@caddis/cli 0.4.56 → 0.4.57

package/bundles/antigravity-plugin/session_end_agy.py

@@ -61,7 +61,8 @@ def _repo_root(path: str):
 
 
 def _user_artifact_root() -> str:
-    """Where usage goes when the workspace is in no repository: the user's own folder, never the cwd."""
+    """Where usage goes when the workspace is in no repository: the user's own folder, never the cwd.
+    The caller writes there only when it already exists."""
     return _artifact_root(os.path.expanduser("~"))
 
 
@@ -121,21 +122,24 @@ def main() -> None:
     try:
         roots = _workspace_roots(data) or [os.getcwd()]
         # A workspace folder may sit inside a repo: the artifact dir is the REPO ROOT's, not the sub-folder's.
-        resolved = [(_repo_root(r) or str(r)) for r in roots]
-        # Write the record to every root that ALREADY has a .caddis dir, rather than to
-        # whichever root happened to be first. A multi-root session's usage belongs to each
-        # repo that participates in it, and creating .caddis in a repo that never opted in
+        # A folder in no repository is skipped: it has no project, and its cwd is never a fallback.
+        resolved = [top for top in (_repo_root(r) for r in roots) if top]
+        # Write the record only to roots that ALREADY have a .caddis dir. A multi-root session's usage
+        # belongs to each repo that participates in it, and creating .caddis in a repo that never opted in
         # would be caddis littering someone else's tree.
         targets = []
         for root in resolved:
             art = _artifact_root(root)
             if os.path.isdir(art) and art not in targets:
                 targets.append(art)
+        if not resolved:
+            # No workspace is in a repository. Usage goes to the user's own folder, and only when
+            # that folder already exists. It is never created and never the cwd.
+            user_art = _user_artifact_root()
+            if os.path.isdir(user_art):
+                targets = [user_art]
         if not targets:
-            # Nothing has opted in. In a repo, the first root's repo root is the default. Outside any
-            # repo there is no project to attach usage to, so it goes to the user's folder, not the cwd.
-            first_repo = _repo_root(roots[0])
-            targets = [_artifact_root(first_repo) if first_repo else _user_artifact_root()]
+            return  # nothing has opted in: write nothing
         record = {
             "ts": datetime.now(timezone.utc).isoformat(),
             "event": "session_end",
@@ -146,7 +150,6 @@ def main() -> None:
             "model": data.get("modelName"),
         }
         for art in targets:
-            os.makedirs(art, exist_ok=True)
             with open(os.path.join(art, "usage-log.jsonl"), "a", encoding="utf-8") as fh:
                 fh.write(json.dumps(record) + "\n")
     except Exception as _exc:

package/bundles/antigravity-plugin/skills/cloud-phases/SKILL.md

@@ -23,6 +23,35 @@ Two modes:
 With no plan argument, use the active plan (`python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_todo.py" active-plan`,
 or the one `status: current` plan in `.caddis/plans/`). If there is none, or more than one, ask.
 
