fix(identity): Order C-followup — refuse main worktree (charter §4 v2) #14

Closed

pdurlej wants to merge 0 commits from claude/orders/order-c-followup-worktree-isolation into main

pdurlej commented

2026-05-02 00:58:16 +02:00

Owner

Critical fix — Order C regression

Order C (PR #12) applied codex identity config to the main worktree instead of a linked worktree. Result: every commit in /Users/pd/Developer/iskra-platform-2026-04-30/ (by operator, claude, glm-strive, anyone) was authored as codex. Opposite of charter §4 intent.

Detected post-merge when this orchestrator (claude) hit askpass-codex.sh failure on its own commits. Diagnosed by operator ("nie kończymy dziś jeszcze zabawy. wiesz dlaczego?" — operator caught what I missed).

What this PR does

WorktreeIsolationViolation exception in identity/codex.py
_is_main_worktree(path) helper (git-dir vs git-common-dir compare)
setup_worktree_git_config() refuses main worktree with actionable error
Tests updated — _linked_repo() helper, 2 new tests for isolation enforcement
Charter §4 v2 sub-rule — explicit "linked worktree only" requirement + setup pattern

Out-of-PR cleanup (already done on operator's local)

Main worktree codex config reset to defaults (git config --worktree --unset for 6 keys). Backup at /tmp/main-worktree-config-backup-2026-05-02.txt. Verified post-reset: git config --get user.name returns Piotr Durlej (operator's global), origin URL back to default.

Tests: 140/140 passed (138 base + 2 new)

test_setup_worktree_refuses_main_worktree PASSED
test_is_main_worktree_distinguishes_main_from_linked PASSED

For future Codex sessions

git worktree add ../platform-wt-codex codex/identity-wiring/<branch>
platformctl identity codex setup-worktree ../platform-wt-codex
# work in ../platform-wt-codex; main worktree stays neutral

Charter §4 v2 sub-rule (added)

Per-actor identity isolation requires LINKED worktree, not main worktree. setup_worktree_git_config() MUST refuse the main worktree.

Test plan

140 unit tests green
Manual: git config --get user.name post-reset returns operator default ✓
Operator skim-review charter §4 v2 wording
After merge: future Codex session uses linked-worktree pattern (next A1 hand-off)

Linkage

Fixes regression introduced by PR #12 (Order C)
Out of scope: Order F-2 (BW item rename, charter §5 explicit naming, §6 cognition + handoff signaling) — separate PR after this lands

Self-criticism note

Detected only after operator pointed me to it. Should have caught this immediately post-PR #12 merge during identity-doctor review. Charter §3 escalation discipline should fire on "main worktree config is non-default" — adding to identity-doctor as separate concern.

🤖 claude orchestrator session, 2026-05-02

label suggestion: ready-for-operator

## Critical fix — Order C regression Order C (PR #12) applied codex identity config to the **main worktree** instead of a linked worktree. Result: every commit in `/Users/pd/Developer/iskra-platform-2026-04-30/` (by operator, claude, glm-strive, anyone) was authored as `codex`. **Opposite of charter §4 intent.** Detected post-merge when this orchestrator (claude) hit `askpass-codex.sh` failure on its own commits. Diagnosed by operator ("nie kończymy dziś jeszcze zabawy. wiesz dlaczego?" — operator caught what I missed). ## What this PR does 1. **`WorktreeIsolationViolation`** exception in `identity/codex.py` 2. **`_is_main_worktree(path)`** helper (git-dir vs git-common-dir compare) 3. **`setup_worktree_git_config()` refuses main worktree** with actionable error 4. **Tests updated** — `_linked_repo()` helper, 2 new tests for isolation enforcement 5. **Charter §4 v2 sub-rule** — explicit "linked worktree only" requirement + setup pattern ## Out-of-PR cleanup (already done on operator's local) Main worktree codex config reset to defaults (`git config --worktree --unset` for 6 keys). Backup at `/tmp/main-worktree-config-backup-2026-05-02.txt`. Verified post-reset: `git config --get user.name` returns `Piotr Durlej` (operator's global), origin URL back to default. ## Tests: 140/140 passed (138 base + 2 new) ``` test_setup_worktree_refuses_main_worktree PASSED test_is_main_worktree_distinguishes_main_from_linked PASSED ``` ## For future Codex sessions ```bash git worktree add ../platform-wt-codex codex/identity-wiring/<branch> platformctl identity codex setup-worktree ../platform-wt-codex # work in ../platform-wt-codex; main worktree stays neutral ``` ## Charter §4 v2 sub-rule (added) > Per-actor identity isolation requires LINKED worktree, not main worktree. `setup_worktree_git_config()` MUST refuse the main worktree. ## Test plan - [x] 140 unit tests green - [x] Manual: `git config --get user.name` post-reset returns operator default ✓ - [ ] Operator skim-review charter §4 v2 wording - [ ] After merge: future Codex session uses linked-worktree pattern (next A1 hand-off) ## Linkage - Fixes regression introduced by PR #12 (Order C) - Out of scope: Order F-2 (BW item rename, charter §5 explicit naming, §6 cognition + handoff signaling) — separate PR after this lands ## Self-criticism note Detected only after operator pointed me to it. Should have caught this immediately post-PR #12 merge during identity-doctor review. Charter §3 escalation discipline should fire on "main worktree config is non-default" — adding to identity-doctor as separate concern. 🤖 claude orchestrator session, 2026-05-02 label suggestion: `ready-for-operator`

