@agentshouse/kit 0.1.0-alpha.17 → 0.1.0-alpha.18

package/README.md

@@ -10,7 +10,7 @@ On Linux `amd64` or `arm64` with a working Docker Engine, run the published,
 versioned bootstrap once:
 
 ```sh
-bash <(curl -fsSL https://github.com/agentshouse/kit/releases/download/v0.1.0-alpha.17/connect-linux.sh)
+bash <(curl -fsSL https://github.com/agentshouse/kit/releases/download/v0.1.0-alpha.18/connect-linux.sh)
 ```
 
 The release asset pins one immutable multi-architecture image digest. It creates
@@ -105,6 +105,14 @@ Forwarding installs no host-native Kit and gives the container no Docker socket
 or further mount; it refuses when no Kit is installed or the installed one
 differs from this bootstrap's.
 
+The owner's working copy push is forwarded the same way: run
+`bash <(curl -fsSL …/connect-linux.sh) house git push [commit] --owner` from a
+directory beneath the workspace root, such as a Room copy under
+`working-copies/rooms/`. The bootstrap runs the container's `house` in the
+matching directory beneath `/agents/house`, through the resident's lease when
+the container runs, and refuses a directory outside the workspace before
+anything reaches House.
+
 ## Building the package
 
 The repository checkout is the development source. Build the package
@@ -829,7 +837,9 @@ nonzero exit status. The CLI holds
 no credential: it calls over its Session's bridge, which attaches the Session
 credential and refuses a caller without that Session's nonce as
 `kit_bridge_unauthorized`. House network calls use only the selected
-`2026-07-28` profile.
+`2026-07-28` profile. `house git push` is the one local verb House does not list;
+[working copies](#working-copies) describe it, and `house --help` and
+`house git push --help` explain it.
 
 Two verbs name files on the Session's own computer: `upload_attachment` takes
 one `path`, and `append_record` takes `attachments` as local paths. The CLI
@@ -1248,14 +1258,54 @@ current grant. Every other file is read-only House content: the generated
 grants anything, and House refuses a change to a read-only path however it is
 committed.
 
-Local edits, staging and commits change nothing in House. `refs/house/received`
-records the House content last received. The per-file manifest, with each
-file's House revision, digest and writability, and the commit it corresponds to
-stay in Kit home under `state/working-copies/`, outside the repository. A local
-commit is a local tree, never a House revision.
+Local edits, staging and commits change nothing in House until a commit is
+pushed. `refs/house/received` records the House content last received; each
+commit Kit wrote there, and each commit it acknowledged for a push, is a House
+state. The House revision of every file content Kit received, keyed by path and
+Git blob, stays in Kit home under `state/working-copies/`, outside the
+repository. A local commit is a local tree, never a House revision.
+
+`house git push [commit]`, run anywhere inside a copy or one of its linked
+worktrees, submits one commit, `HEAD` by default, resolved once. Kit compares
+that commit's tree with the newest House state in its history, so every linked
+worktree keeps its own base, and sends the difference as one ordinary House edit:
+a changed field, section or preamble against its own prior value, any other
+change as the whole file against its exact revision, a new file as a create and
+a committed deletion as a removal. Staged and unstaged work, and files absent
+only from the working tree, are never sent. Native `git push` reaches no House
+remote. Inside an Agent Session the push goes through that Session's bridge,
+under its own authority and provenance; outside one it needs
+`house git push [commit] --owner`, which the resident Kit carries out under its
+control lease when a resident runs, and which otherwise acquires and releases
+its own. A Session refuses `--owner`, and a missing bridge is never replaced by
+owner authority.
+
+House decides before any local Git step. A refusal changes nothing in House;
+after `edit_conflict` Kit records the current content House names for the
+refused paths in `refs/house/received`, reading by revision any content the
+refusal does not carry, so the agent merges or rebases onto it with native Git,
+commits, and pushes again. After acceptance Kit records House's result for the
+pushed paths, the contents an owner push receives or each accepted revision
+read by name, in a commit that covers the pushed one and in
+`refs/house/received`; a read-only path House regenerates, such as the Wiki
+index, stays out of Git. Kit then
+fast-forwards a clean branch still at the pushed commit, or rebases only its
+later commits. A result not yet readable, uncommitted tracked changes,
+a moved branch or a rebase conflict leave the branch as it was, with no stash or
+reset, and the push answers that House accepted it while local integration is
+pending; the next `house git push` finishes that integration without another
+House edit. A push whose answer was lost is recorded in Kit home before it is
+sent, and the next push by the same Session, or by the owner for an owner push,
+resends it under its original operation. Another caller cannot
+recover it: while the pushing Session lives it is refused as
+`kit_working_copy_push_pending`, and once that Session has ended Kit reads House
+again and drops it. When a retained push's operation has expired, Kit reads the
+Room again: if House holds the pushed content the push finishes as accepted,
+otherwise it is dropped and the next push submits it as a new operation.
 
 Deselecting a Room, or losing read access to it, marks its copy inactive:
-launches omit it and nothing local is deleted. Selecting it again reads the Room
+launches omit it, a new push is refused as `kit_working_copy_inactive`, and
+nothing local is deleted; a push already sent still settles and integrates. Selecting it again reads the Room
 again, advances `refs/house/received`, and replaces only the read-only content
 Kit wrote, never the branch, the index or a tracked file. A Room the owner may
 read without sync is refused as `operation_denied` and stays uncopied, while its

package/bin/connect-linux.sh

@@ -9,6 +9,7 @@ MANUAL=0
 WORKSPACE_SELECTED=0
 HOUSE_SELECTED=0
 FORWARDING=0
+FORWARDED=kit
 FORWARD=()
 
 refuse() {
@@ -41,8 +42,9 @@ start_resident() {
   docker run -d --name "$NAME" --restart unless-stopped --user "$(id -u):$(id -g)" --mount "$KIT_HOME_MOUNT" --mount "$WORKSPACE_MOUNT" --label "agentshouse.house=$HOUSE" --env HOME=/kit-home --env HOUSE_KIT_HOME=/kit-home --env HOUSE_KIT_CONTAINER=1 "$IMAGE" resident --house "$HOUSE" >/dev/null
 }
 
