alissa-tools-github-devloop 0.6.0__tar.gz → 0.6.2__tar.gz

{alissa_tools_github_devloop-0.6.0/src/main/alissa_tools_github_devloop.egg-info → alissa_tools_github_devloop-0.6.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: alissa-tools-github-devloop
-Version: 0.6.0
+Version: 0.6.2
 Summary: ALISSA-TOOLS-GITHUB-DEVLOOP
 Home-page: https://alissa.app
 Author: Fahera

{alissa_tools_github_devloop-0.6.0 → alissa_tools_github_devloop-0.6.2}/src/main/alissa/tools/github/devloop/__main__.py

@@ -165,6 +165,24 @@ def build_parser() -> argparse.ArgumentParser:
         "never auto-resume — a dead-with-PR lane waits for an operator",
     )
 
+    claims = over.add_mutually_exclusive_group()
+    claims.add_argument(
+        "--activity-claims",
+        dest="activity_claims_enabled",
+        action="store_true",
+        default=None,
+        help="read the trigger artifact's activity comment for another "
+        "instance's fresh spawn line and defer on it, so spawn dedupe "
+        "survives a ledger the local instance never wrote (the default)",
+    )
+    claims.add_argument(
+        "--no-activity-claims",
+        dest="activity_claims_enabled",
+        action="store_false",
+        help="ledger-only spawn dedupe: never read external claim evidence "
+        "(two overlapping instances can then both spawn on one item)",
+    )
+
     dry = over.add_mutually_exclusive_group()
     dry.add_argument(
         "--dry-run",
@@ -203,6 +221,7 @@ def overrides_from(args: argparse.Namespace) -> dict:
         "maintain_label": args.maintain_label,
         "maintain_enabled": args.maintain_enabled,
         "resume_enabled": args.resume_enabled,
+        "activity_claims_enabled": args.activity_claims_enabled,
         "dry_run": args.dry_run,
     }
 
@@ -234,13 +253,15 @@ def log_effective_config(config: Config, login: str) -> None:
     log.info("reviewers: %s", ", ".join(config.reviewers) or "none")
     log.info(
         "poll every %ss; dry_run=%s; attempt_cap=%s; stale after %s min; "
-        "max_sessions=%s; fix_rounds=%s; maintain=%s (label %r); resume=%s",
+        "max_sessions=%s; fix_rounds=%s; maintain=%s (label %r); resume=%s; "
+        "activity_claims=%s",
         config.poll_interval, config.dry_run, config.attempt_cap,
         config.stale_minutes,
         config.max_sessions or "unlimited",
         config.fix_rounds_enabled,
         config.maintain_enabled, config.maintain_label,
         config.resume_enabled,
+        config.activity_claims_enabled,
     )
     log.debug("hub_template: %s", config.hub_template)
     log.debug("agent_profile: %s", config.agent_profile)

{alissa_tools_github_devloop-0.6.0 → alissa_tools_github_devloop-0.6.2}/src/main/alissa/tools/github/devloop/config.py

@@ -63,6 +63,7 @@ CONFIG_KEYS = (
     "maintain_label",
     "maintain_enabled",
     "resume_enabled",
+    "activity_claims_enabled",
     "dry_run",
 )
 
@@ -180,6 +181,20 @@ class Config:
     # operator who wants a dead-with-PR lane to wait for a human.
     resume_enabled: bool = True
 
+    # Cross-instance spawn dedupe (issue #53): before spawning on any edge,
+    # read the trigger artifact's mechanical activity comment and treat a
+    # spawn line younger than stale_minutes as an in-flight claim EVEN when
+    # the local ledger has no row. The ledger is instance-local and its volume
+    # follows the active deployment, so during a deploy overlap or a
+    # crashloop two daemons run with one GitHub identity and two ledgers and
+    # both spawn; the activity comment is the one claim record either can
+    # read. Default ON -- it closes a thrice-observed duplicate-PR incident,
+    # it can only ever DEFER a spawn, and a claim expires with the same
+    # stale_minutes window a ledger row does. false restores the
+    # ledger-only dedupe: the escape hatch for a single-instance deployment
+    # that would rather not pay the extra comments fetch.
+    activity_claims_enabled: bool = True
+
     dry_run: bool = False
 
