@appchy/jarvis 0.1.129 → 0.1.131

package/harness/harness/shift.py

@@ -7,28 +7,28 @@ any of the harness's guard rails are loaded. `next` is that entry point, and eve
 input it uses already existed: priority, `depends_on`, the bucket, the version's
 derived status, and the task's `tier:` against `autonomy.ceiling`.
 
-**Coordination is a file, not a service.** A `.claim` beside `task.md` holds the
-instance id and an expiry. A second `next` never returns a claimed task; a claim
-whose `code:` regions are already held live by another instance is refused and the
-selector moves on, which reuses the region overlap `jarvis work code` has computed all
-along. Expired claims are reaped on read, so an instance that crashes at 3am frees
-its work without anyone being paged.
+**Who is on something is read from the board's own history, and from nothing else.**
+Taking an item is the commit that moved it into progress, or that recorded a run on
+one already there, so a second `next` sees every session's work — a person's at a
+terminal included, which a lease written only by this loop never could. A task whose
+`code:` regions overlap an in-progress item somebody may still be working is skipped,
+and the selector moves on. Nothing expires and nothing is reaped: an area is free
+once everyone holding it has ended.
 
 `status` is the same data read from the other end — what shipped, what is waiting
 on you, what is at risk. Derived, never declared.
 """
-import json
+import os
 import shutil
 import sys
-from datetime import date, datetime, timedelta, timezone
-from pathlib import Path
+from datetime import date, datetime, timezone
 
 from .tree import BLOCKED, BUCKETS, die, find_work_root, rel
 from .frontmatter import rewrite_file
-from .model import locate, missing, record_session, scan
+from .model import locate, record_session, scan
 from .generate import _sync
 from .epic import plans_held
-from . import autonomy, events, links, peers
+from . import autonomy, events, holders, links, peers
 # The ceiling is read through the MODULE, never bound in with `from … import`.
 # A `from .autonomy import CEILING` captures the value at import time, so
 # `config.apply` setting it afterwards would leave this file quietly running on
@@ -36,64 +36,39 @@ from . import autonomy, events, links, peers
 # harness is built to avoid.
 from .autonomy import _open_questions, tier_of
 
-CLAIM = ".claim"
-#: How long a claim is good for. Long enough that a real task finishes inside it,
-#: short enough that a crashed instance's work is takeable the same day. Config
-#: moves it (`autonomy.lease_minutes`).
-LEASE_MINUTES = 240
 
+def _takes(root) -> dict:
+    """Everyone on every item, out of the board's own history — one read for the
+    whole tree, shared by every question this module asks of it."""
+    return holders.to_holders_by_item(events.read(root, eventless=True))
 
-def _now():
-    return datetime.now(timezone.utc).replace(microsecond=0)
 
+def _still_there(holder: dict) -> bool:
+    """Whether a holder may still be working, for the one decision this gates.
 