-if [[ "${1:-}" == kit ]]; then
+if [[ "${1:-}" == kit || "${1:-}" == house ]]; then
   FORWARDING=1
+  FORWARDED="$1"
   FORWARD=("${@:2}")
   set --
 fi
@@ -129,10 +131,18 @@ if docker container inspect "$NAME" >/dev/null 2>&1; then
   [[ "$(docker inspect --format '{{index .Config.Labels "agentshouse.house"}}' "$NAME")" == "$HOUSE" ]] || refuse 'the installed Kit uses another House origin'
   [[ -f "$KIT_HOME/credential" && -f "$KIT_HOME/environment" && -f "$KIT_HOME/house" ]] || refuse 'the installed Kit has no enrolled authority'
   if ((FORWARDING)); then
-    if [[ "${FORWARD[0]:-}" == login ]]; then
+    if [[ "$FORWARDED" == kit && "${FORWARD[0]:-}" == login ]]; then
       login_kit "${FORWARD[@]:1}"
       exit 0
     fi
+    PLACED=()
+    ENTRY=()
+    if [[ "$FORWARDED" == house ]]; then
+      HERE=$(pwd -P)
+      [[ "$HERE" == "$WORKSPACE" || "$HERE" == "$WORKSPACE"/* ]] || refuse "the current directory is outside the workspace $WORKSPACE"
+      PLACED=(--workdir "/agents/house${HERE#"$WORKSPACE"}")
+      ENTRY=(--entrypoint house)
+    fi
     TERMINAL=()
     if [[ -t 0 && -t 1 ]]; then TERMINAL=(-t); fi
     if [[ -t 0 && ! -t 1 ]]; then
@@ -141,9 +151,9 @@ if docker container inspect "$NAME" >/dev/null 2>&1; then
       stty -echo
     fi
     if [[ "$(docker inspect --format '{{.State.Running}}' "$NAME")" == true ]]; then
-      docker exec -i "${TERMINAL[@]}" "$NAME" kit "${FORWARD[@]}"
+      docker exec -i "${TERMINAL[@]}" "${PLACED[@]}" "$NAME" "$FORWARDED" "${FORWARD[@]}"
     else
-      "${DOCKER_RUN[@]:0:2}" -i "${TERMINAL[@]}" "${DOCKER_RUN[@]:2}" "${FORWARD[@]}"
+      "${DOCKER_RUN[@]:0:2}" -i "${TERMINAL[@]}" "${PLACED[@]}" "${ENTRY[@]}" "${DOCKER_RUN[@]:2}" "${FORWARD[@]}"
     fi
     exit
   fi

package/bootstrap.json

@@ -1,12 +1,12 @@
 {
   "schemaVersion": 1,
-  "version": "0.1.0-alpha.17",
+  "version": "0.1.0-alpha.18",
   "hosts": {
     "linux": {
-      "command": "bash <(curl -fsSL https://github.com/agentshouse/kit/releases/download/v0.1.0-alpha.17/connect-linux.sh)",
+      "command": "bash <(curl -fsSL https://github.com/agentshouse/kit/releases/download/v0.1.0-alpha.18/connect-linux.sh)",
       "asset": {
         "name": "connect-linux.sh",
-        "url": "https://github.com/agentshouse/kit/releases/download/v0.1.0-alpha.17/connect-linux.sh"
+        "url": "https://github.com/agentshouse/kit/releases/download/v0.1.0-alpha.18/connect-linux.sh"
       },
       "workspace": {
         "argument": "--workspace",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentshouse/kit",
-  "version": "0.1.0-alpha.17",
+  "version": "0.1.0-alpha.18",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -9,6 +9,7 @@
   "private": false,
   "type": "module",
   "bin": {
+    "house": "src/session-bin/house",
     "kit": "bin/kit.js"
   },
   "exports": {

package/src/bridge.js

@@ -18,7 +18,7 @@ import {
 import { operationId } from "./operation.js";
 import { houseFailed } from "./refusal.js";
 
-function bridgedFrame(request, operation) {
+export function bridgedFrame(request, operation) {
   if (typeof request.method !== "string") return request;
   const params = typeof request.params === "object" && request.params !== null ? request.params : {};
   const declared = typeof params._meta === "object" && params._meta !== null ? params._meta : {};

package/src/contract.js

@@ -292,17 +292,21 @@ export const KIT_DOOR_DISCOVER_PATH = "/kit/door/discover";
 export const KIT_DOOR_BOOTSTRAP_PATH = "/kit/door/bootstrap";
 export const KIT_DOOR_ENUMERATE_PATH = "/kit/door/enumerate";
 export const KIT_DOOR_BATCH_PATH = "/kit/door/batch";
+export const KIT_DOOR_REVISIONS_PATH = "/kit/door/revisions";
 export const EXPLICIT_SYNC_VERSION = "explicit-sync/2";
 export const KIT_DOOR_UNMOUNT_PATH = "/kit/door/unmount";
 
 export const KIT_WORKING_COPY_SELECTION_PATH = "/kit/working-copy/selection";
-export const WORKING_COPY_VERSION = "working-copy-state/1";
+export const WORKING_COPY_VERSION = "working-copy-state/2";
 export const WORKING_COPIES_HOME = "working-copies";
 export const WORKING_COPY_ROOM_HOMES = ["capture", "library", "collaboration"];
 export const WORKING_COPY_PRIVATE_HOMES = ["library", "collaboration", "rooms", "agents", "house"];
 export const WORKING_COPY_RECEIVED_REF = "refs/house/received";
 export const WORKING_COPY_BRANCH = "main";
 export const ROOM_REFERENCE = /^r_[0-9a-z]+\.[0-9a-z]$/;
+export const WORKING_COPY_PUSH_METHOD = "house/git/push";
+export const WORKING_COPY_PUSH_HELP =
+  "Submit a Room commit to House; default HEAD. Use --owner only outside an Agent Session. Native git push is not a House remote.";
 
 export const MIGRATOR_CONTRACT = "kit-migrator/1";
 export const MIGRATOR_CATEGORY = "migrator";

package/src/house-main.js

@@ -1,9 +1,19 @@
-import { resolve } from "node:path";
-import { BRIDGE_NONCE_ENVIRONMENT, BRIDGE_SOCKET_ENVIRONMENT } from "./contract.js";
-import { bridgeCall } from "./mcp.js";
-import { KitRefusal } from "./refusal.js";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+import {
+  BRIDGE_NONCE_ENVIRONMENT,
+  BRIDGE_SOCKET_ENVIRONMENT,
+  WORKING_COPY_PUSH_HELP,
+  WORKING_COPY_PUSH_METHOD,
+} from "./contract.js";
+import { storedHouse } from "./login.js";
+import { answerText, bridgeCall } from "./mcp.js";
+import { formatCommandError, KitRefusal } from "./refusal.js";
+import { ownerPush } from "./working-copy.js";
 
 const HELP = ["--help", "-h"];
+const OWNER = "--owner";
+const GIT_PUSH_USAGE = `usage: house git push [commit] [${OWNER}]`;
 const usage = (verb) => `usage: house ${verb} ['<arguments as one JSON object>' | - for standard input]`;
 
 async function answered(method, params) {
@@ -49,10 +59,59 @@ function located(verb, args) {
   return args;
 }
 