     # Derived at build time: `repos` casefolded for matching. GitHub names are
@@ -338,6 +353,9 @@ class Config:
             resume_enabled=bool(
                 raw.get("resume_enabled", cls.resume_enabled)
             ),
+            activity_claims_enabled=bool(
+                raw.get("activity_claims_enabled", cls.activity_claims_enabled)
+            ),
             dry_run=bool(raw.get("dry_run", cls.dry_run)),
         )
 

{alissa_tools_github_devloop-0.6.0 → alissa_tools_github_devloop-0.6.2}/src/main/alissa/tools/github/devloop/ghclient.py

@@ -821,6 +821,29 @@ class GitHub:
             if isinstance(c, dict)
         ]
 
+    def marked_comment(
+        self, owner: str, repo: str, number: int, marker: str
+    ) -> "IssueComment | None":
+        """THE own-authored comment carrying `marker` on this issue/PR, or None.
+
+        The find half of the activity comment's find-or-create, lifted out of
+        the writer so the READER shares one definition of "the daemon's
+        activity comment" with it -- a marker/author filter that drifted
+        between the two would let a spawn append to one comment while the
+        cross-instance claim check read another.
+
+        Both halves of the filter are load-bearing. The marker names the
+        mechanical log (an operator page on the same artifact must never be
+        mistaken for it), and OWN AUTHORSHIP is what keeps a marker anyone can
+        paste from being PATCHed by the writer -- or, for the reader, from
+        being able to park a lane by spoofing a claim line. First match wins,
+        matching the writer's `mine[0]`.
+        """
+        for comment in self.issue_comments(owner, repo, number):
+            if comment.author == self.login and marker in comment.body:
+                return comment
+        return None
+
     def update_comment(
         self, owner: str, repo: str, comment_id: int, body: str
     ) -> None:

{alissa_tools_github_devloop-0.6.0 → alissa_tools_github_devloop-0.6.2}/src/main/alissa/tools/github/devloop/loop.py

@@ -161,6 +161,35 @@ spams the comment; spawn lines self-dedupe on their own spawn ledger row. Being
 plain issue comments, they create no review records, never move the fix edge's
 author-activity liveness signal, and never register as operator escalations.
 
+That comment is also the loop's only CROSS-INSTANCE claim record, and since
+`activity_claims_enabled` (default true) it is READ as well as written. Every
+dedupe signal above this one is local (the ledger) or identity-scoped (the
+assignment), and neither can see the failure that produced three
+closed-as-duplicate PRs: during a deploy overlap or a crashloop window two
+daemon instances are briefly alive sharing ONE GitHub identity but not one
+ledger -- the state volume follows the active deployment -- so each reads an
+empty ledger, each believes it holds the only claim, and both spawn. The
+activity comment escapes both limits: it lives on the trigger artifact, so any
+instance can read any other's spawn line from the one place both already
+write. Before spawning on ANY edge, once the local ledger stops vouching for
+the lane, the daemon reads it: a spawn line younger than stale_minutes defers
+exactly like a live local claim, EVEN with no ledger row at all. A claim is
+matched by LANE (the session name minus its attempt segment, so the fix edge's
+round stays in and two instances numbering attempts differently still agree
+what is claimed) and tested on FRESHNESS ALONE -- never liveness, because a
+peer's sessions are not in this container's tmux and would read DEAD, which
+would defeat the entire signal. Past the window the claim expires and the
+stale/liveness matrix above governs untouched. The new signal is fail-open by
+construction: no comment, an unreadable one, a foreign author, a missing
+marker, a fetch that raises -- every one of them reads as "no claim" and
+restores the ledger-only behavior, because a gate that could latch a lane
+closed on a bad read would be worse than the double-spawn it prevents. This is
+also why the activity line is now written BEFORE the enqueue on all three
+edges rather than after: a claim published after the session exists does not
+cover the window it is for. The cost is a crash between the line and the
+enqueue leaving a claim with no session -- one stale window of deferral, then
+the line ages out and the next poll spawns normally.
+
 Finally, every pass runs the SESSION REAPER: finished `develop-*`/`fix-*`
 worker sessions otherwise idle in tmux forever (observed live on the reviewer
 daemon, 2026-07-22 -- and dev workers are worse, because they block through
@@ -184,6 +213,7 @@ spared, dry-run only logs, and kills are best-effort: a CLI without
 
 from __future__ import annotations
 
+import calendar
 import logging
 import re
 import time
@@ -520,6 +550,37 @@ ACTIVITY_HEADER = (
 # line is deduped per episode -- see deferral_activity_kind.
 ACTIVITY_DEFERRED = "deferred"
 