-def read_claim(folder: Path):
-    """The live claim on a task folder, or None. An expired or unreadable claim is
-    treated as absent — a lease nobody can parse must not be able to strand work
-    forever, which is the failure mode of every lock that fails closed."""
-    p = folder / CLAIM
-    if not p.is_file():
-        return None
-    try:
-        data = json.loads(p.read_text())
-        expires = datetime.fromisoformat(str(data["expires"]))
-        # TypeError is in the list because the comparison below throws it, not the
-        # parse: a claim written without a timezone reads fine and then cannot be
-        # compared against an aware `now`. That raised out of a function whose whole
-        # contract is that an unreadable claim reads as absent — so a single
-        # malformed `.claim` took down every command that asks who holds an item,
-        # which is the fail-closed lock this was written to avoid being.
-        if expires <= _now():
-            return None
-    except (OSError, TypeError, ValueError, KeyError, json.JSONDecodeError):
-        return None
-    return data
-
-
-def _write_claim(folder: Path, instance: str) -> dict:
-    data = {
-        "instance": instance,
-        # WHICH BOX, recorded because an id alone cannot say whether the session
-        # holding this is one you can talk to or one on another machine entirely.
-        # A claim never enters git, so this is the only place the pairing exists.
-        "machine": peers.here(),
-        "taken": _now().isoformat(),
-        "expires": (_now() + timedelta(minutes=LEASE_MINUTES)).isoformat(),
-    }
-    (folder / CLAIM).write_text(json.dumps(data, indent=2) + "\n")
-    return data
-
-
-def _live_claims(s: dict) -> list:
-    """Every unexpired claim across the tree, as (claim, task) — the input to both
-    the same-task check and the region-conflict check."""
-    out = []
-    for v in s["versions"]:
-        for t in v.all_tasks():
-            c = read_claim(t.folder)
-            if c:
-                out.append((c, t))
-    return out
+    Only `ended` says no. A session this machine cannot see — on another machine, on
+    a client that publishes nothing, or a shift that names itself — counts as still
+    there, because what this answer decides is the unattended loop HOLDING BACK: a
+    wrong yes costs a task not taken tonight, and a wrong no costs two runs on one
+    area. It never refuses a person and never lets anything go ahead that would not
+    have gone ahead anyway."""
+    return peers.reach(holder["session"], holder["machine"])["live"] != "ended"
+
+
+def somebody_else(root, name: str) -> str:
+    """A note for whoever is about to move `name` when somebody other than them may
+    still be on it, or "" when nobody is.
+
+    It warns and never refuses: `next` is the door that declines held work, and a
+    person who has decided to take something over is owed who to talk to before the
+    two of them collide, not an argument about it."""
+    mine = peers.me()
+    others = [h for h in holders.to_holders(events.read(root, name=name, eventless=True))
+              if h["session"] != mine and _still_there(h)]
+    if not others:
+        return ""
+    said = "; ".join(peers.describe(h["session"], h["machine"]) for h in others)
+    return f"note: '{name}' may still be held by another session — {said}"
 
 
 def _blockers(task, s: dict) -> str:
@@ -112,50 +87,59 @@ def _blockers(task, s: dict) -> str:
     return ""
 
 
-def _region_conflict(task, claims: list) -> str:
+def _region_conflict(task, held: list) -> str:
+    """Why `task` overlaps work somebody may still be doing, or "".
+
+    `held` is every (holder, in-progress item) pair whose holder is not this instance
+    and has not ended. Overlap is exact and says nothing finer: where a repo's work
+    sits in one region, everything waits while anyone is working, which is the safe
+    direction for an unattended run to be wrong in."""
     if not task.code:
         return ""
-    for c, other in claims:
+    for holder, other in held:
         if other.name == task.name:
             continue
         overlap = sorted(set(task.code) & set(other.code))
         if overlap:
-            # Naming the holder is only half an answer — the half that leaves you
-            # waiting for a lease. The other half is whether that session is one
-            # you can actually talk to about it.
-            return (f"code region(s) {', '.join(overlap)} held by "
-                    f"'{other.name}' · {peers.of_claim(c)}")
+            return (f"code region(s) {', '.join(overlap)} held by '{other.name}' · "
+                    f"{peers.describe(holder['session'], holder['machine'])}")
     return ""
 
 
 def cmd_next(args) -> int:
-    """Hand this instance exactly one task, and claim it.
+    """Hand this instance exactly one task.
 
-    `--peek` selects without claiming or moving — for a human asking what the shift
+    `--peek` selects without taking or moving — for a human asking what the shift
     would take next, which must not have the side effect of taking it."""
     root = find_work_root()
-    instance = (args.get("instance") or events.instance_id() or "local").strip()
+    instance = (args.get("instance") or events.instance_id() or "").strip()
+    if args.get("instance"):
+        # A take is recorded under whoever this run is known as, so a name given here
+        # has to be that name — or this run would read its own take as somebody
+        # else's and hold back from its own work.
+        os.environ["WORK_INSTANCE"] = instance
     peek = bool(args.get("peek"))
     s = scan(root)
-    claims = _live_claims(s)
+    live = [v for v in s["versions"] if not v.released]
+    in_flight = [t for v in live for t in v.bucket("in-progress")]
+    takes = _takes(root)
 