+## Step 0 — Is this checkout safe to move?
+
+<!-- checkout-safety: keep byte-identical in pr-merge, ship-pr, ship-merge and cloud-phases; a test pins it -->
+Some steps below move the files of this checkout (`git rebase`, `switch`, `checkout <branch>`, `pull`, `merge`,
+`stash`, `reset --hard`). Before the first of them, run:
+```
+python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_checkout_guard.py" shared --root .
+```
+It prints `SHARED: yes <reason>` or `SHARED: no` and exits 0. It says yes when the repo's `AGENTS.md` has a line
+`Shared checkout: yes` (a dev service serves from this checkout), or when `git status` lists a change. With no
+`--own-files`, every change counts as another session's. A linked worktree is never shared.
+
+- **On `SHARED: no`,** do the steps as written, in this checkout.
+- **On `SHARED: yes`,** never move this checkout. Leave its changes as they are, and report them. Instead:
+  - **Rebase:** `git worktree add --detach "$TEMP/<repo>-rebase" <branch>`, then
+    `git -C <worktree> rebase origin/<default>` and `git -C <worktree> push --force-with-lease origin HEAD:<branch>`.
+  - **Pull a branch to test it:** `git fetch origin`, then
+    `git worktree add --detach "$TEMP/<repo>-<branch>" origin/<branch>` (for the default branch,
+    `origin/<default>`), and run the gates there. Install dependencies fresh; never link `node_modules` or a venv.
+  - **Clean up after a merge:** do not switch or pull. Run `git fetch --prune`, then
+    `git fetch origin <default>:<default>`: it fast-forwards the default branch with no checkout. Git refuses when a
+    checkout has the default branch out; then leave it and report it. Delete the local feature branch only when no
+    checkout has it out.
+  - Remove each worktree you made when its step ends: `git worktree remove <worktree>`.
+
+`$TEMP` is `%TEMP%` (`$env:TEMP` in PowerShell). The caddis guard checks only the `Shared checkout: yes` line in
+`AGENTS.md`, not a dirty tree: with that line, it asks before a tree move, and denies it in a headless session.
+<!-- /checkout-safety -->
+
 ## Step 1 — check the preconditions (stop on any failure)
 
 ```
@@ -35,7 +64,11 @@ gh auth status
 - `origin` must be a GitHub repository. Cloud sessions clone from GitHub; a repo with no GitHub
   remote cannot use this command. Say so and stop.
 - The current branch must be the plan's feature branch, never the default branch. The cloud PRs
-  target this branch, and it goes to `main` later through the normal `/caddis:ship-pr`.
+  target this branch, and it goes to the default branch later through the normal `/caddis:ship-pr`.
+  Read the default branch as a bare name: `git rev-parse --abbrev-ref origin/HEAD` prints
+  `origin/<default>`, so strip the `origin/` prefix before you compare
+  (`d=$(git rev-parse --abbrev-ref origin/HEAD) && d=${d#origin/}`; when origin/HEAD is not set,
+  `gh repo view --json defaultBranchRef -q .defaultBranchRef.name`).
 - Tracked changes must be committed. A cloud session cannot see uncommitted work.
 - `gh` must be signed in as an account that can push to the repository and open PRs.
 
@@ -152,14 +185,26 @@ gh pr list --base <feature branch> --state open --json number,title,headRefName,
 For each PR from a `<prefix>/phase-<NN>` branch, one at a time:
 1. Read the whole diff (`gh pr diff <N>`). Check it against the phase's Design and Touches. A file
    outside Touches is a finding.
-2. Wait for CI: `gh pr checks <N> --watch` (or the ci-watch lane, if this caddis has it).
+2. Wait for CI outside the session:
+   `python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_lanes.py" ci-watch --pr <N>`. Only `RESULT: pass`
+   counts; `HEAD:` names the watched head. A `gh pr checks` table is not proof: it can show an older
+   head's checks.
 3. Review under the three rules (rule 3, review by tier): stop at the first CLEAN; after 3 rounds,
-   ask the owner. A fix goes back to the same cloud session or is made locally on the PR branch.
-4. Just before merging, re-read `gh pr view <N> --json headRefOid,mergeStateStatus`. Merge only if
-   the head SHA is the one you reviewed and CI passed on it:
-   `gh pr merge <N> --squash --delete-branch`.
-5. Pull: `git pull --ff-only origin <feature branch>`.
-6. Run the phase's exit gate locally, and after the last PR, the full test suite.
+   ask the owner. A fix goes back to the same cloud session or is made locally on the PR branch. A
+   fix pushes a new head: run ci-watch again.
+4. Just before merging, check all three, then merge that head only:
+   - the last ci-watch printed `RESULT: pass`, and its `HEAD:` is the head you reviewed;
+   - `gh pr view <N> --json headRefOid,mergeStateStatus` still shows that head;
+   - no CI run on the default branch is in progress:
+     `gh run list --branch <default branch> --json status` lists no `in_progress` or `queued` run
+     (wait, then check again).
+
+   `gh pr merge <N> --squash --delete-branch --match-head-commit <watched head>` (the full SHA).
+   GitHub refuses the merge if the head moved. A merge on a head match alone merged a red PR (#34).
+5. Pull: `git pull --ff-only origin <feature branch>`. In a shared checkout (Step 0 says `SHARED: yes`), never
+   pull here: make a detached worktree of `origin/<feature branch>`, as Step 0 says, and run point 6 there.
+6. Run the phase's exit gate locally: the tests of the touched files, in the foreground, each command under
+   10 minutes. Do not start the full suite in the background. CI runs it on every PR.
 7. Update the phase's Tracker row: status, PR number, merge commit, review result. Set the prompt's
    frontmatter `status: done` so `/caddis:handoff` tidies it.
 

package/bundles/antigravity-plugin/skills/cross-review/SKILL.md

@@ -86,23 +86,26 @@ now means the narrower case — a **single file** too big to split, or more batc
 see it, the fix is usually to review that one file separately, not to narrow `--range`; don't raise