+function printed(result) {
+  const text = answerText(result);
+  return result?.isError === true ? { err: text, status: 1 } : { out: text };
+}
+
+async function ownerPushed(request) {
+  const directory = process.env.HOUSE_KIT_HOME ?? join(homedir(), ".house-kit");
+  const cancellation = new AbortController();
+  const cancel = () => cancellation.abort();
+  process.once("SIGINT", cancel);
+  process.once("SIGTERM", cancel);
+  try {
+    const pushed = await ownerPush(
+      { house: await storedHouse(directory), directory, signal: cancellation.signal },
+      request,
+    );
+    return pushed.refused ? { err: pushed.text, status: 1 } : { out: pushed.text };
+  } catch (refusal) {
+    return { err: formatCommandError(refusal), status: 1 };
+  } finally {
+    process.removeListener("SIGINT", cancel);
+    process.removeListener("SIGTERM", cancel);
+  }
+}
+
+async function gitPush([action, ...rest]) {
+  if (action !== "push") throw new KitRefusal("kit_house_arguments_invalid", GIT_PUSH_USAGE);
+  if (rest.some((argument) => HELP.includes(argument))) return { out: `${GIT_PUSH_USAGE}\n\n${WORKING_COPY_PUSH_HELP}` };
+  const owner = rest.includes(OWNER);
+  const named = rest.filter((argument) => argument !== OWNER);
+  if (named.length > 1 || named.some((argument) => argument.startsWith("-"))) {
+    throw new KitRefusal("kit_house_arguments_invalid", GIT_PUSH_USAGE);
+  }
+  const request = { cwd: process.cwd(), commit: named[0] ?? "HEAD" };
+  if (process.env[BRIDGE_SOCKET_ENVIRONMENT] === undefined) {
+    if (!owner) throw new KitRefusal("kit_bridge_unavailable");
+    return ownerPushed(request);
+  }
+  if (owner) throw new KitRefusal("kit_house_arguments_invalid", `${OWNER} is only for use outside an Agent Session`);
+  return printed(await answered(WORKING_COPY_PUSH_METHOD, request));
+}
+
 async function house([verb, argument, ...rest]) {
+  if (verb === "git") return gitPush([argument, ...rest].filter((part) => part !== undefined));
   if (verb === undefined || HELP.includes(verb)) {
     const tools = await listed();
-    return { out: [usage("<verb>"), ...tools.map((tool) => `${tool.name}\n${tool.description}`)].join("\n\n") };
+    return {
+      out: [
+        usage("<verb>"),
+        ...tools.map((tool) => `${tool.name}\n${tool.description}`),
+        `git push [commit]\n${WORKING_COPY_PUSH_HELP}`,
+      ].join("\n\n"),
+    };
   }
   if (HELP.includes(argument)) {
     const tool = (await listed()).find((one) => one.name === verb);
@@ -61,9 +120,7 @@ async function house([verb, argument, ...rest]) {
   }
   if (rest.length > 0) throw new KitRefusal("kit_house_arguments_invalid", usage(verb));
   const args = located(verb, await argumentsOf(verb, argument));
-  const result = await answered("tools/call", { name: verb, arguments: args });
-  const text = (result?.content ?? []).filter((item) => item.type === "text").map((item) => item.text).join("\n");
-  return result?.isError === true ? { err: text, status: 1 } : { out: text };
+  return printed(await answered("tools/call", { name: verb, arguments: args }));
 }
 
 house(process.argv.slice(2)).then(

package/src/house.js

@@ -172,7 +172,7 @@ async function residentRelay(session, request, signal, draining) {
   }
 }
 
-export async function serveResident(session, directory, signal, drain) {
+export async function serveResident(session, directory, signal, drain, push) {
   const socket = residentSocket(directory);
   await mkdir(dirname(socket), { recursive: true, mode: 0o700 });
   await rm(socket, { force: true });
@@ -229,12 +229,15 @@ export async function serveResident(session, directory, signal, drain) {
         }
         const cancelled = new AbortController();
         relayed.set(request.id, cancelled);
-        void residentRelay(session, request, AbortSignal.any([signal, cancelled.signal]), draining).then(
-          (answer) => {
-            relayed.delete(request.id);
-            if (!connection.destroyed) writeFrame(connection, { id: request.id, ...answer });
-          },
-        );
+        const relaySignal = AbortSignal.any([signal, cancelled.signal]);
+        const answered =
+          request.push === undefined
+            ? residentRelay(session, request, relaySignal, draining)
+            : push(request.push, relaySignal).then((pushed) => ({ pushed }));
+        void answered.then((answer) => {
+          relayed.delete(request.id);
+          if (!connection.destroyed) writeFrame(connection, { id: request.id, ...answer });
+        });
       },
       onRefusal: () => connection.destroy(),
     });
@@ -302,45 +305,54 @@ async function residentDelegation(directory, fetcher) {
   }
   connection.unref();
   let next = 0;
+  function exchange(frame, signal) {
+    signal?.throwIfAborted();
+    if (connection.destroyed) return Promise.resolve(unavailable());
+    return new Promise((resolve, reject) => {
+      const id = (next += 1);
+      const cancel = () => {
+        pending.delete(id);
+        settle(id);
+        if (!connection.destroyed) writeFrame(connection, { id, cancel: true });
+        reject(signal.reason);
+      };
+      signal?.addEventListener("abort", cancel, { once: true });
+      pending.set(id, (answer) => {
+        signal?.removeEventListener("abort", cancel);
+        resolve(answer);
+      });
+      connection.ref();
+      writeFrame(connection, { id, ...frame });
+    });
+  }
+  async function push(request, signal) {
+    const answer = await exchange({ push: request }, signal);
+    if (answer.pushed === undefined) throw new KitRefusal("kit_resident_unavailable");
+    return answer.pushed;
+  }
   async function delegated(url, init = {}) {
     const { authorization, ...headers } = init.headers ?? {};
     if (authorization !== RESIDENT) return fetcher(url, init);
-    init.signal?.throwIfAborted();
     const address = new URL(url);
-    const answer = connection.destroyed
-      ? unavailable()
-      : await new Promise((resolve, reject) => {
-          const id = (next += 1);
-          const cancel = () => {
-            pending.delete(id);
-            settle(id);
-            if (!connection.destroyed) writeFrame(connection, { id, cancel: true });
-            reject(init.signal.reason);
-          };
-          init.signal?.addEventListener("abort", cancel, { once: true });
-          pending.set(id, (answer) => {
-            init.signal?.removeEventListener("abort", cancel);
-            resolve(answer);
-          });
-          connection.ref();
-          writeFrame(connection, {
-            id,
-            method: init.method ?? "GET",
-            path: `${address.pathname}${address.search}`,
-            headers,
-            ...(typeof init.body === "string"
-              ? { text: init.body }
-              : init.body === undefined
-                ? {}
-                : { bytes: Buffer.from(init.body).toString("base64") }),
-          });
-        });
+    const answer = await exchange(
+      {
+        method: init.method ?? "GET",
+        path: `${address.pathname}${address.search}`,
+        headers,
+        ...(typeof init.body === "string"
+          ? { text: init.body }
+          : init.body === undefined
+            ? {}
+            : { bytes: Buffer.from(init.body).toString("base64") }),
+      },
+      init.signal,
+    );
     return new Response(answer.body === null ? null : Buffer.from(answer.body, "base64"), {
       status: answer.status,
       headers: answer.type === null ? {} : { "content-type": answer.type },
     });
   }
-  return { connection, fetch: delegated };
+  return { connection, fetch: delegated, push };
 }
 
 export async function openSession(options, dependencies = {}) {
@@ -359,6 +371,7 @@ export async function openSession(options, dependencies = {}) {
       : await residentDelegation(options.directory, dependencies.fetch ?? fetch);
   if (resident !== null) {
     session.resident = resident.connection;
+    session.push = resident.push;
     session.dependencies = { ...dependencies, fetch: resident.fetch };
     return session;
   }

package/src/local-files.js

@@ -1,6 +1,7 @@
 import { isAbsolute } from "node:path";
-import { parse, stringify } from "yaml";
+import { stringify } from "yaml";
 import { AGENT_OPERATION_META, ATTACHMENT_FILE_META } from "./contract.js";
+import { answerText, answerYaml } from "./mcp.js";
 import { derivedOperationId } from "./operation.js";
 import { localAttachment, sendLocalConversationFile, uploadLocalAttachment } from "./original.js";
 import { KitRefusal } from "./refusal.js";
@@ -12,18 +13,9 @@ class HouseRefused extends Error {
   }
 }
 