+# The reader's grammar for a line `_activity_line` wrote: bullet, UTC
+# timestamp, backticked session name, edge, context. The edge field is
+# non-greedy and em-dash-free so the CONTEXT keeps every em-dash it contains
+# ("deferred — at capacity", "re-enqueued — previous session presumed dead");
+# a line that does not match this shape is simply not read, which is the
+# fail-open direction (see external_claim).
+ACTIVITY_LINE_RE = re.compile(
+    r"^-\s+(?P<ts>\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}) UTC\s+—\s+"
+    r"`(?P<session>[^`]+)`\s+—\s+(?P<edge>[^—]*?)\s+—\s+(?P<context>.*)$"
+)
+
+# The trailing attempt segment every session name ends in. Stripping it turns
+# a session name into its LANE -- the (edge, artifact, and on the fix edge
+# round) identity that a claim is made against. Attempt-independent on
+# purpose: two instances with different ledgers disagree about the attempt
+# NUMBER while working the very same lane, and the lane is what must not be
+# double-claimed.
+ATTEMPT_SUFFIX_RE = re.compile(r"-a\d+$")
+
+# How far a claim line's timestamp may sit in the FUTURE and still be read.
+# The line is stamped by whichever instance wrote it, off ITS clock, and read
+# against ours, so a small forward skew is ordinary and must not make a real
+# claim unreadable -- inside the tolerance the age simply floors at 0 (the
+# line reads as brand new, the deferring direction). Beyond it the clock is
+# not plausibly a peer's: honouring such a line would park the lane for as
+# long as the bogus timestamp stays in the future, so it is dropped -- the
+# fail-open direction this whole signal is held to. A backward-skewed clock
+# needs no tolerance: its line simply looks older, and past stale_minutes it
+# stops claiming anything, exactly as an old line should.
+ACTIVITY_SKEW_TOLERANCE = 300
+
 
 # Escalation-ledger kinds. Cap-out, assignment-rejection, and a stalled
 # linked-PR deferral have different operator remedies (raise attempt_cap vs
@@ -920,6 +981,86 @@ def maintain_session_name(pr: PullRequest, attempt: int) -> str:
     return f"maintain-{owner}-{repo}-pr{pr.number}-a{attempt}"
 