 `--max-diff-chars` blind.
 
-**Do not alternate providers on a schedule.** DeepSeek is the default because it has actually found real
-bugs that same-vendor passes missed; GLM is the documented fallback, used automatically when DeepSeek is
-unavailable and you did not name a provider. The policy lives in `oss_review.py`'s `FALLBACK_PROVIDERS`
-comment — a rota that sends half your phases to a provider observed timing out three phases running buys
-variety it never actually collects, and a review that silently does not happen is the same failure class
-as a diff that silently is not read. Name a provider explicitly only when you have a reason.
+**Do not alternate providers on a schedule.** The order is the owner policy: **DeepSeek, then agy Argon,
+then GLM** (`REVIEW_ORDER` in `oss_review.py`). A named `--provider` goes first; on a provider failure
+(HTTP 429, any 5xx, a timeout, a connection error, an empty reply) the tool moves to the next one in
+that order and prints which provider gave the verdict. A provider with no key is skipped. agy runs
+through `caddis_spend.py run` (the spend cap); if the cap refuses, agy is skipped. On a 429 the tool
+waits for `Retry-After` once (at most 60 s); it never splits the diff because of a 429 or an empty
+reply. A custom endpoint (`--base-url`/`--model`) never falls back. Name a provider only when you have
+a reason.
 
 ## Interpret the exit code
 - **0 — REVIEW: CLEAN** → no blocking issues. Proceed.
 - **1 — REVIEW: BLOCKING** → read the printed findings, then **FIX each blocking item** (or explicitly
   justify why one is a false positive). Fix it, then re-review only the fix diff. After 3 rounds, ask the owner (rule 3).
 - **4 — error** → no verdict parsed, or a git/endpoint failure. Read stderr; do NOT treat as clean.
-- **3 — misconfigured** → `REVIEW_API_KEY` is unset. Set it (see Prerequisite) and re-run.
+- **3 — could not run** → no key (see Prerequisite), the secret filter refused, or every provider
+  failed (429, 5xx, timeout, empty reply). Read stderr. A provider failure is not a verdict: re-run later.
 
 ## Three rules: one attempt, one review
 1. **Think before you send.** Before a task goes to any coder, write its edge cases and check the facts it depends on (one query or one file read).
-2. **Run it before review.** The coder runs the same checks as CI (name the exact commands in the task). Then run the change once on real data.
+2. **Run it before review.** The coder runs only the tests of the files it touched, in the foreground, each command under 10 minutes (split into parts if needed). Name the exact commands in the task. Never start the full suite in the background and never wait on a monitor for it: CI runs the full suite on every PR. Then run the change once on real data.
 3. **Review by tier.** Run `python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_gate.py" review-tier --range <base>...HEAD` (add `--plan <plan> --phase <N>` inside a plan; no `TIER:` line means tier 2).
    Tier 0: gates only. Tier 1-small: your self-check only. Tier 1: one review by another vendor; stop at
    the first CLEAN. Tier 2: two reviewers of two other vendors, in one round. Fix blocking findings only;

package/bundles/antigravity-plugin/skills/feature-plan/SKILL.md

@@ -270,7 +270,7 @@ yourself (relay + Tracker) before stopping — do not hand back "run `/caddis:ha
 ## Execution protocol (standing rules — this plan is the memory, not anyone's head)
 Three rules: one attempt, one review.
 1. **Think before you send.** Before a task goes to any coder, write its edge cases and check the facts it depends on (one query or one file read).
-2. **Run it before review.** The coder runs the same checks as CI (name the exact commands in the task). Then run the change once on real data.
+2. **Run it before review.** The coder runs only the tests of the files it touched, in the foreground, each command under 10 minutes (split into parts if needed). Name the exact commands in the task. Never start the full suite in the background and never wait on a monitor for it: CI runs the full suite on every PR. Then run the change once on real data.
 3. **Review by tier.** Run `python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_gate.py" review-tier --range <base>...HEAD` (add `--plan <plan> --phase <N>` inside a plan; no `TIER:` line means tier 2).
    Tier 0: gates only. Tier 1-small: your self-check only. Tier 1: one review by another vendor; stop at
    the first CLEAN. Tier 2: two reviewers of two other vendors, in one round. Fix blocking findings only;

package/bundles/antigravity-plugin/skills/gh-cli/SKILL.md

@@ -73,7 +73,10 @@ gh pr diff 55
 gh pr checkout 55
 gh pr review 55 --approve --body "LGTM!"
 gh pr review 55 --request-changes --body "Please fix error handling"
-gh pr merge 55 --squash --delete-branch
+# merge only on ci-watch RESULT: pass, only its HEAD:, with no default-branch run in progress
+python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_lanes.py" ci-watch --pr 55
+gh run list --branch main --json status       # no in_progress or queued run (main = the default branch)
+gh pr merge 55 --squash --delete-branch --match-head-commit <watched head>
 
 # Manage
 gh pr ready 55             # Mark draft as ready
@@ -170,8 +173,9 @@ gh issue develop 42 --branch fix/issue-42
 git add src/auth/login.py tests/test_login.py   # named files only, never `git add .`
 git commit -m "fix: resolve login bug" -- src/auth/login.py tests/test_login.py && git push -u origin HEAD
 gh pr create --title "fix: resolve login bug" --body "Closes #42"
-gh pr checks --watch
-gh pr merge --squash --delete-branch
+python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_lanes.py" ci-watch --pr <n>   # RESULT: pass, HEAD: <watched head>
+gh run list --branch main --json status       # wait while a default-branch run is in progress
+gh pr merge <n> --squash --delete-branch --match-head-commit <watched head>
 ```
 