     # An instance that already holds work resumes it rather than taking more. One
     # instance, one task — a shift juggling three tasks is three half-finished
     # tasks, and unattended nobody notices until morning.
-    for c, t in claims:
-        if c["instance"] == instance:
-            print(f"RESUME  {t.name} — {t.title}   [claimed {c['taken']}]")
+    for t in in_flight:
+        mine = [h for h in takes.get(t.name, []) if instance and h["session"] == instance]
+        if mine:
+            print(f"RESUME  {t.name} — {t.title}   [taken {mine[0]['taken']}]")
             _read_order(t, root)
             return 0
 
-    live = [v for v in s["versions"] if not v.released]
+    held = [(h, t) for t in in_flight for h in takes.get(t.name, [])
+            if h["session"] != instance and _still_there(h)]
     candidates, skipped = [], []
     for v in sorted(live, key=lambda x: (x.order, x.name)):
         for t in v.bucket("queue"):
-            if read_claim(t.folder):
-                skipped.append((t, "claimed by another instance"))
-                continue
-            why = _blockers(t, s) or _region_conflict(t, claims)
+            why = _blockers(t, s) or _region_conflict(t, held)
             if why:
                 skipped.append((t, why))
                 continue
@@ -193,13 +177,13 @@ def cmd_next(args) -> int:
         md,
         lambda d: d.update({"updated": date.today().isoformat()}),
     )
-    claim = _write_claim(dest, instance)
     record_session(dest)
+    # The move IS the take: its commit names the run and the machine, and that record
+    # is the one every reader derives who is on this from.
     events.append(root, "moved", task.name, **{"from": "queue", "to": "in-progress"})
-    events.append(root, "claimed", task.name, expires=claim["expires"])
 
     print(f"TAKE  {task.name} — {task.title}   "
-          f"[{task.priority} · tier {tier_of(task)} · lease to {claim['expires']}]")
+          f"[{task.priority} · tier {tier_of(task)}]")
     task = locate(root, task.name)
     _read_order(task, root)
     _sync(root)
@@ -227,23 +211,6 @@ def _read_order(task, root) -> None:
              "ABOVE CEILING: do not decide alone."))
 
 
-def cmd_drop(args) -> int:
-    """Give a task back — the honest end to a shift that cannot finish it."""
-    root = find_work_root()
-    task = locate(root, args["name"])
-    if not task:
-        die(missing(root, args["name"]))
-    p = task.folder / CLAIM
-    if p.is_file():
-        p.unlink()
-        events.append(root, "released-claim", task.name,
-                      why=(args.get("why") or "").strip() or None)
-        print(f"released claim on '{task.name}'")
-    else:
-        print(f"'{task.name}' has no claim")
-    return 0
-
-
 def _ago(ts: str) -> str:
     """How long ago a recorded moment was, in the coarsest unit that still says
     something. "6h ago" answers *is anyone on this* far better than a timestamp the
@@ -303,7 +270,7 @@ def cmd_status(args) -> int:
     # One read of the record, shared by every section below. It is a `git log`
     # under the git backend, so asking three times is three subprocesses for one
     # answer that cannot change between them.
-    log = events.read(root)
+    log = events.read(root, eventless=True)
     recent = [e for e in log if e["event"] == "completed"][-5:]
     print(f"\nSHIPPED  (last {len(recent)})")
     for e in recent:
@@ -312,39 +279,36 @@ def cmd_status(args) -> int:
     if not recent:
         print("  nothing recorded yet.")
 
-    # Who last touched each item, out of the commits. A lease answers this only for
-    # the unattended loop — an interactive session writes none at all, so reading
-    # claims alone printed `unclaimed` against every item a person was working and
-    # told the one screen the shift is read from nothing whatsoever.
-    touched = {}
-    for e in log:
-        if e.get("by"):
-            touched[e["name"]] = e
+    # Who is on each item, out of the commits that took it — the derivation the board
+    # and `next` read too, so the three cannot name different holders.
+    takes = holders.to_holders_by_item(log)
 