 
+def activity_lane(session: str) -> str:
+    """A session name reduced to its LANE by dropping the attempt segment.
+
+    `develop-acme-widgets-i7-a3` -> `develop-acme-widgets-i7`;
+    `fix-acme-widgets-pr16-r2-a1` -> `fix-acme-widgets-pr16-r2` (the ROUND
+    stays: the fix ledger dedupes per round, so a claim must too);
+    `maintain-acme-widgets-pr16-a1` -> `maintain-acme-widgets-pr16`.
+
+    The lane is what a spawn claims. Attempt numbers come from a LOCAL ledger,
+    and the whole point of reading another instance's spawn line is that its
+    ledger is not ours -- it can be on attempt 1 of a lane we would number 3.
+    Comparing lanes rather than names is what lets the two agree on what is
+    already claimed. A name without an attempt segment is returned unchanged
+    and so simply matches nothing (no lane the daemon ever spawns lacks one).
+    """
+    return ATTEMPT_SUFFIX_RE.sub("", session)
+
+
+def parse_activity_timestamp(ts: str) -> "int | None":
+    """An activity line's `%Y-%m-%d %H:%M:%S` UTC stamp as unix seconds, or
+    None when it is not a real instant.
+
+    `_activity_line` writes UTC via `time.gmtime`, so the read is `timegm`,
+    never `mktime` -- reading a UTC stamp through the host's local timezone
+    would shift every claim by the offset and, east of Greenwich, make fresh
+    lines look future-dated. The mirror of ghclient.parse_github_timestamp
+    (different format, same contract: unreadable is None, never an error).
+    """
+    try:
+        return calendar.timegm(time.strptime(ts, "%Y-%m-%d %H:%M:%S"))
+    except (ValueError, TypeError):
+        return None
+
+
+@dataclass(frozen=True, slots=True)
+class ActivityClaim:
+    """One readable spawn record from the activity comment: a session name, the
+    instant its line was written, and how old that is against OUR clock (never
+    negative -- see ACTIVITY_SKEW_TOLERANCE)."""
+
+    session: str
+    at: int
+    age: float
+
+
+def activity_claims(body: str, now: "float | None" = None) -> "list[ActivityClaim]":
+    """Every readable SPAWN record in an activity comment's body.
+
+    Spawn records only: a capacity-deferral line explicitly claims nothing (no
+    self-assign, no ledger row, no session -- see _spawn's gate), so reading
+    one as a claim would let a deferring instance park the lane against
+    everybody including itself. The context field is what tells them apart,
+    and `deferred` is the only context that is not a spawn.
+
+    Everything else fails open, one line at a time: a line that does not match
+    the grammar, or whose stamp is not an instant, or whose stamp is
+    implausibly far in the future is dropped and the remaining lines are still
+    read. A comment that is entirely unreadable therefore yields no claims,
+    which is exactly "behave as before" on the new signal.
+    """
+    now = time.time() if now is None else now
+    claims: "list[ActivityClaim]" = []
+    for raw in (body or "").splitlines():
+        match = ACTIVITY_LINE_RE.match(raw.strip())
+        if match is None:
+            continue
+        if match.group("context").strip().lower().startswith(ACTIVITY_DEFERRED):
+            continue
+        at = parse_activity_timestamp(match.group("ts"))
+        if at is None:
+            continue
+        age = now - at
+        if age < -ACTIVITY_SKEW_TOLERANCE:
+            continue
+        claims.append(
+            ActivityClaim(session=match.group("session"), at=at, age=max(age, 0.0))
+        )
+    return claims
+
+
 def no_envelope_verdict(owner: str, repo: str, number: int) -> "str | None":
     """The default (stub) envelope tie-breaker: no verdict is ever readable.
 
@@ -1026,6 +1167,29 @@ class DevWatcher:
                 session=session_name(issue, attempts),
             )
 
+        # The one dedupe signal that survives an instance change, consulted
+        # the moment the LOCAL ledger stops vouching for the lane (no row, or
+        # a row already past the window): another instance's fresh spawn line
+        # on this issue's own activity comment. It sits ABOVE the
+        # self-assigned-outside guard on purpose. Both branches describe an
+        # issue marked in flight with nothing local to show for it, but their
+        # operator remedies are OPPOSITE -- that guard's message asks the
+        # operator to UNASSIGN, which against a peer instance's live claim
+        # would clear the only other marker and invite the very double-spawn
+        # this closes. The claim is the more specific diagnosis, so it answers
+        # first. The cost is one comments fetch per poll on an issue nothing
+        # local claims; the fresh-in-flight return above keeps it off the
+        # common case, exactly as the linked-PR probe is kept off it.
+        claim = self.external_claim(
+            issue.owner,
+            issue.repo,
+            issue.number,
+            session_name(issue, attempts + 1),
+            issue.issue_slug,
+        )
+        if claim is not None:
+            return self._claim_deferral(claim, attempts)
+
         if login in issue.assignees and age is None:
             # Self-assigned but the ledger never spawned: assigned outside this
             # daemon (by hand, or under another workspace's ledger). Not a
@@ -1305,27 +1469,29 @@ class DevWatcher:
             except AssignmentRejected as exc:
                 return self._escalate_rejection(issue, exc)
 