-function parsed(text) {
-  try {
-    return parse(text);
-  } catch {
-    return null;
-  }
-}
-
 function answerOf(frame) {
   if (frame.error !== undefined || frame.result?.isError === true) throw new HouseRefused(frame);
-  const text = (frame.result?.content ?? []).filter((item) => item.type === "text").map((item) => item.text).join("\n");
-  const answer = parsed(text);
+  const answer = answerYaml(answerText(frame.result));
   if (answer === null || typeof answer !== "object") throw new KitRefusal("kit_house_answer_unreadable");
   return answer;
 }

package/src/mcp.js

@@ -1,4 +1,5 @@
 import { randomUUID } from "node:crypto";
+import { parse } from "yaml";
 import { bridgePeer } from "./peer.js";
 import { KitRefusal } from "./refusal.js";
 
@@ -69,3 +70,15 @@ export async function bridgeCall(bridge, request, signal = undefined) {
     await peer.end();
   }
 }
+
+export function answerText(result) {
+  return (result?.content ?? []).filter((item) => item.type === "text").map((item) => item.text).join("\n");
+}
+
+export function answerYaml(text) {
+  try {
+    return parse(text);
+  } catch {
+    return null;
+  }
+}

package/src/sync-library.js

@@ -100,13 +100,12 @@ function recordedMap(authority) {
   return new Map(authority.files.map((file) => [file.path, file]));
 }
 
-function structuredOrReplace(root, relative, recorded, content) {
+export function structuredOrReplace(root, relative, recorded, content) {
   const path = housePath(root, relative);
+  const whole = [{ op: "replace", path, base: recorded.revision, content }];
   const before = parse(recorded.content, relative);
   const after = parse(content, relative);
-  if (!before.ok || !after.ok) {
-    return [{ op: "replace", path, base: recorded.revision, content }];
-  }
+  if (!before.ok || !after.ok) return whole;
   const ops = [];
   if (before.document.preamble !== after.document.preamble) {
     ops.push({
@@ -124,9 +123,7 @@ function structuredOrReplace(root, relative, recorded, content) {
     if (JSON.stringify(before.document.fields[name]) === JSON.stringify(after.document.fields[name])) {
       continue;
     }
-    if (after.document.fields[name] === undefined) {
-      return [{ op: "replace", path, base: recorded.revision, content }];
-    }
+    if (after.document.fields[name] === undefined) return whole;
     const change = { op: "set_field", path, field: name, value: after.document.fields[name] };
     if (before.document.fields[name] !== undefined) change.base = before.document.fields[name];
     ops.push(change);
@@ -139,12 +136,11 @@ function structuredOrReplace(root, relative, recorded, content) {
     const prior = before.document.sections[name];
     const next = after.document.sections[name];
     if (prior === next) continue;
-    if (prior === undefined || next === undefined) {
-      return [{ op: "replace", path, base: recorded.revision, content }];
-    }
+    if (prior === undefined || next === undefined) return whole;
     ops.push({ op: "replace_section", path, section: name, base: prior, content: next });
   }
-  return ops.length === 0 ? [{ op: "replace", path, base: recorded.revision, content }] : ops;
+  if (ops.length === 0) return whole;
+  return applyChanges({ [relative]: recorded.content }, ops, root)[relative] === content ? ops : whole;
 }
 
 export function deriveChanges(state, authority, localFiles) {

package/src/sync.js

@@ -41,7 +41,7 @@ function sessionDependencies(options, dependencies) {
   };
 }
 
-async function withSession(options, dependencies, operation) {
+export async function withSession(options, dependencies, operation) {
   const session = await openSession(options, sessionDependencies(options, dependencies));
   return maintainControl(session, (signal) => operation(session, signal), options.signal);
 }

package/src/worker.js

@@ -10,15 +10,16 @@ import {
 } from "./agents.js";
 import { readBindings, removeBinding, writeBinding } from "./binding.js";
 import { readContinuation, readContinuationRuns, writeContinuation, removeContinuation } from "./continuation.js";
-import { openBridge } from "./bridge.js";
+import { bridgedFrame, openBridge } from "./bridge.js";
 import { assistantBlocks } from "./blocks.js";
 import { retryConversationFiles } from "./conversation-originals.js";
 import { openAssistantDrafts } from "./draft.js";
 import { localRequest, reconcileInbound } from "./inbound.js";
 import { localFiles } from "./local-files.js";
+import { answerText, answerYaml } from "./mcp.js";
 import { inheritedEnvironment } from "./command.js";
 import { watchKitWork } from "./kit-work-stream.js";
-import { applyWorkingCopies, workingCopyPaths } from "./working-copy.js";
+import { applyWorkingCopies, ownerCaller, pushWorkingCopy, workingCopyPaths } from "./working-copy.js";
 import { readConfiguration } from "./configuration.js";
 import { launchBase, readyLaunchDirectory } from "./directory.js";
 import {
@@ -32,8 +33,9 @@ import {
   WORKER_HEARTBEAT_MS,
   WORKER_INHERITED_ENVIRONMENT,
   WORKER_SUPERVISION_POLL_MS,
+  WORKING_COPY_PUSH_METHOD,
 } from "./contract.js";
-import { EpochReportRequired, houseFailed, KitRefusal } from "./refusal.js";
+import { EpochReportRequired, formatCommandError, houseFailed, KitRefusal } from "./refusal.js";
 import {
   acceptAssistantText,
   acquireCommands,
@@ -270,6 +272,52 @@ function endOnEpochReport(ended, act) {
   };
 }
 
+function refusedWith(text) {
+  const conflicts = answerYaml(text.slice(text.indexOf("\n") + 1))?.conflicts;
+  const current = Array.isArray(conflicts)
+    ? conflicts.map(({ path, state, revision }) =>
+        state === "absent" ? { path, revision: null, content: null } : { path, revision },
+      )
+    : null;
+  return { refused: { code: text.split(":")[0].trim(), text, current } };
+}
+
+function acceptedWith(text) {
+  const written = answerYaml(text).results.map(({ path, op, revision }) =>
+    op === "remove" ? { path, revision: null, content: null } : { path, revision },
+  );
+  return { refused: null, written };
+}
+
+async function sessionPush(context, bound, authority, frame, signal) {
+  const edit = async (body, sent) => {
+    const answer = await callHouseMcp(
+      context.session,
+      await sessionAuthority(context.session, bound.session, authority, sent),
+      bridgedFrame(
+        { jsonrpc: "2.0", id: 1, method: "tools/call", params: { name: "edit", arguments: { changes: body.changes } } },
+        body.operation_id,
+      ),
+      sent,
+    );
+    if (answer.error !== undefined) return refusedWith(answer.error.message ?? "kit_house_refused");
+    const text = answerText(answer.result);
+    return answer.result?.isError === true ? refusedWith(text) : acceptedWith(text);
+  };
+  let outcome;
+  try {
+    outcome = await pushWorkingCopy(context, frame.params, { binding: { session: bound.session }, submit: edit }, signal);
+  } catch (refusal) {
+    if (!(refusal instanceof KitRefusal)) throw refusal;
+    outcome = { refused: true, text: refusal.message };
+  }
+  return {
+    jsonrpc: "2.0",
+    id: frame.id,
+    result: { content: [{ type: "text", text: outcome.text }], ...(outcome.refused ? { isError: true } : {}) },
+  };
+}
+
 async function openRunBridge(context, bound, authority, start) {
   const ended = new AbortController();
   const handed = (act) => endOnEpochReport(ended, act);
@@ -291,8 +339,9 @@ async function openRunBridge(context, bound, authority, start) {
     ),
     secret: (interaction, ceremony) => awaitSecretInput(context.session, interaction, ceremony),
     settle: handed((interaction, outcome) => settleInteraction(context, interaction, outcome)),
-    forward: handed((frame, signal) =>
-      localFiles(async (sent) =>
+    forward: handed((frame, signal) => frame.method === WORKING_COPY_PUSH_METHOD
+      ? sessionPush(context, bound, authority, frame, signal)
+      : localFiles(async (sent) =>
         callHouseMcp(
           context.session,
           await sessionAuthority(context.session, bound.session, authority, signal),
@@ -960,7 +1009,16 @@ export async function runResident(options, dependencies = {}) {
   const wake = residentWake();
   const update = residentUpdate(context, wake);
   context.update = update;
-  const served = await serveResident(session, context.directory, options.signal, (serving) => update.request(serving));
+  const served = await serveResident(
+    session,
+    context.directory,
+    options.signal,
+    (serving) => update.request(serving),
+    (request, signal) =>
+      pushWorkingCopy({ directory: context.directory, session }, request, ownerCaller(session), signal).catch(
+        (error) => ({ refused: true, text: formatCommandError(error) }),
+      ),
+  );
   const serve = async (signal) => {
     context.busy = true;
     const watcher = new AbortController();