 ### Release Workflow
@@ -189,8 +193,8 @@ gh release upload v1.3.0 ./dist/*.tar.gz
 | Create repo       | `gh repo create name --public`                 |
 | Create issue      | `gh issue create --title "..." --labels bug`   |
 | Create PR         | `gh pr create --title "..." --reviewer user`   |
-| Merge PR          | `gh pr merge 55 --squash --delete-branch`      |
+| Merge PR          | `gh pr merge 55 --squash --delete-branch --match-head-commit <watched head>`, only after ci-watch `RESULT: pass` |
 | Create release    | `gh release create v1.0.0 --generate-notes`    |
-| Watch CI          | `gh run watch`                                 |
+| Watch CI          | `caddis_lanes.py ci-watch --pr 55` (fallback: `gh run watch`) |
 | Set secret        | `echo "val" \| gh secret set KEY`              |
 | API call          | `gh api /repos/o/r --jq '.description'`        |

package/bundles/antigravity-plugin/skills/implement/SKILL.md

@@ -32,8 +32,8 @@ These override everything below. They exist because branch isolation and the run
 depend on them:
 
 - **Work ONLY on the current branch.** You are already on the feature branch (the current branch,
-  `git branch --show-current`; that read is the only `git branch` form allowed). **NEVER** run
-  `git checkout`, `git switch`, `git branch <name>`, `git switch -c`, or any command that changes,
+  `git branch --show-current`; that read is the only `git branch` form allowed).
+  **NEVER** run `git checkout`, `git switch`, `git branch <name>`, `git switch -c`, or any command that changes,
   creates, or leaves the current branch. Read the default branch with
   `git symbolic-ref --short refs/remotes/origin/HEAD`, which prints `origin/<default>`: remove the
   `origin/` prefix before you compare. If that command fails (origin/HEAD is not set), the default
@@ -57,7 +57,7 @@ depend on them:
 
 ## Three rules: one attempt, one review
 1. **Think before you send.** Before a task goes to any coder, write its edge cases and check the facts it depends on (one query or one file read).
-2. **Run it before review.** The coder runs the same checks as CI (name the exact commands in the task). Then run the change once on real data.
+2. **Run it before review.** The coder runs only the tests of the files it touched, in the foreground, each command under 10 minutes (split into parts if needed). Name the exact commands in the task. Never start the full suite in the background and never wait on a monitor for it: CI runs the full suite on every PR. Then run the change once on real data.
 3. **Review by tier.** Run `python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_gate.py" review-tier --range <base>...HEAD` (add `--plan <plan> --phase <N>` inside a plan; no `TIER:` line means tier 2).
    Tier 0: gates only. Tier 1-small: your self-check only. Tier 1: one review by another vendor; stop at
    the first CLEAN. Tier 2: two reviewers of two other vendors, in one round. Fix blocking findings only;
@@ -185,12 +185,17 @@ row, visible to any later reader without anyone having to catch it live.
    this wording without `--allow-load`. Only the owner gives that flag.
 7b. **Write test economy into every agent brief, not only the lane prompt.** The script already adds it
    to its lane prompts. A brief you write yourself (an Agent-tool subagent, a peer session) needs the same
-   five lines: after each step run only the tests for the file or module you changed; run the full suite only
-   for the baseline and once at the end; run no review loop inside the agent (you review); report progress
-   every 20 minutes; never start a second heavy test run while one is still running. **Two parallel agents
-   must not both run full suites.** Measured 2026-10-02 on one shared box: a 2,063-test suite took 2.7 min
+   five lines: after each step run only the tests for the file or module you changed, in the foreground, each
+   command under 10 minutes; never start the full suite, and never wait on a monitor for it (CI runs it on every PR);
+   run no review loop inside the agent (you review); report progress
+   every 20 minutes; never start a second heavy test run while one is still running. **Agents never run
+   the full suite.** Measured 2026-10-02 on one shared box: a 2,063-test suite took 2.7 min
    alone and 6.7 min beside a second test-heavy agent, and one agent's brief (baseline, tests after each of 9
    module switches, full gates, in-agent review) cost 30-40 of its 59 minutes.
+   On 18-19 Oct 2026 agents started the full suite (about 40 min) in the background and waited through
+   monitors with their own timeouts. One missed the finish and sat "Waiting" for over 1 h. Four parallel
+   suites also slowed the box. The orchestrator checks a stalled agent by process (pytest alive, CPU moving),
+   not by its monitor.
 8. Record these Tracker values:
    - `Model` = the packet's `model`.
    - `Lane` = the lanes tried, joined with ` -> ` and followed by the reason. For example,
@@ -288,10 +293,12 @@ You:     /clear, then paste ↓
 **In headless/runner mode, never ask — halt, write the block, and exit.** The block is how a
 non-interactive run tells a human what it needs; asking is still forbidden.
 
-**4. Run the tests yourself.** After the last phase you complete, run the project's full test command once
-more and record the real result. The runner will re-run it independently and that decides success — but
-you run it too so your reported `"tests"` value is truthful, not assumed. Never report `"passed"` on a
-suite you did not see go green.
+**4. Run the tests yourself.** After the last phase you complete, run the tests of the files you touched
+once more, in the foreground, each command under 10 minutes (split into parts if needed), and record the
+real result. Never start the full suite in the background and never wait on a monitor for it. CI runs the
+full suite on every PR and is the gate before merge. The runner re-runs its own gate independently and
+that decides success — but you run your tests too so your reported `"tests"` value is truthful, not
+assumed. Never report `"passed"` on tests you did not see go green.
 