     in_flight = [t for v in live for t in v.bucket("in-progress")]
     print(f"\nIN FLIGHT  ({len(in_flight)})")
     for t in in_flight:
-        c = read_claim(t.folder)
-        last = touched.get(t.name)
-        if c:
-            who = f" · {c['instance'][:8]} until {c['expires'][11:16]}Z"
-        elif last:
-            who = f" · last touched {_ago(last['ts'])}"
-        else:
-            who = " · never touched"
+        found = takes.get(t.name, [])
+        latest = max(found, key=lambda h: h["taken"]) if found else None
+        who = f" · last taken {_ago(latest['taken'])}" if latest else " · never taken"
         print(f"  {t.name} — {t.title}  [tier {tier_of(t)}{who}]")
         # Only for work that is somebody ELSE's: on your own tasks this would be a
         # line about yourself on every status, which is how a useful line becomes
-        # one people stop reading.
-        if c and c.get("instance") != peers.me():
-            print(f"      {peers.of_claim(c)}")
-        elif not c and last and last["by"] != peers.me():
-            print(f"      {peers.describe(last['by'], last.get('machine', ''))}")
+        # one people stop reading. Takes whose run has ended collapse to a count, and
+        # the newest of them is named only when nobody at all is left on the item.
+        others = [h for h in found if h["session"] != peers.me()]
+        still = [h for h in others if _still_there(h)]
+        for h in still:
+            print(f"      {peers.describe(h['session'], h['machine'])}")
+        ended = [h for h in others if h not in still]
+        if ended and not still:
+            newest = max(ended, key=lambda h: h["taken"])
+            print(f"      {peers.describe(newest['session'], newest['machine'])}")
+            ended.remove(newest)
+        if ended:
+            print(f"      + {len(ended)} earlier take(s) whose run has ended")
     if not in_flight:
         print("  nothing is being worked on.")
 
-    # At risk: claimed-but-expired (an instance died), and gates that keep refusing.
-    stale = [t for t in in_flight if not read_claim(t.folder) and (t.folder / CLAIM).is_file()]
+    # At risk: gates that keep refusing.
     # A task refused repeatedly is a task not converging — UNLESS it is parked with
     # an open question, which is the designed outcome rather than a failure. Counting
     # those would put the harness's own correct behaviour on the risk list, and a
@@ -355,12 +319,10 @@ def cmd_status(args) -> int:
         if e["event"] == "gate-refused" and e["name"] not in waiting:
             refused[e["name"]] = refused.get(e["name"], 0) + 1
     repeat = {n: c for n, c in refused.items() if c >= 2}
-    print(f"\nAT RISK  ({len(stale) + len(repeat)})")
-    for t in stale:
-        print(f"  {t.name}: lease expired — the instance working it is gone")
+    print(f"\nAT RISK  ({len(repeat)})")
     for n, c in sorted(repeat.items()):
         print(f"  {n}: completion refused {c}× — it is not converging")
-    if not stale and not repeat:
+    if not repeat:
         print("  nothing.")
 
     print("\nBOARD")

package/harness/harness/task.py

@@ -3,7 +3,7 @@ import shutil
 import sys
 from datetime import date
 
-from . import peers, tree
+from . import tree
 # `TASK_TAGS_OK` is deliberately NOT imported by name: `config.apply` binds it on
 # the `tree` module, and a `from … import` captures the value at import time, so
 # the name here would still hold the pre-config default. Read through the module.
@@ -334,11 +334,10 @@ def cmd_move(args) -> int:
     # what a person uses when they have decided to take something over — and a
     # harness that argued with that would just get worked around. What it owes is
     # the fact, and who to talk to before the two of you collide.
-    from .shift import read_claim
-    held = read_claim(task.folder)
-    if held and held.get("instance") != peers.me():
-        print(f"note: '{name}' is held by another session — {peers.of_claim(held)}",
-              file=sys.stderr)
+    from .shift import somebody_else
+    note = somebody_else(root, name)
+    if note:
+        print(note, file=sys.stderr)
 