package/src/working-copy.js

@@ -1,8 +1,11 @@
 import { randomUUID } from "node:crypto";
-import { mkdir, readdir, rename, rm, stat } from "node:fs/promises";
+import { mkdir, readdir, realpath, rename, rm, stat } from "node:fs/promises";
 import { dirname, join } from "node:path";
+import { readBindings } from "./binding.js";
 import {
+  KIT_DOOR_BATCH_PATH,
   KIT_DOOR_DISCOVER_PATH,
+  KIT_DOOR_REVISIONS_PATH,
   KIT_WORKING_COPY_SELECTION_PATH,
   ROOM_REFERENCE,
   WORKING_COPIES_HOME,
@@ -13,13 +16,16 @@ import {
   WORKING_COPY_VERSION,
 } from "./contract.js";
 import { runGit } from "./git.js";
-import { houseAnswered, KitRefusal } from "./refusal.js";
+import { operationId } from "./operation.js";
+import { formatCommandError, houseAnswered, houseFailed, KitRefusal } from "./refusal.js";
 import { readNote, writeNote, writeText } from "./state.js";
-import { bootstrapBundle, discoveryOf, door } from "./sync.js";
-import { sidecarPath } from "./sync-library.js";
+import { bootstrapBundle, discoveryOf, door, withSession } from "./sync.js";
+import { sidecarPath, structuredOrReplace } from "./sync-library.js";
 import { locate, removeReplicaFile, writeReplicaFile } from "./sync-state.js";
 
-const COMMITTER = "House Kit <house-kit@localhost>";
+const COMMITTER_NAME = "House Kit";
+const COMMITTER_EMAIL = "house-kit@localhost";
+const COMMITTER = `${COMMITTER_NAME} <${COMMITTER_EMAIL}>`;
 const GIT_FAILED = "kit_working_copy_git_failed";
 
 function rejected(detail = null) {
@@ -149,25 +155,53 @@ function quotedPath(path) {
   return `"${path.replace(/[\\"]/g, "\\$&").replace(/\n/g, "\\n")}"`;
 }
 
-async function importReceived(repository, scope, read, parent, signal) {
-  const message = `House ${housePath(scope)} at position ${read.position}`;
-  const lines = [
-    Buffer.from(`commit ${WORKING_COPY_RECEIVED_REF}\n`),
+function importCommit(message, parents) {
+  return [
     Buffer.from(`committer ${COMMITTER} ${Math.floor(Date.now() / 1000)} +0000\n`),
     ...importData(message),
-    ...(parent === null ? [] : [Buffer.from(`from ${parent}\n`)]),
-    Buffer.from("deleteall\n"),
+    ...parents.map((parent, index) => Buffer.from(`${index === 0 ? "from" : "merge"} ${parent}\n`)),
   ];
-  for (const file of read.files.filter((entry) => entry.writable)) {
-    lines.push(Buffer.from(`M 100644 inline ${quotedPath(file.path)}\n`), ...importData(file.content));
+}
+
+function importFile(path, content) {
+  if (content === null) return [Buffer.from(`D ${quotedPath(path)}\n`)];
+  return [Buffer.from(`M 100644 inline ${quotedPath(path)}\n`), ...importData(content)];
+}
+
+async function importReceived(repository, { message, parents, files, whole = false, acknowledging = null }, signal) {
+  const stream = [];
+  const merged = [...parents];
+  if (acknowledging !== null && acknowledging.edits.length === 0) merged.push(acknowledging.commit);
+  if (acknowledging !== null && acknowledging.edits.length > 0) {
+    stream.push(
+      Buffer.from(`commit ${WORKING_COPY_RECEIVED_REF}\nmark :1\n`),
+      ...importCommit(`House accepted ${acknowledging.commit}`, [acknowledging.commit]),
+      ...acknowledging.edits.flatMap((edit) => importFile(edit.path, edit.content)),
+      Buffer.from("\n"),
+    );
+    merged.push(":1");
   }
-  lines.push(Buffer.from("\n"));
+  stream.push(
+    Buffer.from(`commit ${WORKING_COPY_RECEIVED_REF}\n`),
+    ...importCommit(message, merged),
+    ...(whole ? [Buffer.from("deleteall\n")] : []),
+    ...files.flatMap((file) => importFile(file.path, file.content)),
+    Buffer.from("\n"),
+  );
   await runGit(repository, ["fast-import", "--quiet", "--force"], {
-    input: Buffer.concat(lines),
+    input: Buffer.concat(stream),
     signal,
     failure: GIT_FAILED,
   });
-  const commit = await runGit(repository, ["rev-parse", "--verify", `${WORKING_COPY_RECEIVED_REF}^{commit}`], {
+  const received = await commitOf(repository, WORKING_COPY_RECEIVED_REF, signal);
+  if (acknowledging === null) return { received, acknowledged: null };
+  const acknowledged =
+    acknowledging.edits.length === 0 ? acknowledging.commit : await commitOf(repository, `${received}^2`, signal);
+  return { received, acknowledged };
+}
+
+async function commitOf(repository, name, signal) {
+  const commit = await runGit(repository, ["rev-parse", "--verify", `${name}^{commit}`], {
     capture: true,
     signal,
     failure: GIT_FAILED,
@@ -175,6 +209,16 @@ async function importReceived(repository, scope, read, parent, signal) {
   return commit.toString("utf8").trim();
 }
 
+async function remembered(repository, revisions, commit, files, signal) {
+  const tree = await treeOf(repository, commit, signal);
+  const next = { ...revisions };
+  for (const { path, revision } of files) {
+    const entry = tree.get(path);
+    if (entry !== undefined && revision !== null) next[path] = { ...next[path], [entry.object]: revision };
+  }
+  return next;
+}
+
 function readOnlyContents(read) {
   const contents = new Map();
   for (const file of read.files) {
@@ -268,13 +312,21 @@ function manifest(read, commit) {
     commit,
     position: read.position,
     log_epoch: read.logEpoch,
-    files: read.files.map(({ path, revision, sha256, writable }) => ({ path, revision, sha256, writable })),
     read_only: [...readOnlyContents(read).keys()],
   };
 }
 