-        self.alissa.enqueue_developer(
-            session=name,
-            directive=directive,
-            cwd=hub,
-            agent=self.config.agent_profile,
-            dry_run=self.config.dry_run,
-        )
-
-        if not self.config.dry_run:
-            self.state.record_spawn(
-                repo_slug=issue.full_name,
-                issue=issue.number,
-                attempt=attempt,
-                session=name,
-            )
-
-        # AFTER the spawn side effects on purpose: the activity comment is
-        # telemetry and must never gate the spawn it reports on. A resume
-        # names the confirmation that unblocked it (an operator reading the
-        # issue must be able to tell a proven-dead resume from a timer-only
-        # retry); a plain retry says presumed; attempt 1 is a plain spawn.
+        # BEFORE the enqueue, not after (issue #53). The line stopped being
+        # only telemetry the moment `external_claim` started reading it: it is
+        # now this spawn's CROSS-INSTANCE claim, the one marker a peer daemon
+        # with its own ledger can see, and a claim published after the session
+        # exists leaves the window it is meant to close wide open -- the whole
+        # gap is the seconds between deciding to spawn and the record of it
+        # becoming visible. Publish first, then enqueue.
+        #
+        # The crash story is why this is safe to reorder. A crash between the
+        # line and the enqueue leaves a claim with no session behind it: this
+        # lane then defers for ONE stale window, after which the line ages out
+        # of the freshness test and the next poll spawns normally. That is
+        # bounded, self-healing, and strictly cheaper than the failure the
+        # other order permits (two live sessions, two PRs, two review loops,
+        # one closed as a duplicate). Nothing else moved: the assignment still
+        # lands first (it is the issue edge's server-side marker), the line is
+        # still best-effort -- `_append_activity` swallows its failures and a
+        # failed line never gates the spawn -- and still fully dry-run gated.
+        #
+        # A resume names the confirmation that unblocked it (an operator
+        # reading the issue must be able to tell a proven-dead resume from a
+        # timer-only retry); a plain retry says presumed; attempt 1 is a plain
+        # spawn.
         if resume_pr is not None:
             context = (
                 f"resumed — previous session confirmed dead (absent from the "
@@ -1344,6 +1510,22 @@ class DevWatcher:
             issue.issue_slug,
         )
 
+        self.alissa.enqueue_developer(
+            session=name,
+            directive=directive,
+            cwd=hub,
+            agent=self.config.agent_profile,
+            dry_run=self.config.dry_run,
+        )
+
+        if not self.config.dry_run:
+            self.state.record_spawn(
+                repo_slug=issue.full_name,
+                issue=issue.number,
+                attempt=attempt,
+                session=name,
+            )
+
         resumed = (
             ""
             if resume_pr is None
@@ -1743,6 +1925,26 @@ class DevWatcher:
                 round=round_,
             )
 
+        # The cross-instance claim check, the issue edge's placement
+        # transposed: past the fresh-in-flight return, the local ledger no
+        # longer vouches for this round, and a peer instance's fresh spawn
+        # line on THIS PR's activity comment is the only thing that can. The
+        # lane is round-scoped (activity_lane keeps the `-r<k>` segment), so a
+        # claim on round k never suppresses round k+1 -- the fix ledger
+        # dedupes per round and the external evidence must match it. This edge
+        # needs the signal most: it has no assignment analogue at all (PR
+        # authorship is the marker, and both instances share the identity that
+        # authored it), so before this the ledger was the ONLY dedupe it had.
+        claim = self.external_claim(
+            pr.owner,
+            pr.repo,
+            pr.number,
+            fix_session_name(pr, round_, attempts + 1),
+            pr.pr_slug,
+        )
+        if claim is not None:
+            return self._claim_deferral(claim, attempts, round_=round_)
+
         # Fix-retry staleness needs TWO signals, the issue edge's doctrine
         # verbatim (see the linked-PR probe in evaluate()): the ledger timer
         # says the newest fix spawn is old, but elapsed time alone cannot
@@ -2093,6 +2295,36 @@ class DevWatcher:
             dead_session=dead_session,
         )
 
