origin/main
```
Say why it is safe (step 3's number, plus where the snapshots live) and what it unblocks.

Why waiting is not free

scripts/live-sync.sh merges with a plain git merge --no-edit origin/main (its line ~88), so the hourly heartbeat hits the identical wall and raises its ntfy alert merge conflict with origin/main — local commit kept; needs you at the keyboard. Report that consequence: the dirt is not merely untidy, it alerts.

Also note for later: git branch -d <merged-branch> refuses until the commits reach main — -d checks against the current HEAD, not origin/main — so local branch deletion goes on the post-landing list, not the pruning list.

What you CAN do while it waits

Verify the merged behaviour through the live config, not the branch pointer. Merged prompt/config changes take effect from the deployment's files: spawn a fresh session/subagent and have it read and quote the changed file back. That proves the change is live even while main is behind.
Prune your own build worktrees, but check nothing is running inside them first: ls -l /proc/*/cwd 2>/dev/null | grep -c "wt/<name>" (the same guard live-sync.sh uses).
Delete the merged remote branches (git push origin --delete <branch>, allowed on the local Gitea).

4.3 KiB Raw Permalink Blame History