+function copyPath(directory, copy) {
+  return statePath(directory, { kind: copy.scope, ref: copy.room_ref });
+}
+
 async function writeCopy(directory, copy, signal) {
-  await writeNote(statePath(directory, { kind: copy.scope, ref: copy.room_ref }), copy, signal);
+  await writeNote(copyPath(directory, copy), copy, signal);
+}
+
+async function readCopy(path) {
+  const copy = await readNote(path, null);
+  return copy?.version === WORKING_COPY_VERSION ? copy : null;
 }
 
 async function heldCopies(directory) {
@@ -287,10 +339,30 @@ async function heldCopies(directory) {
   }
   const held = [];
   for (const name of names.filter((entry) => entry.endsWith(".json")).sort()) {
-    held.push(await readNote(join(rooms, name), null));
+    held.push(await readCopy(join(rooms, name)));
   }
-  held.push(await readNote(statePath(directory, { kind: "private" }), null));
-  return held.filter((copy) => copy?.version === WORKING_COPY_VERSION);
+  held.push(await readCopy(statePath(directory, { kind: "private" })));
+  return held.filter((copy) => copy !== null);
+}
+
+const turns = new Map();
+
+function exclusively(path, work) {
+  const turn = (turns.get(path) ?? Promise.resolve()).then(work);
+  const settled = turn.then(
+    () => undefined,
+    () => undefined,
+  );
+  turns.set(path, settled);
+  void settled.then(() => {
+    if (turns.get(path) === settled) turns.delete(path);
+  });
+  return turn;
+}
+
+function received(scope, read, parents) {
+  const files = read.files.filter((file) => file.writable);
+  return { message: `House ${housePath(scope)} at position ${read.position}`, parents, files, whole: true };
 }
 
 async function materialize(context, scope, signal) {
@@ -300,10 +372,13 @@ async function materialize(context, scope, signal) {
   if (await present(repository)) throw new KitRefusal("kit_working_copy_unmanaged", repository);
   const staging = join(dirname(repository), `.${randomUUID()}.staging`);
   await mkdir(staging, { recursive: true });
+  const imported = received(scope, read, []);
   let commit;
+  let revisions;
   try {
     await runGit(staging, ["init", "-q", "-b", WORKING_COPY_BRANCH], { signal, failure: GIT_FAILED });
-    commit = await importReceived(staging, scope, read, null, signal);
+    commit = (await importReceived(staging, imported, signal)).received;
+    revisions = await remembered(staging, {}, commit, imported.files, signal);
     await runGit(staging, ["update-ref", `refs/heads/${WORKING_COPY_BRANCH}`, commit], {
       signal,
       failure: GIT_FAILED,
@@ -316,7 +391,6 @@ async function materialize(context, scope, signal) {
     await rm(staging, { recursive: true, force: true });
     throw error;
   }
-  const received = manifest(read, commit);
   await writeCopy(context.directory, {
     version: WORKING_COPY_VERSION,
     scope: scope.kind,
@@ -324,27 +398,33 @@ async function materialize(context, scope, signal) {
     room_handle: scope.handle,
     repository,
     active: true,
-    base: received,
-    received,
+    received: manifest(read, commit),
+    revisions,
   });
 }
 
+async function receive(context, copy, scope, signal) {
+  const read = await readScope(context.session, scope, signal);
+  if (read.anchor !== copy.room_ref) throw rejected("bootstrap");
+  const imported = received(scope, read, [copy.received.commit]);
+  const commit = (await importReceived(copy.repository, imported, signal)).received;
+  await replaceReadOnly(copy.repository, copy.received.read_only, readOnlyContents(read), signal);
+  await writeIgnoreRules(copy.repository, read, signal);
+  return {
+    ...copy,
+    received: manifest(read, commit),
+    revisions: await remembered(copy.repository, copy.revisions, commit, imported.files, signal),
+  };
+}
+
 async function refresh(context, copy, scope, signal) {
   if (!(await present(copy.repository))) {
-    await rm(statePath(context.directory, { kind: copy.scope, ref: copy.room_ref }), { force: true });
+    await rm(copyPath(context.directory, copy), { force: true });
     await materialize(context, scope, signal);
     return;
   }
-  const read = await readScope(context.session, scope, signal);
-  if (read.anchor !== copy.room_ref) throw rejected("bootstrap");
-  const commit = await importReceived(copy.repository, scope, read, copy.received.commit, signal);
-  await replaceReadOnly(copy.repository, copy.received.read_only, readOnlyContents(read), signal);
-  await writeIgnoreRules(copy.repository, read, signal);
-  await writeCopy(
-    context.directory,
-    { ...copy, room_handle: scope.handle, active: true, received: manifest(read, commit) },
-    signal,
-  );
+  const next = await receive(context, copy, scope, signal);
+  await writeCopy(context.directory, { ...next, room_handle: scope.handle, active: true }, signal);
 }
 