pdurlej added 1 commit

2026-05-02 00:58:16 +02:00

fix(identity): refuse main worktree in setup_worktree_git_config (charter §4 v2) 35536dfb70

## Why

Order C as merged in PR #12 applied codex identity config (user.name=codex,
remote.origin.url=https://codex@..., core.askPass=askpass-codex.sh,
credential.helper=) to the MAIN worktree at /Users/pd/Developer/iskra-platform-2026-04-30/.

Consequence: any subsequent commit in that working directory — by operator,
claude, glm-strive, or any other actor — was authored as `codex`. This is the
opposite of charter §4 intent: per-actor identity isolation got inverted into
identity collision.

Detected post-merge when claude (this orchestrator session) tried to commit
PR #13 follow-ups and discovered git push invoked `askpass-codex.sh` (which
fails for non-codex actors). Workaround was push-with-explicit-URL; that's
not a fix, that's a treadmill.

## What this PR does

1. **`WorktreeIsolationViolation` exception** in `identity/codex.py`
2. **`_is_main_worktree(path)`** helper — compares `git rev-parse --git-dir`
   vs `--git-common-dir`; main worktree has them equal, linked worktree
   has them diverge (.git/worktrees/<name>/ vs .git/)
3. **`setup_worktree_git_config()` refuses main worktree** with actionable
   error message: "Run: git worktree add ../platform-wt-codex
   codex/identity-wiring/<branch> and pass the linked path"
4. **Tests updated**: existing setup tests use new `_linked_repo()` helper
   (creates main + initial commit + linked worktree, returns linked path).
   Added `test_setup_worktree_refuses_main_worktree` and
   `test_is_main_worktree_distinguishes_main_from_linked`
5. **Charter §4 v2 sub-rule** added — "Per-actor identity isolation requires
   LINKED worktree, not main worktree" with setup pattern + detection mechanism

## What was done outside this PR (operator's local main worktree)

Reset main worktree codex config back to defaults (operator-local, not
trackable in repo):

```
for key in user.name user.email core.askPass credential.helper \
           remote.origin.url extensions.worktreeConfig; do
  git config --worktree --unset "$key" 2>/dev/null || true
done
```

Backup of pre-reset state at /tmp/main-worktree-config-backup-2026-05-02.txt
Operator's main worktree now back to global identity (Piotr Durlej / p@durlej.me).

## For future Codex sessions

```bash
# Operator (one-time per Codex delegation):
git worktree add ../platform-wt-codex codex/identity-wiring/<branch>
cd ../platform-wt-codex
platformctl identity codex setup-worktree .
# Codex works from here; main worktree stays neutral
```

Same pattern applies to future per-actor identities (claude askpass,
glm-strive askpass) when those land.

## Tests: 140/140 passed (was 138, +2 new)

- `test_setup_worktree_refuses_main_worktree` — verifies exception text
  mentions "main worktree", "git worktree add", "charter §4"
- `test_is_main_worktree_distinguishes_main_from_linked` — verifies
  detection helper

## Linkage

- Order C (PR #12) introduced the regression
- This PR is Order C-followup — minimal scope, only worktree isolation
- Order F-2 (BW item rename + charter §5/§6 sub-rules) deferred to next PR

🤖 Generated by claude (orchestrator session, 2026-05-02) — Order C-followup.
Review carefully — operator's local main worktree was modified outside the PR.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

claude closed this pull request

2026-05-02 00:58:57 +02:00

claude commented

2026-05-02 00:58:57 +02:00

Collaborator

Closing — wrong author (pdurlej via MCP admin token). Reopening as claude via REST API. Same content, different identity. Charter §4 enforcement: tool-originated writes ALWAYS use service identity, including PR creation.

claude referenced this pull request

2026-05-02 00:58:57 +02:00

fix(identity): Order C-followup — refuse main worktree (charter §4 v2) #15