+        # BEFORE the enqueue (issue #53), for the reason _spawn spells out:
+        # the line is this spawn's cross-instance claim, and a claim published
+        # after the session exists does not close the window it is for. On
+        # this edge the argument is sharper still -- there is no
+        # self-assignment to fall back on (the PR's authorship IS the marker,
+        # and both instances share the identity that authored it), so this
+        # line is the ONLY thing a peer daemon can read. Same crash story: a
+        # crash between the line and the enqueue costs one stale window of
+        # deferral on this round, then the line ages out and the retry
+        # proceeds. The line stays best-effort and dry-run gated.
+        #
+        # The session name carries the round and attempt; the context marks a
+        # retry, and names the confirmation when a resume is what unblocked it.
+        if dead_session is not None:
+            context = (
+                "resumed — previous session confirmed dead (absent from the "
+                "tmux listing); finishing the round on the same branch"
+            )
+        elif reenqueued:
+            context = "re-enqueued — previous session presumed dead"
+        else:
+            context = "spawned"
+        self._append_activity(
+            pr.owner,
+            pr.repo,
+            pr.number,
+            self._activity_line(name, "fix edge", context),
+            pr.pr_slug,
+        )
+
         # No self-assignment here: the PR's authorship IS the server-side
         # marker (the token already owns it), and the in-flight signal is the
         # fix ledger row plus, once the session re-requests, the pending
@@ -2114,26 +2346,6 @@ class DevWatcher:
                 session=name,
             )
 
-        # AFTER the spawn side effects: telemetry, never a gate. The session
-        # name carries the round and attempt; the context marks a retry, and
-        # names the confirmation when a resume is what unblocked it.
-        if dead_session is not None:
-            context = (
-                "resumed — previous session confirmed dead (absent from the "
-                "tmux listing); finishing the round on the same branch"
-            )
-        elif reenqueued:
-            context = "re-enqueued — previous session presumed dead"
-        else:
-            context = "spawned"
-        self._append_activity(
-            pr.owner,
-            pr.repo,
-            pr.number,
-            self._activity_line(name, "fix edge", context),
-            pr.pr_slug,
-        )
-
         resumed = (
             f" — RESUMING the round after {dead_session} was confirmed dead"
             if dead_session is not None
@@ -2205,6 +2417,23 @@ class DevWatcher:
                 session=maintain_session_name(pr, attempts),
             )
 
+        # The cross-instance claim check, before the epoch re-basing: whether
+        # this request's budget is fresh or re-based, a peer instance that
+        # already spawned against the SAME standing label must not be spawned
+        # over. Like the fix edge, this edge has no assignment analogue (the
+        # label is the operator's ask, not a per-instance claim, and it stays
+        # put until the maintenance session removes it), so the activity
+        # comment is its only cross-instance evidence.
+        claim = self.external_claim(
+            pr.owner,
+            pr.repo,
+            pr.number,
+            maintain_session_name(pr, attempts + 1),
+            pr.pr_slug,
+        )
+        if claim is not None:
+            return self._claim_deferral(claim, attempts)
+
         # Stale path with history: re-base the budget on the current
         # request. An unreadable boundary (no visible labeled event, or an
         # unparseable timestamp) conservatively leaves the lifetime budget
@@ -2321,6 +2550,27 @@ class DevWatcher:
             session=name,
         )
 
+        # BEFORE the enqueue (issue #53), for the reason _spawn spells out:
+        # the line is this spawn's cross-instance claim, and this edge, like
+        # the fix edge, has no per-instance server-side marker to fall back on
+        # -- the label is the OPERATOR's standing ask and stays put until the
+        # maintenance session removes it, so it says nothing about which
+        # instance already took it. Same crash story, same one-stale-window
+        # cost; the line stays best-effort and dry-run gated. The session name
+        # carries the attempt; the context marks a retry.
+        context = (
+            "re-enqueued — previous session presumed dead"
+            if reenqueued
+            else "spawned"
+        )
+        self._append_activity(
+            pr.owner,
+            pr.repo,
+            pr.number,
+            self._activity_line(name, "maintain edge", context),
+            pr.pr_slug,
+        )
+
         # No self-assignment (authorship is the marker, like the fix edge)
         # and NO label removal: remove-on-completion is the design decision.
         # The label stays as the visible in-flight state; the ledger row
@@ -2341,21 +2591,6 @@ class DevWatcher:
                 session=name,
             )
 