 **4b. If every phase is now done, tidy the plan into `done/` IN THE SAME COMMIT.** Only when the
 whole plan is finished (every `## Tracker` row is `done`, no halt, no blocker) — a mid-plan halt is

package/bundles/antigravity-plugin/skills/mmr/SKILL.md

@@ -22,7 +22,7 @@ The exit codes follow `caddis_exit.py`: 0 clean, 1 blocked, 2 advisory, 3 could
 
 ## Three rules: one attempt, one review
 1. **Think before you send.** Before a task goes to any coder, write its edge cases and check the facts it depends on (one query or one file read).
-2. **Run it before review.** The coder runs the same checks as CI (name the exact commands in the task). Then run the change once on real data.
+2. **Run it before review.** The coder runs only the tests of the files it touched, in the foreground, each command under 10 minutes (split into parts if needed). Name the exact commands in the task. Never start the full suite in the background and never wait on a monitor for it: CI runs the full suite on every PR. Then run the change once on real data.
 3. **Review by tier.** Run `python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_gate.py" review-tier --range <base>...HEAD` (add `--plan <plan> --phase <N>` inside a plan; no `TIER:` line means tier 2).
    Tier 0: gates only. Tier 1-small: your self-check only. Tier 1: one review by another vendor; stop at
    the first CLEAN. Tier 2: two reviewers of two other vendors, in one round. Fix blocking findings only;

package/bundles/antigravity-plugin/skills/pr-merge/SKILL.md

@@ -9,7 +9,7 @@ End-to-end delivery of feature-branch work through the reviewed lane in one shot
 push safely, create or update the Pull Request, monitor CI checks to green, merge into the default
 branch, validate the deployment, and clean up the feature branch.
 
-For a hotfix straight to the default branch with no PR ceremony, use `/ship` (the express lane) instead.
+For a quick commit and push of a feature branch, use `/ship` (the express lane). It never pushes the default branch.
 To open a PR and stop at green for human review without merging, use `/ship-pr`.
 To merge an already-opened PR, use `/ship-merge`.
 
@@ -29,11 +29,47 @@ can be provided.
 Read `AGENTS.md` + the detected workflow file(s) first for the repo's real gate names, default
 branch, and merge conventions — never assume `main`, never assume job names.
 
+## Step 0b — Is this checkout safe to move?
+
+<!-- checkout-safety: keep byte-identical in pr-merge, ship-pr, ship-merge and cloud-phases; a test pins it -->
+Some steps below move the files of this checkout (`git rebase`, `switch`, `checkout <branch>`, `pull`, `merge`,
+`stash`, `reset --hard`). Before the first of them, run:
+```
+python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_checkout_guard.py" shared --root .
+```
+It prints `SHARED: yes <reason>` or `SHARED: no` and exits 0. It says yes when the repo's `AGENTS.md` has a line
+`Shared checkout: yes` (a dev service serves from this checkout), or when `git status` lists a change. With no
+`--own-files`, every change counts as another session's. A linked worktree is never shared.
+
+- **On `SHARED: no`,** do the steps as written, in this checkout.
+- **On `SHARED: yes`,** never move this checkout. Leave its changes as they are, and report them. Instead:
+  - **Rebase:** `git worktree add --detach "$TEMP/<repo>-rebase" <branch>`, then
+    `git -C <worktree> rebase origin/<default>` and `git -C <worktree> push --force-with-lease origin HEAD:<branch>`.
+  - **Pull a branch to test it:** `git fetch origin`, then
+    `git worktree add --detach "$TEMP/<repo>-<branch>" origin/<branch>` (for the default branch,
+    `origin/<default>`), and run the gates there. Install dependencies fresh; never link `node_modules` or a venv.
+  - **Clean up after a merge:** do not switch or pull. Run `git fetch --prune`, then
+    `git fetch origin <default>:<default>`: it fast-forwards the default branch with no checkout. Git refuses when a
+    checkout has the default branch out; then leave it and report it. Delete the local feature branch only when no
+    checkout has it out.
+  - Remove each worktree you made when its step ends: `git worktree remove <worktree>`.
+
+`$TEMP` is `%TEMP%` (`$env:TEMP` in PowerShell). The caddis guard checks only the `Shared checkout: yes` line in
+`AGENTS.md`, not a dirty tree: with that line, it asks before a tree move, and denies it in a headless session.
+<!-- /checkout-safety -->
+
 ## Step 1 — Refuse on the default branch
 
-A PR is *branch → default*. If HEAD **is** the default branch, stop and point at `/ship` — there is
-nothing to open a PR from. (Offer to create a feature branch from the current work if the changes
-are uncommitted.)
+A PR is *branch → default*. Read the default branch as a bare name: `git rev-parse --abbrev-ref
+origin/HEAD` prints `origin/<default>`, so strip the `origin/` prefix before you compare.
+```bash
+d=$(git rev-parse --abbrev-ref origin/HEAD 2>/dev/null) && d=${d#origin/}   # prints origin/<default>: strip origin/
+[ -n "$d" ] || d=$(gh repo view --json defaultBranchRef -q .defaultBranchRef.name)   # origin/HEAD not set
+git branch --show-current                                                  # compare with "$d"
+```
+If HEAD **is** the default branch, stop: there is nothing to open a PR from. Offer to move the
+uncommitted work to a feature branch (`git switch -c <branch>`), or run `/ship`, which does that and
+hands back here.
 