     # The gate runs BEFORE the folder moves. It used to warn after — which meant
     # the task was already sitting in `complete/` when the warning printed, and
@@ -405,11 +404,6 @@ def cmd_move(args) -> int:
     # (a blank scaffold on every pickup was noise). Working checklists live in
     # native TodoWrite, so completion strips nothing.
     if to == "complete":
-        # The lease is the claim on WORK IN FLIGHT; finished work holds nothing.
-        # Leaving it would make `status` report a live instance on a done task.
-        claim = dest / ".claim"
-        if claim.is_file():
-            claim.unlink()
         events.append(root, "completed", name, delivered=delivered or None,
                       not_included=not_included or None)
         # The forwardable line. `not_included` is asked for every time and never

package/harness/harness/tree.py

@@ -133,6 +133,23 @@ TASK_REGION_CAP = 3
 # has not cut yet), which is why this warns rather than blocks: an epic that is
 # planned deep and cut shallow is legitimate, and says so in its own §Plan.
 EPIC_TASK_FLOOR = 3
+# The other end of the epic bound, and the first bound on a CUT. Both count OPEN
+# work — queue, in-progress, blocked — because what is hard to plan together, or to
+# close, is what is still owed rather than what already shipped inside it.
+#
+# Soft in exactly the shape the floor and the region cap already are. An epic past
+# its ceiling warns, and a written `one_goal:` answers it. A cut past its ceiling is
+# FLAGGED as owing a reshape — never refused, never routed. Founder's call,
+# 2026-09-12, made against the live counts (epics at 17, 10, 8, 7 open; cuts at 24,
+# 15, 13, 9): "it should be resolved and either be in a new cut or the epic, depends
+# on the task … to make sure we dont land a half baked cut". Where a task belongs is
+# a planning call, so the harness says what is owed and a person decides.
+#
+# These are only the shipped defaults: `ceilings` in config moves them, because the
+# harness serves repos of very different sizes. READ THROUGH THE MODULE — a
+# `from .tree import` captures the default before config has bound the repo's own.
+EPIC_TASK_CEILING = 8
+CUT_TASK_CEILING = 15
 # A feature's lifecycle, product-language not engineering-status.
 PRODUCT_STATES = ("idea", "defined", "building", "shipped", "retired")
 BACKLOG_START = "<!-- BACKLOG:START -->"

package/harness/harness/version.py

@@ -348,12 +348,10 @@ def _archive_task(root, name: str, args) -> int:
     # Somebody may be on it. Both notes WARN rather than refuse, exactly as `move`
     # and the take-it-out-of-a-cut door already do: a harness that argues about a
     # call the person has made gets worked around.
-    from .shift import read_claim
-    from . import peers
-    held = read_claim(task.folder)
-    if held and held.get("instance") != peers.me():
-        print(f"note: '{name}' is held by another session — {peers.of_claim(held)}",
-              file=sys.stderr)
+    from .shift import somebody_else
+    note = somebody_else(root, name)
+    if note:
+        print(note, file=sys.stderr)
     if task.status == "in-progress":
         print(f"note: '{name}' is in progress — somebody may be working it right "
               f"now, and this takes it out from under them.", file=sys.stderr)