-        # AFTER the spawn side effects: telemetry, never a gate. The session
-        # name carries the attempt; the context marks a retry.
-        context = (
-            "re-enqueued — previous session presumed dead"
-            if reenqueued
-            else "spawned"
-        )
-        self._append_activity(
-            pr.owner,
-            pr.repo,
-            pr.number,
-            self._activity_line(name, "maintain edge", context),
-            pr.pr_slug,
-        )
-
         return Decision(
             Action.SPAWNED,
             f"maintenance session {name} (label {self.config.maintain_label!r} "
@@ -2431,14 +2666,10 @@ class DevWatcher:
             log.info("[dry-run] would append activity line on %s: %s", slug, line)
             return False
         try:
-            mine = [
-                c
-                for c in self.github.issue_comments(owner, repo, number)
-                if c.author == self.github.login and ACTIVITY_MARKER in c.body
-            ]
-            if mine:
+            mine = self.github.marked_comment(owner, repo, number, ACTIVITY_MARKER)
+            if mine is not None:
                 self.github.update_comment(
-                    owner, repo, mine[0].id, mine[0].body + "\n" + line
+                    owner, repo, mine.id, mine.body + "\n" + line
                 )
             else:
                 self.github.comment(
@@ -2449,6 +2680,109 @@ class DevWatcher:
             return False
         return True
 
+    def external_claim(
+        self, owner: str, repo: str, number: int, session: str, slug: str
+    ) -> "ActivityClaim | None":
+        """Has ANOTHER instance already claimed this lane? The newest fresh
+        spawn line on the trigger artifact's activity comment, or None.
+
+        The local ledger is an instance-local file on a volume that follows
+        the active deployment, so during a deploy overlap or a crashloop two
+        daemons are briefly alive sharing one GitHub identity and NOT one
+        ledger: each reads an empty ledger, each believes it holds the only
+        claim, and both spawn (observed three times -- orc #7, #13 and #16 all
+        produced closed-as-duplicate PRs). Nothing local can see that, and
+        GitHub assignment cannot dedupe it either, because the two instances
+        ARE the same login. The activity comment can: it is written
+        mechanically at every spawn, on the trigger artifact itself, so any
+        instance can read any other instance's claim from the one place both
+        of them already write. External truth for claims is what makes spawn
+        dedupe survive a volume handoff, an overlapping deploy, or ledger loss
+        outright.
+
+        FRESH is `stale_minutes` measured from the line's own timestamp -- the
+        same window the ledger's rows are aged by, so a claim expires exactly
+        as a local spawn row does and a dead foreign session cannot park the
+        lane forever. Past it this returns None and the existing stale /
+        liveness matrix (resume path included) governs untouched.
+
+        Liveness is deliberately NOT consulted for the session on the line.
+        The tmux roster is this container's; a peer instance's sessions are
+        not in it and would read DEAD -- taking that as permission to respawn
+        would defeat the entire signal. Freshness is the only test a claim
+        gets.
+
+        Fail-open, always, on this signal alone: no marker comment, an
+        unreadable one, a comment fetch that raises (the broad except mirrors
+        `_append_activity` -- `_api` raises RateLimited, not CommandError) all
+        return None, which is precisely today's behavior. This gate can only
+        ever DEFER a spawn, so a false positive parks a lane for one stale
+        window while a false negative is the double-spawn it exists to
+        prevent -- but a signal that could latch a lane closed on a bad read
+        would be worse than the bug, so it never fails closed.
+
+        NOT dry-run gated: reading is free of side effects, and a dry pass has
+        to reach the same decisions the real one would.
+        """
+        if not self.config.activity_claims_enabled:
+            return None
+        lane = activity_lane(session)
+        try:
+            comment = self.github.marked_comment(
+                owner, repo, number, ACTIVITY_MARKER
+            )
+        except Exception as exc:
+            log.warning(
+                "could not read the activity comment on %s (%s) — no external "
+                "claim evidence this poll",
+                slug,
+                exc,
+            )
+            return None
+        if comment is None:
+            return None
+
+        window = self.config.stale_minutes * 60
+        newest: "ActivityClaim | None" = None
+        for claim in activity_claims(comment.body):
+            if activity_lane(claim.session) != lane:
+                continue
+            if claim.age >= window:
+                continue
+            if self.state.knows_session(claim.session):
+                # This daemon's OWN past spawn, read back off the shared
+                # record. Its ledger row is the authoritative clock for it and
+                # the matrix above has already weighed that row; treating the
+                # line as foreign evidence would let the daemon defer behind
+                # itself -- and, because the line never ages differently from
+                # the row it was written beside, it could only ever say what
+                # the ledger just said. EXTERNAL means "a spawn this ledger has
+                # no memory of", which is exactly the ledger-loss, volume-
+                # handoff and overlapping-deploy cases this exists for.
+                continue
+            if newest is None or claim.at > newest.at:
+                newest = claim
+        return newest
+
+    def _claim_deferral(
+        self, claim: "ActivityClaim", attempts: int, round_: "int | None" = None
+    ) -> Decision:
+        """The IN_FLIGHT decision an external claim produces. IN_FLIGHT, not
+        SKIPPED or DEFERRED: the work IS in flight, just under another
+        instance's ledger, and like every other in-flight return this one
+        claims nothing locally -- no assignment, no ledger row -- so the item
+        stays a clean candidate the moment the claim ages out."""
+        return Decision(
+            Action.IN_FLIGHT,
+            f"another daemon instance recorded a spawn on this lane "
+            f"{int(claim.age / 60)} min ago (`{claim.session}`, on the "
+            f"mechanical activity comment) and the local ledger has no fresh "
+            f"row — external claim evidence; not double-spawning",
+            attempts,
+            session=claim.session,
+            round=round_,
+        )
+
     def _log_deferral(
         self,
         owner: str,