 ## Step 2 — Preflight (local gates mirroring CI)
 
@@ -69,6 +105,8 @@ Run `python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_gate.py" review-tier --range <
   git rebase <default-branch>
   git push --force-with-lease origin <branch> # never bare --force
   ```
+- In a shared checkout (Step 0b says `SHARED: yes`), never rebase here: rebase in a detached worktree, as
+  Step 0b says.
 
 ## Step 5 — Push + create or update the PR
 
@@ -141,6 +179,8 @@ If the default branch triggers an automated deployment pipeline:
 **Only after** the merge is complete and deployment (if any) is validated green:
 - Run `git status --short`. If it shows changes you did not make, do not switch, stash, reset or commit:
   leave them, report them, and stop cleanup here (a shared checkout often holds a peer's edits).
+- In a shared checkout (Step 0b says `SHARED: yes`), skip the switch and the pull below. Clean up as Step 0b
+  says: `git fetch --prune`, `git fetch origin <default-branch>:<default-branch>`, then delete the branches.
 - Fetch and prune: `git fetch --prune`.
 - Switch to the default branch: `git switch <default-branch>`.
 - Fast-forward to the merge commit: `git pull --ff-only origin <default-branch>`.

package/bundles/antigravity-plugin/skills/review-pr/SKILL.md

@@ -34,8 +34,11 @@ gh pr view <n> --repo <owner/repo> --json number,title,author,state,isDraft,merg
 - the PR is **merged or closed** — there is nothing to decide;
 - it is a **draft** — say so and ask whether to continue;
 - **the operator is the author.** GitHub does not allow approving your own PR. Say it plainly, and
-  say the alternatives: have someone else approve it, or merge with an admin bypass
-  (`gh pr merge <n> --squash --admin`). Do not silently produce a review they cannot submit.
+  say the alternatives: have someone else approve it, or merge with an admin bypass. An admin
+  bypass skips the approval only, never the CI rule: merge only after `caddis_lanes.py ci-watch
+  --pr <n>` prints `RESULT: pass`, with no default-branch run in progress (section 4)
+  (`gh pr merge <n> --squash --admin --match-head-commit <watched head>`). Do not silently produce a
+  review they cannot submit.
 
 ## 2. Gather what the decision needs
 
@@ -85,12 +88,18 @@ Lead with the verdict. Keep it short enough to read before deciding:
 - **CI** — green, red, or still running. Name the failing check.
 - **Merge state** — and what would clear it.
 
-Then print the exact commands, and stop:
+Then print the exact commands, and stop. The merge follows the CI rule: wait with ci-watch, and
+merge only on `RESULT: pass`, only the head it watched (`HEAD:`), and never while a CI run on the
+default branch is in progress.
 
 ```bash
 # approve
 gh pr review <n> --repo <owner/repo> --approve
-gh pr merge  <n> --repo <owner/repo> --squash --delete-branch
+# wait for CI; merge only on RESULT: pass. HEAD: is the watched head
+python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_lanes.py" ci-watch --pr <n> --repo <owner/repo>
+# no in_progress or queued run may be listed
+gh run list --repo <owner/repo> --branch <default branch> --json status
+gh pr merge  <n> --repo <owner/repo> --squash --delete-branch --match-head-commit <watched head>
 
 # or ask for changes
 gh pr review <n> --repo <owner/repo> --request-changes --body "..."

package/bundles/antigravity-plugin/skills/ship/SKILL.md

@@ -9,11 +9,12 @@ Ship the current working changes via this repo's actual delivery pipeline. The p
 repo, so **detect it first**, then follow the matching lane. Preflight, staging, and commit are
 identical across lanes; only monitoring and validation differ.
 
-> **This is the express lane** — it pushes straight to the default branch with no review pause.
-> Right for a hotfix. On a repo where that push deploys to production, Step 2c stops it before the
-> push and the owner merges. **For feature work, use the reviewed lane instead: `/ship-pr`** (open a
-> PR, monitor CI, stop at green) **→ `/ship-merge`** (merge the green PR behind a deploy-confirm,
-> validate, clean up).
+> **This is the express lane** — commit, push the current feature branch and watch its CI, with no
+> review pause. **It never pushes to the default branch.** On the default branch (Gitea or GitHub lane)
+> it moves the change to a new branch and hands over to the reviewed lane: **`/caddis:ship-pr`** (open
+> a PR, monitor CI, stop at green) **→ `/caddis:ship-merge`** (merge the green PR behind a
+> deploy-confirm, validate, clean up). Why: a direct push skips the PR, the ci-watch `RESULT: pass` on
+> the watched head and the check that no default-branch run is in progress.
 
 Optional message: **$ARGUMENTS** (if empty, derive a conventional commit message from staged changes)
 
@@ -36,6 +37,22 @@ names, branch, and service identifiers — never assume.
 - Tests: run only if the user says they're needed or a gate explicitly requires them
 - Fix any failures before proceeding. Do not commit broken code.
 