package/harness/presets/appchy/PRESET.md

@@ -555,31 +555,30 @@ Work-Session: <the run that made the change>
 ```
 
 Four keys and no more: who, when and which branch are git's own, and a second copy of a fact is a
-second thing to drift. Two things never reach git — a **hold** (`.claim`), because coordination that
-replicates is two machines holding one item with neither knowing, and a **refused completion**,
-because nothing changed for a commit to carry.
+second thing to drift. One thing never reaches git — a **refused completion**, because nothing changed
+for a commit to carry.
 
 **One consequence worth holding on to**: most commits in this repo are board writes that change no
 code, and `stale` is defined as *graph older than HEAD*. See §Plan against the graph.
 
 ## Somebody else is on it
 
-The harness knows who else is working — a `.claim` carries an instance id and a machine, a board
-commit carries `Work-Session` and `Work-Machine`. Where that matters it says **whether you can reach
-them**:
+The harness knows who else is working — every board commit carries `Work-Session` and
+`Work-Machine`, and who is on an item is derived from the commits that took it. Where that matters it
+says **whether you can reach them**:
 
 | You see it | When |
 |---|---|
 | the session block, at startup | somebody else is live in this checkout — who, on what, and how to reach them. **Silence means you are alone** |
 | `jarvis work peers` | you asked again, because that line was true when it printed and not for long |
-| `next` skips a task | its `code:` regions are held by another session |
-| `move <name> in-progress` | a live claim on it belongs to somebody else — a **note**, not a refusal |
+| `next` skips a task | its `code:` regions overlap an item held by a session that has not ended, or that this machine cannot see |
+| `move <name> in-progress` | somebody else took it and may still be on it — a **note**, not a refusal |
 | `status` → IN FLIGHT | a task is held by a session that is not you |
 | a board read | every holder carries whether its run is still going and what reaches it |
 | any write | a pull brought board changes in: *the board moved under you — <what> · from <who>* |
 
 - **`— this machine`** → that session is addressable. `ListAgents` lists it, `SendMessage` reaches it.
-  Use it when the plan has to change and waiting for a lease to expire is the wrong answer.
+  Use it when the plan has to change.
 - **`— another machine`** → it cannot be reached from here. The board is the only thing you share, so
   say it on the board: `ask`, a `handoff`, or a task note.
 - **`ENDED`** → that is abandoned work, not a peer to negotiate with. Nobody is there to ask, so the
@@ -615,10 +614,9 @@ this repo that refuses produced a hand-written forty-iteration retry loop — so
 conversation is your call. A `move` that warns still moves — `next` is the door that declines held
 work.
 
-**Two things about holds.** A hold belongs to a **person**, not a machine — so a session you start can
-update and complete an item you are holding, and two of your own sessions never lock each other out.
-And a hold is **time-bounded and lives in the daemon's memory**: it does not survive a restart and is
-not written into the tree. Take an item when you are about to start it, not to reserve it.
+**There is no hold.** Who is on an item is the commits that took it, read the same way by `status`, the
+board and `next`. Nothing is written beside them, nothing expires, and nothing locks anybody out. Take
+an item when you are about to start it, not to reserve it — a take is on the record for good.
 
 ## Running unattended — what you decide, and what you park
 
@@ -659,7 +657,7 @@ this section exists to prevent, and nothing downstream can detect it.
 **The loop a scheduled instance runs:**
 
 ```
-jarvis work next                      # take ONE task, claim it, print the read order
+jarvis work next                      # take ONE task and print the read order
 #   … read what it printed, build, and then, through TOOLS:
 work_verify {id}                      # runs every gate; ask again until it is finished
 work_complete {id, delivered, notIncluded, observed}
@@ -667,7 +665,7 @@ work_complete {id, delivered, notIncluded, observed}
 work_update {id, question: {…}}       # park it and go back to `next`
 ```
 
-`next` is the one step with no tool: claiming work unattended is a scheduler's job, not a session's.
+`next` is the one step with no tool: taking work unattended is a scheduler's job, not a session's.
 Everything after it is a tool call, and a session that cannot finish through them has found a gap
 worth parking a question about.
 

package/harness/presets/appchy/references/operations.md

@@ -231,7 +231,7 @@ what `next` adds is *choosing*, and what `ask` adds is somewhere to put a questi
 so the run never stalls and never quietly decides for the founder.
 
 ```bash
-work.py next                      # ONE task, claimed, with its read order printed
+work.py next                      # ONE task, taken, with its read order printed
 #   … build it, then EITHER prove it:
 work.py verify --task <name>
 work.py observed <name> --ac AC-01 --saw "what you actually saw"

package/harness/schema/work.config.schema.json

@@ -196,12 +196,6 @@
           "maximum": 3,
           "default": 2,
           "description": "The highest task `tier:` an unattended run acts on alone. 0 reversible and local · 1 ordinary change behind existing tests · 2 new behaviour or a reversible migration · 3 irreversible, or it touches money, secrets, personal data or the law. Default 2: the shift does ordinary work and parks the rest with `work ask`. 3 means \"decide everything\" and is deliberately never the shipped default."
-        },
-        "lease_minutes": {
-          "type": "integer",
-          "minimum": 1,
-          "default": 240,
-          "description": "How long one instance's claim on a task holds before another may take it. Long enough that real work finishes inside it; short enough that a crashed shift's task is takeable the same day."
         }
       }
     },