The implementer agent no longer pushes to git — the controller worker
now owns the push: it gates the agent's commits on lint+typecheck and
pushes via a single leased primitive. Closes two production defects:
- Clobber: the pre-fix MCP --force-with-lease leased against a
freshly-fetched tip, so the lease always passed — an in-flight
implementer destroyed a commit pushed to the PR branch during its
run (lost a hand-pushed skip_coverage fix on PR #46).
- Gate-skip: the agent verified only the CI-flagged gate, so a fix for
one gate shipped fresh violations in another (lint flapped
pass->fail across CI runs 198->199).
Step 1 — worker_push primitive:
- New git_push.py: one leased push, pinned to the SHA the worker
started from; classifies pushed / stale_input / diverged /
infra_error; bounded infra-retry.
- mcp_git_server.push gains expected_sha for a correctly-pinned lease.
- finalize_conflict_resolution migrated onto worker_push.
Step 2 — deterministic gate:
- New gate.py: per-slot nox env-dirs (no venv races), manifest-hash
staleness keying, lazy warm-up.
- local_ci_gate.sh gains --envdir.
Step 3 — worker-owned gated push:
- New implementer_finalize.py: divergence pre-check -> lint+typecheck
gate -> ruff auto-fix -> leased push. finalize's outcome is
authoritative over the agent's emitted outcome.
- agent_runner integrates finalize; salvage no longer pushes.
- outcomes/tick: gate-failed + push-time stale-input caps,
epoch-scoped; WorkerError carries an output_payload so the gate
report reaches the next attempt's prompt; prefetch surfaces
gate-failed attempts.
- The 5 task-implementor prompts drop the agent push step.
Reviewed across 4 adversarial rounds; full controller+MCP suite green
(1379 passed).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
drew
a103a31bbf