+**1b. BRANCH CHECK** — Read the default branch as a bare name (don't assume `main`) and the current
+branch. `git rev-parse --abbrev-ref origin/HEAD` prints `origin/<default>`, so strip the `origin/`
+prefix before you compare, or the check never matches:
+```bash
+d=$(git rev-parse --abbrev-ref origin/HEAD 2>/dev/null) && d=${d#origin/}   # prints origin/<default>: strip origin/
+[ -n "$d" ] || d=$(gh repo view --json defaultBranchRef -q .defaultBranchRef.name)   # origin/HEAD not set
+git branch --show-current                                                  # compare with "$d"
+```
+- **On a non-default branch:** continue at Step 2, then Step 3 pushes that branch.
+- **On the default branch, Gitea or GitHub lane:** do not commit here. Run `git switch -c ship/<slug>`
+  (the uncommitted changes go with you) and commit on it (Step 2). Then **STOP: `/ship` ends here.**
+  Do not run Step 3 or later. Hand over to `/caddis:ship-pr` → `/caddis:ship-merge`.
+  A direct push to the default branch is refused: it skips the PR, the CI pass on the watched head
+  and the in-progress check.
+- **Local-only lane:** there is no CI and no PR; commit where you are.
+
 **2. STAGE + COMMIT** — Stage only the intended files, by name (never `git add -A`, `git add .`, `git add -u`, a folder, or `git commit -a`):
 ```
 git status --short      # confirm what's staged
@@ -55,10 +72,12 @@ Run `python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_gate.py" review-tier --range <
 `<base>` is `origin/<default branch>` (on the default branch itself, the commit before this change). Tier 0 or 1-small: no model review. Tier 1: one `/caddis:cross-review`. Tier 2: two reviewers of two other vendors in one round. No `TIER:` line means tier 2.
 <!-- /shared:cross-review-trigger -->
 
-**3. PUSH** — to the repo's default branch (confirm the branch first; don't assume `main`):
+**3. PUSH** — only when Step 1b found a non-default branch (on the default branch, `/ship` stopped at Step 2):
 ```
-git push origin <branch>
+git push -u origin <feature branch>
 ```
+Never `git push origin <default branch>`: the change reaches the default branch only through
+`/caddis:ship-pr` → `/caddis:ship-merge`, which merge on ci-watch `RESULT: pass` at the watched head.
 Confirm the push succeeded and the SHA is accepted by the remote. (Local-only lane: skip if there is
 no remote, and note that nothing was pushed.)
 

package/bundles/antigravity-plugin/skills/ship-merge/SKILL.md

@@ -28,6 +28,35 @@ Resolve the target PR from `$ARGUMENTS`, else the current branch's open PR. No o
 that and point at `/ship-pr`. Read `AGENTS.md` + the workflow file(s) for the repo's real deploy
 job names and default branch — never assume.
 
+## Step 0b — Is this checkout safe to move?
+
+<!-- checkout-safety: keep byte-identical in pr-merge, ship-pr, ship-merge and cloud-phases; a test pins it -->
+Some steps below move the files of this checkout (`git rebase`, `switch`, `checkout <branch>`, `pull`, `merge`,
+`stash`, `reset --hard`). Before the first of them, run:
+```
+python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_checkout_guard.py" shared --root .
+```
+It prints `SHARED: yes <reason>` or `SHARED: no` and exits 0. It says yes when the repo's `AGENTS.md` has a line
+`Shared checkout: yes` (a dev service serves from this checkout), or when `git status` lists a change. With no
+`--own-files`, every change counts as another session's. A linked worktree is never shared.
+
+- **On `SHARED: no`,** do the steps as written, in this checkout.
+- **On `SHARED: yes`,** never move this checkout. Leave its changes as they are, and report them. Instead:
+  - **Rebase:** `git worktree add --detach "$TEMP/<repo>-rebase" <branch>`, then
+    `git -C <worktree> rebase origin/<default>` and `git -C <worktree> push --force-with-lease origin HEAD:<branch>`.
+  - **Pull a branch to test it:** `git fetch origin`, then
+    `git worktree add --detach "$TEMP/<repo>-<branch>" origin/<branch>` (for the default branch,
+    `origin/<default>`), and run the gates there. Install dependencies fresh; never link `node_modules` or a venv.
+  - **Clean up after a merge:** do not switch or pull. Run `git fetch --prune`, then
+    `git fetch origin <default>:<default>`: it fast-forwards the default branch with no checkout. Git refuses when a
+    checkout has the default branch out; then leave it and report it. Delete the local feature branch only when no
+    checkout has it out.
+  - Remove each worktree you made when its step ends: `git worktree remove <worktree>`.
+
+`$TEMP` is `%TEMP%` (`$env:TEMP` in PowerShell). The caddis guard checks only the `Shared checkout: yes` line in
+`AGENTS.md`, not a dirty tree: with that line, it asks before a tree move, and denies it in a headless session.
+<!-- /checkout-safety -->
+
 ## Step 1 — Refuse unless green + mergeable + reviewed
 
 All of, per the repo's own rules:
@@ -102,6 +131,8 @@ attempt a silent re-deploy — and **skip cleanup** (Step 6).