 function scopeRefused(error) {
@@ -355,21 +435,26 @@ export async function applyWorkingCopies(context, signal) {
   const selected = (await savedSelection(context.session, signal)).filter(
     (scope) => scope.kind === "private" || scope.handle !== null,
   );
-  const held = await heldCopies(context.directory);
-  for (const copy of held) {
-    if (copy.active && !selected.some((scope) => sameScope(copy, scope))) {
-      await writeCopy(context.directory, { ...copy, active: false }, signal);
-    }
+  for (const held of await heldCopies(context.directory)) {
+    if (!held.active || selected.some((scope) => sameScope(held, scope))) continue;
+    const path = copyPath(context.directory, held);
+    await exclusively(path, async () => {
+      const copy = await readCopy(path);
+      if (copy !== null) await writeCopy(context.directory, { ...copy, active: false }, signal);
+    });
   }
   const refused = [];
   for (const scope of selected) {
-    const copy = held.find((entry) => sameScope(entry, scope));
+    const path = statePath(context.directory, scope);
     try {
-      if (copy === undefined) await materialize(context, scope, signal);
-      else if (!copy.active) await refresh(context, copy, scope, signal);
-      else if (copy.room_handle !== scope.handle) {
-        await writeCopy(context.directory, { ...copy, room_handle: scope.handle }, signal);
-      }
+      await exclusively(path, async () => {
+        const copy = await readCopy(path);
+        if (copy === null) await materialize(context, scope, signal);
+        else if (!copy.active) await refresh(context, copy, scope, signal);
+        else if (copy.room_handle !== scope.handle) {
+          await writeCopy(context.directory, { ...copy, room_handle: scope.handle }, signal);
+        }
+      });
     } catch (error) {
       if (!scopeRefused(error)) throw error;
       refused.push({ path: housePath(scope), code: error.code });
@@ -387,3 +472,387 @@ export async function workingCopyPaths(directory) {
     }))
     .sort((left, right) => (left.path < right.path ? -1 : 1));
 }
+
+function scopeOf(copy) {
+  return { kind: copy.scope, ref: copy.room_ref, handle: copy.room_handle };
+}
+
+function without(copy) {
+  const { push, ...settled } = copy;
+  return settled;
+}
+
+function lines(output) {
+  return output.toString("utf8").split("\n").filter((line) => line !== "");
+}
+
+function succeeded(git) {
+  return git.then(
+    () => true,
+    () => false,
+  );
+}
+
+function contains(repository, ancestor, descendant, signal) {
+  return succeeded(
+    runGit(repository, ["merge-base", "--is-ancestor", ancestor, descendant], { signal, failure: GIT_FAILED }),
+  );
+}
+
+async function located(cwd, signal) {
+  const [common, worktree] = lines(
+    await runGit(cwd, ["rev-parse", "--path-format=absolute", "--git-common-dir", "--show-toplevel"], {
+      capture: true,
+      signal,
+      failure: "kit_working_copy_unresolved",
+    }),
+  );
+  return { repository: await realpath(dirname(common)), worktree };
+}
+
+async function copyAt(directory, repository) {
+  for (const copy of await heldCopies(directory)) {
+    if ((await realpath(copy.repository).catch(() => null)) === repository) return copy;
+  }
+  throw new KitRefusal("kit_working_copy_not_found", repository);
+}
+
+async function treeOf(repository, commit, signal) {
+  const listed = await runGit(repository, ["ls-tree", "-r", "-z", commit], {
+    capture: true,
+    signal,
+    failure: GIT_FAILED,
+  });
+  const tree = new Map();
+  for (const entry of listed.toString("utf8").split("\0").filter((line) => line !== "")) {
+    const tab = entry.indexOf("\t");
+    const [, type, object] = entry.slice(0, tab).split(" ");
+    tree.set(entry.slice(tab + 1), { type, object });
+  }
+  return tree;
+}
+
+async function blobText(repository, entry, path, signal) {
+  if (entry === undefined) return null;
+  if (entry.type !== "blob") throw new KitRefusal("kit_working_copy_not_text", path);
+  const bytes = await runGit(repository, ["cat-file", "blob", entry.object], {
+    capture: true,
+    signal,
+    failure: GIT_FAILED,
+  });
+  try {
+    return new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes);
+  } catch {
+    throw new KitRefusal("kit_working_copy_not_text", path);
+  }
+}
+
+async function trustedBase(copy, commit, signal) {
+  const git = (args) => runGit(copy.repository, args, { capture: true, signal, failure: GIT_FAILED });
+  const house = new Set(
+    lines(await git(["rev-list", "--first-parent", "--parents", copy.received.commit])).flatMap((line) => {
+      const [received, , acknowledged] = line.split(" ");
+      return acknowledged === undefined ? [received] : [received, acknowledged];
+    }),
+  );
+  const base = lines(await git(["rev-list", "--topo-order", commit])).find((ancestor) => house.has(ancestor));
+  if (base !== undefined) return base;
+  throw new KitRefusal(
+    "kit_working_copy_base_unknown",
+    `${commit} contains no House state; merge or rebase onto ${WORKING_COPY_RECEIVED_REF}`,
+  );
+}
+
+async function derived(copy, base, commit, signal) {
+  const root = housePath(scopeOf(copy));
+  const before = await treeOf(copy.repository, base, signal);
+  const after = await treeOf(copy.repository, commit, signal);
+  const changes = [];
+  for (const path of [...new Set([...before.keys(), ...after.keys()])].sort()) {
+    const prior = before.get(path);
+    const next = after.get(path);
+    if (prior?.object === next?.object) continue;
+    const target = `${root}/${path}`;
+    const revision = copy.revisions[path]?.[prior?.object];
+    if (next === undefined) {
+      changes.push({ op: "remove", path: target, base: revision });
+      continue;
+    }
+    const content = await blobText(copy.repository, next, path, signal);
+    if (prior === undefined) {
+      changes.push({ op: "create", path: target, content });
+      continue;
+    }
+    const recorded = { content: await blobText(copy.repository, prior, path, signal), revision };
+    changes.push(...structuredOrReplace(root, path, recorded, content));
+  }
+  return changes;
+}
+
+async function revisionText(session, { path, revision }, signal) {
+  const page = await door(session, KIT_DOOR_REVISIONS_PATH, { path, revision }, signal);
+  const content = page?.revisions?.find((entry) => entry?.revision === revision)?.content;
+  if (typeof content !== "string") throw new KitRefusal("kit_working_copy_result_unreadable", `${path} at ${revision}`);
+  return content;
+}
+
+async function materials(context, copy, entries, signal) {
+  const root = housePath(scopeOf(copy));
+  const files = [];
+  for (const entry of entries) {
+    const content = entry.content === undefined ? await revisionText(context.session, entry, signal) : entry.content;
+    files.push({ path: entry.path.slice(root.length + 1), revision: entry.revision, content });
+  }
+  return files;
+}
+
+async function recorded(copy, files, message, acknowledging, signal) {
+  const imported = await importReceived(
+    copy.repository,
+    { message, parents: [copy.received.commit], files, acknowledging },
+    signal,
+  );
+  return {
+    copy: {
+      ...copy,
+      received: { ...copy.received, commit: imported.received },
+      revisions: await remembered(copy.repository, copy.revisions, imported.received, files, signal),
+    },
+    acknowledged: imported.acknowledged,
+  };
+}
+
+function submittedPaths(copy) {
+  const root = housePath(scopeOf(copy));
+  return new Set(copy.push.changes.map((change) => change.path.slice(root.length + 1)));
+}
+
+function short(commit) {
+  return commit.slice(0, 12);
+}
+
+async function acknowledge(context, copy, signal) {
+  const { push } = copy;
+  const files = await materials(context, copy, push.written, signal);
+  const selected = await treeOf(copy.repository, push.commit, signal);
+  const edits = [];
+  for (const file of files) {
+    if ((await blobText(copy.repository, selected.get(file.path), file.path, signal)) !== file.content) edits.push(file);
+  }
+  const { copy: next, acknowledged } = await recorded(
+    copy,
+    files,
+    `House ${housePath(scopeOf(copy))} with ${push.commit} accepted`,
+    { commit: push.commit, edits },
+    signal,
+  );
+  return { ...next, push: { ...push, acknowledged } };
+}
+
+async function integrated(copy, signal) {
+  const { commit, acknowledged, worktree, branch } = copy.push;
+  const accepted = `House accepted ${short(commit)}`;
+  if (acknowledged === commit) return { done: true, text: `${accepted}.` };
+  const pending = (reason) => ({
+    done: false,
+    text: `${accepted}; local integration is pending (${reason}): ${acknowledged} holds House's result.`,
+  });
