From e4a9b02b0083c4818564d6f335ed26de831ae5aa Mon Sep 17 00:00:00 2001 From: Keith Jackson Date: Mon, 5 Oct 2026 23:00:50 -0500 Subject: [PATCH] =?UTF-8?q?docs(pm-agent):=20CLAUDE.md=20=C2=A70=20is=20al?= =?UTF-8?q?ready=20satisfied=20in=20a=20worker=20=E2=80=94=20tell=20it=20n?= =?UTF-8?q?ot=20to=20make=20a=20worktree?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit PR #56 added §0 (work in your own worktree, never the shared checkout) while this branch was open. A worker agent reads CLAUDE.md first, and §0's instruction is to create a git worktree outside the shared checkout — which does not exist in a worker's container. It holds a fresh clone of its own, made for one assignment and thrown away with the pod, which is what §0 is actually asking for. A worker that obeyed §0 literally would 'git worktree add', edit somewhere the wrapper that started it does not look, and have its work committed by nobody while the issue got a 'changed nothing' report. worker-rules.md now says §0 is satisfied and not to do that. Also records in the handoff entry: the merge and its one conflict, and that this push dismisses the operator's approving review — measured, dismiss_stale_approvals=true — so the approval-policy stage needs them to re-approve. That is theirs to do, not an agent's. Co-Authored-By: Claude Opus 5 (1M context) --- decisions/2026-10-05-pm-agent-issue-to-pr.md | 32 ++++++++++++++++++++ infra/agent/worker-rules.md | 7 +++++ 2 files changed, 39 insertions(+) diff --git a/decisions/2026-10-05-pm-agent-issue-to-pr.md b/decisions/2026-10-05-pm-agent-issue-to-pr.md index 9146991..07af5fd 100644 --- a/decisions/2026-10-05-pm-agent-issue-to-pr.md +++ b/decisions/2026-10-05-pm-agent-issue-to-pr.md @@ -167,6 +167,38 @@ All offline, in the pinned toolbox (`./infra/devcontainer/dev.sh run`), never on >= 2.1.259, which is why the image asserts a version floor. The pin `2.1.285` is the npm registry's `stable` dist-tag, measured on 2026-10-05. +## Merged `main` in, after PR #55 and #56 landed + +One conflict, in `clusters/base/kustomization.yaml`: PR #55 (vpn-ingress) and this branch +both appended a resource line to the same tail. Resolved by keeping both, main's first — +`vpn-ingress` is a platform-config-tier leaf and `pm-agent` dependsOn `apps-wave-0`, which +is later. Nothing else conflicted; `runbooks/kustomization.yaml` auto-merged with both +entries, and the handoff entries are separate files with nothing to merge, which is exactly +what `decisions/` being a directory buys. + +**PR #56 added `CLAUDE.md` §0 — work in your own worktree, never the shared checkout — +while this branch was open, and it named this run's uncommitted directories as its +measured example.** Two consequences were handled rather than noted: + +- This merge, and everything after it, was done in a worktree outside the repository root + (`/var/home/keith/source/wt-pm-agent`), per §0. +- **§0 would have misled a worker agent, so `infra/agent/worker-rules.md` now says so + explicitly.** A worker reads `CLAUDE.md` first, and §0's instruction is to create a + worktree outside the shared checkout. There is no shared checkout in a worker's container + — it holds a fresh clone of its own, which is what §0 is actually asking for — and a + worker that obeyed §0 literally would `git worktree add`, edit somewhere the wrapper does + not look, and have its work committed by nobody while the issue got a "changed nothing" + report. The rules file now tells it §0 is already satisfied and not to make a worktree. + +**The operator's approving review on PR #57 is dismissed by this push.** Measured on the +live branch protection: `dismiss_stale_approvals = true`, `ignore_stale_approvals = false`. +A conflict cannot be resolved without a new head, so this is unavoidable rather than a +choice — but it means `ci/approval-policy.sh` goes red again (`required_approvals` is 0, so +Gitea itself does not block; the gate stage is what demands the non-author review) and the +operator has to re-approve, or post `/approve-override ` as a PR **review**. That is +theirs to do; an agent posting it on its own PR is the self-approval the stage exists to +prevent. + ## What I did NOT verify **Nothing in this change has run.** That is the headline, and everything below is a diff --git a/infra/agent/worker-rules.md b/infra/agent/worker-rules.md index 90c2b99..b808bb3 100644 --- a/infra/agent/worker-rules.md +++ b/infra/agent/worker-rules.md @@ -15,6 +15,13 @@ facts about the container you are running inside. pinned toolchain is on `PATH` — you are *inside* the toolbox, so run `./ci/gate.sh` directly. Do **not** try to run `infra/devcontainer/dev.sh`; there is no container engine here and no need for one. +- **`CLAUDE.md` §0 is already satisfied. Do not make a worktree.** §0 tells agents to work in + a git worktree outside the shared checkout, because that checkout is the operator's working + copy and several runs fight over its HEAD. There is no shared checkout here: this container + holds a fresh clone of its own, made for this assignment and thrown away with the pod, which + is what §0 is asking for. `git worktree add` would put your edits somewhere the wrapper that + started you does not look — so your work would be committed by nobody and the issue would + get a "changed nothing" report. Work in the tree you are standing in. - You hold **no cluster credentials** — no kubeconfig, and no ServiceAccount token is mounted. `kubectl` is on `PATH` and will fail. That is deliberate: you cannot measure the live platform, so do not claim to have. Anything that needs a cluster is a line in "What