 **Only after** Step 5 is green:
 - Run `git status --short`. If it shows changes you did not make, do not switch, stash, reset or commit:
   leave them, report them, and stop cleanup here.
+- In a shared checkout (Step 0b says `SHARED: yes`), do not switch or pull. Clean up as Step 0b says:
+  `git fetch --prune`, `git fetch origin <default-branch>:<default-branch>`, then delete the branches.
 - `git fetch --prune`, then switch to the default branch and fast-forward it to the merge commit.
 - Delete the **remote** feature branch; delete the **local** feature branch (for a squash merge, compare
   the branch tree with the merged tree first, not ancestry).

package/bundles/antigravity-plugin/skills/ship-pr/SKILL.md

@@ -10,7 +10,7 @@ after. This command does the mechanics only: push safely, open (or update) the P
 and **stop at green** with a mergeability verdict. It **never merges and never deploys** — on these
 repos merge == deploy, so the merge stays a separate, deliberate act: `/ship-merge`.
 
-For a hotfix straight to the default branch, use `/ship` (the express lane) instead.
+For a quick commit and push of a feature branch, use `/ship` (the express lane). It never pushes the default branch.
 
 Optional argument: **$ARGUMENTS** (PR title override; default = derived from the branch's
 conventional-commit summary).
@@ -27,11 +27,47 @@ conventional-commit summary).
 Read `AGENTS.md` + the detected workflow file(s) first for the repo's real gate names, default
 branch, and merge conventions — never assume `main`, never assume job names.
 
+## Step 0b — Is this checkout safe to move?
+
+<!-- checkout-safety: keep byte-identical in pr-merge, ship-pr, ship-merge and cloud-phases; a test pins it -->
+Some steps below move the files of this checkout (`git rebase`, `switch`, `checkout <branch>`, `pull`, `merge`,
+`stash`, `reset --hard`). Before the first of them, run:
+```
+python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_checkout_guard.py" shared --root .
+```
+It prints `SHARED: yes <reason>` or `SHARED: no` and exits 0. It says yes when the repo's `AGENTS.md` has a line
+`Shared checkout: yes` (a dev service serves from this checkout), or when `git status` lists a change. With no
+`--own-files`, every change counts as another session's. A linked worktree is never shared.
+
+- **On `SHARED: no`,** do the steps as written, in this checkout.
+- **On `SHARED: yes`,** never move this checkout. Leave its changes as they are, and report them. Instead:
+  - **Rebase:** `git worktree add --detach "$TEMP/<repo>-rebase" <branch>`, then
+    `git -C <worktree> rebase origin/<default>` and `git -C <worktree> push --force-with-lease origin HEAD:<branch>`.
+  - **Pull a branch to test it:** `git fetch origin`, then
+    `git worktree add --detach "$TEMP/<repo>-<branch>" origin/<branch>` (for the default branch,
+    `origin/<default>`), and run the gates there. Install dependencies fresh; never link `node_modules` or a venv.
+  - **Clean up after a merge:** do not switch or pull. Run `git fetch --prune`, then
+    `git fetch origin <default>:<default>`: it fast-forwards the default branch with no checkout. Git refuses when a
+    checkout has the default branch out; then leave it and report it. Delete the local feature branch only when no
+    checkout has it out.
+  - Remove each worktree you made when its step ends: `git worktree remove <worktree>`.
+
+`$TEMP` is `%TEMP%` (`$env:TEMP` in PowerShell). The caddis guard checks only the `Shared checkout: yes` line in
+`AGENTS.md`, not a dirty tree: with that line, it asks before a tree move, and denies it in a headless session.
+<!-- /checkout-safety -->
+
 ## Step 1 — Refuse on the default branch
 
-A PR is *branch → default*. If HEAD **is** the default branch, stop and point at `/ship` — there is
-nothing to open a PR from. (Offer to create a feature branch from the current work if the changes
-are uncommitted.)
+A PR is *branch → default*. Read the default branch as a bare name: `git rev-parse --abbrev-ref
+origin/HEAD` prints `origin/<default>`, so strip the `origin/` prefix before you compare.
+```bash
+d=$(git rev-parse --abbrev-ref origin/HEAD 2>/dev/null) && d=${d#origin/}   # prints origin/<default>: strip origin/
+[ -n "$d" ] || d=$(gh repo view --json defaultBranchRef -q .defaultBranchRef.name)   # origin/HEAD not set
+git branch --show-current                                                  # compare with "$d"
+```
+If HEAD **is** the default branch, stop: there is nothing to open a PR from. Offer to move the
+uncommitted work to a feature branch (`git switch -c <branch>`), or run `/ship`, which does that and
+hands back here.
 
 ## Step 2 — Preflight (local gates mirroring CI)
 
@@ -108,6 +144,8 @@ Run `python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_gate.py" review-tier --range <
   git rebase <default-branch>
   git push --force-with-lease origin <branch> # never bare --force
   ```
+- In a shared checkout (Step 0b says `SHARED: yes`), never rebase here: rebase in a detached worktree, as
+  Step 0b says.
 
 ## Step 5 — Push + create/update the PR