+  const git = (args) => runGit(worktree, args, { capture: true, signal, failure: GIT_FAILED });
+  const head = await git(["symbolic-ref", "-q", "HEAD"]).then(
+    (output) => lines(output)[0],
+    () => null,
+  );
+  if (branch === null || head !== branch) return pending("the branch changed");
+  const tip = lines(await git(["rev-parse", "HEAD"]))[0];
+  const name = branch.replace(/^refs\/heads\//, "");
+  if (await contains(worktree, acknowledged, tip, signal)) return { done: true, text: `${accepted}; ${name} holds it.` };
+  if (!(await contains(worktree, commit, tip, signal))) return pending("the branch changed");
+  if (lines(await git(["status", "--porcelain", "--untracked-files=no"])).length > 0) {
+    return pending("uncommitted changes");
+  }
+  if (tip === commit) {
+    if (!(await succeeded(git(["merge", "--ff-only", "-q", acknowledged])))) return pending("a conflict");
+  } else if (
+    !(await succeeded(
+      git(["-c", `user.name=${COMMITTER_NAME}`, "-c", `user.email=${COMMITTER_EMAIL}`, "rebase", "-q", "--onto", acknowledged, commit]),
+    ))
+  ) {
+    await git(["rebase", "--abort"]).catch(() => undefined);
+    return pending("a conflict");
+  }
+  return { done: true, text: `${accepted}; ${name} is at ${short(lines(await git(["rev-parse", "HEAD"]))[0])}.` };
+}
+
+async function finish(context, copy, signal) {
+  try {
+    let acknowledged = copy;
+    if (copy.push.acknowledged === undefined) {
+      acknowledged = await acknowledge(context, copy, signal);
+      await writeCopy(context.directory, acknowledged, signal);
+    }
+    const outcome = await integrated(acknowledged, signal);
+    if (outcome.done) await writeCopy(context.directory, without(acknowledged), signal);
+    return { refused: false, text: outcome.text };
+  } catch (error) {
+    return {
+      refused: false,
+      text: `House accepted ${short(copy.push.commit)}; local integration is pending (${formatCommandError(error)}); run house git push again to finish it.`,
+    };
+  }
+}
+
+function sameCaller(left, right) {
+  return left.session === right.session && left.owner === right.owner;
+}
+
+function definite(error) {
+  return (
+    error instanceof KitRefusal &&
+    error.code !== "kit_command_cancelled" &&
+    !houseFailed(error) &&
+    !(error.status >= 500)
+  );
+}
+
+async function orphaned(context, copy, signal) {
+  const held = copy.push.caller.session;
+  const live = (binding) => binding.session === held && binding.stopped === null && binding.reported === null;
+  if (held === undefined || (await readBindings(context.directory)).some(live)) {
+    throw new KitRefusal("kit_working_copy_push_pending", "another caller's push awaits its recovery");
+  }
+  await writeCopy(context.directory, await receive(context, without(copy), scopeOf(copy), signal), signal);
+  throw new KitRefusal(
+    "kit_working_copy_push_unrecoverable",
+    `the Session that pushed ended before its outcome arrived; ${WORKING_COPY_RECEIVED_REF} holds House's current state`,
+  );
+}
+
+async function expired(context, copy, text, signal) {
+  const { push } = copy;
+  const root = housePath(scopeOf(copy));
+  const confirmed = await receive(context, without(copy), scopeOf(copy), signal);
+  const house = await treeOf(copy.repository, confirmed.received.commit, signal);
+  const selected = await treeOf(copy.repository, push.commit, signal);
+  const paths = [...submittedPaths(copy)];
+  if (paths.some((path) => house.get(path)?.object !== selected.get(path)?.object)) {
+    await writeCopy(context.directory, confirmed, signal);
+    return {
+      refused: true,
+      text: `${text}\nHouse does not hold ${short(push.commit)}; run house git push again to submit it as a new operation.`,
+    };
+  }
+  const written = [];
+  for (const path of paths) {
+    const entry = house.get(path);
+    written.push({
+      path: `${root}/${path}`,
+      revision: entry === undefined ? null : confirmed.revisions[path][entry.object],
+      content: await blobText(copy.repository, entry, path, signal),
+    });
+  }
+  const accepted = { ...confirmed, push: { ...push, state: "accepted", written } };
+  await writeCopy(context.directory, accepted, signal);
+  return finish(context, accepted, signal);
+}
+
+async function settle(context, copy, caller, signal) {
+  const { push } = copy;
+  if (!sameCaller(push.caller, caller.binding)) return orphaned(context, copy, signal);
+  let answer;
+  try {
+    answer = await caller.submit({ operation_id: push.operation_id, changes: push.changes }, signal);
+  } catch (error) {
+    if (!definite(error)) {
+      throw new KitRefusal("kit_working_copy_push_uncertain", "run house git push again to recover its outcome");
+    }
+    const current = error.payload?.error?.current;
+    answer = { refused: { code: error.code, text: formatCommandError(error), current: Array.isArray(current) ? current : null } };
+  }
+  const { refused } = answer;
+  if (refused?.code === "operation_expired") return expired(context, copy, refused.text, signal);
+  if (refused === null) {
+    const submitted = new Set(push.changes.map((change) => change.path));
+    const written = answer.written.filter((entry) => submitted.has(entry.path));
+    const accepted = { ...copy, push: { ...push, state: "accepted", written } };
+    await writeCopy(context.directory, accepted, signal);
+    return finish(context, accepted, signal);
+  }
+  const settled = without(copy);
+  await writeCopy(context.directory, settled, signal);
+  if (refused.current === null) return { refused: true, text: refused.text };
+  try {
+    const files = await materials(context, settled, refused.current, signal);
+    const message = `House ${housePath(scopeOf(settled))} current where ${short(push.commit)} was refused`;
+    await writeCopy(context.directory, (await recorded(settled, files, message, null, signal)).copy, signal);
+    return { refused: true, text: refused.text };
+  } catch (error) {
+    return { refused: true, text: `${refused.text}\n${WORKING_COPY_RECEIVED_REF} is unchanged: ${formatCommandError(error)}` };
+  }
+}
+
+async function pushed(context, path, at, selector, caller, signal) {
+  let copy = await readCopy(path);
+  if (copy.push?.state === "submitted") return settle(context, copy, caller, signal);
+  const commit = (
+    await runGit(at.worktree, ["rev-parse", "--verify", "--quiet", "--end-of-options", `${selector}^{commit}`], {
+      capture: true,
+      signal,
+      failure: "kit_working_copy_commit_unknown",
+    })
+  )
+    .toString("utf8")
+    .trim();
+  if (copy.push !== undefined) {
+    const held = copy.push.acknowledged;
+    if (held === undefined || !(await contains(copy.repository, held, commit, signal))) {
+      return finish(context, copy, signal);
+    }
+    copy = without(copy);
+    await writeCopy(context.directory, copy, signal);
+  }
+  if (!copy.active) throw new KitRefusal("kit_working_copy_inactive", housePath(scopeOf(copy)));
+  const changes = await derived(copy, await trustedBase(copy, commit, signal), commit, signal);
+  if (changes.length === 0) return { refused: false, text: `Nothing to submit: ${short(commit)} matches House.` };
+  const branch = await runGit(at.worktree, ["symbolic-ref", "-q", "HEAD"], { capture: true, signal, failure: GIT_FAILED })
+    .then((output) => lines(output)[0], () => null);
+  const submitted = {
+    ...copy,
+    push: {
+      state: "submitted",
+      caller: caller.binding,
+      operation_id: operationId(),
+      changes,
+      commit,
+      worktree: at.worktree,
+      branch,
+    },
+  };
+  await writeCopy(context.directory, submitted, signal);
+  return settle(context, submitted, caller, signal);
+}
+
+export async function pushWorkingCopy(context, request, caller, signal) {
+  if (typeof request?.cwd !== "string" || typeof request.commit !== "string") {
+    throw new KitRefusal("kit_house_arguments_invalid", "cwd and commit");
+  }
+  const at = await located(request.cwd, signal);
+  const path = copyPath(context.directory, await copyAt(context.directory, at.repository));
+  return exclusively(path, () => pushed(context, path, at, request.commit, caller, signal));
+}
+
+export function ownerCaller(session) {
+  return {
+    binding: { owner: true },
+    async submit(body, signal) {
+      return { refused: null, written: (await door(session, KIT_DOOR_BATCH_PATH, body, signal)).contents };
+    },
+  };
+}
+
+export function ownerPush(options, request, dependencies = {}) {
+  return withSession(options, dependencies, (session, signal) =>
+    session.resident === undefined
+      ? pushWorkingCopy({ directory: options.directory, session }, request, ownerCaller(session), signal)
+      : session.push(request, signal),
+  );
+}