{alissa_tools_github_devloop-0.6.0 → alissa_tools_github_devloop-0.6.2}/src/main/alissa/tools/github/devloop/state.py

@@ -236,6 +236,31 @@ class State:
         ).fetchone()
         return None if row is None else row["session"]
 
+    def knows_session(self, session: str) -> bool:
+        """Has THIS ledger ever recorded a spawn under this session name?
+
+        The question the cross-instance claim check asks of every spawn line it
+        reads on an activity comment (loop.DevWatcher.external_claim). The
+        comment is a shared record: a spawn line is only EXTERNAL evidence when
+        this instance has no memory of writing it -- otherwise it is this
+        daemon's own past spawn, whose ledger row already carries the
+        authoritative clock, and reading it back as a foreign claim would let
+        the daemon defer behind itself.
+
+        Deliberately NOT edge- or artifact-scoped: session names are globally
+        unique by construction (each edge's builder folds in its own prefix,
+        the owner/repo, the number, and the attempt), so one lookup across the
+        three spawn ledgers answers it for every edge without a caller having
+        to say which one it is asking about.
+        """
+        row = self._db.execute(
+            "SELECT 1 AS hit FROM spawns WHERE session=? "
+            "UNION ALL SELECT 1 FROM fix_spawns WHERE session=? "
+            "UNION ALL SELECT 1 FROM maintain_spawns WHERE session=? LIMIT 1",
+            (session, session, session),
+        ).fetchone()
+        return row is not None
+
     def record_fix_spawn(
         self, *, repo_slug: str, number: int, round_: int, attempt: int, session: str
     ) -> None:

alissa_tools_github_devloop-0.6.2/src/main/alissa/tools/github/devloop/version

@@ -0,0 +1 @@
+0.6.2

{alissa_tools_github_devloop-0.6.0 → alissa_tools_github_devloop-0.6.2}/src/main/alissa/tools/github/devloop/webui/sources.py

@@ -324,6 +324,7 @@ class Sources:
             "fix_rounds_enabled": c.fix_rounds_enabled,
             "maintain_enabled": c.maintain_enabled,
             "resume_enabled": c.resume_enabled,
+            "activity_claims_enabled": c.activity_claims_enabled,
             "reviewers": list(c.reviewers),
             "agent_profile": c.agent_profile,
             "state_db": str(c.state_db),

{alissa_tools_github_devloop-0.6.0 → alissa_tools_github_devloop-0.6.2/src/main/alissa_tools_github_devloop.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: alissa-tools-github-devloop
-Version: 0.6.0
+Version: 0.6.2
 Summary: ALISSA-TOOLS-GITHUB-DEVLOOP
 Home-page: https://alissa.app
 Author: Fahera

alissa_tools_github_devloop-0.6.0/src/main/alissa/tools/github/devloop/version

@@ -1 +0,0 @@
-0.6.0