alissa-tools-github-devloop 0.8.22__py3-none-any.whl → 0.8.24__py3-none-any.whl

alissa/tools/github/devloop/hubs.py

@@ -0,0 +1,427 @@
+"""Hub trust: keeping Claude Code's per-directory "trust this folder?" gate
+pre-accepted for every directory a dev session may start in (issue #123).
+
+Claude Code asks, once per directory, whether the folder it was started in is
+trusted -- and `--dangerously-skip-permissions` does NOT suppress that
+dialog. A headless session that meets it hangs: the directive `alissa tmux
+queue` types into the pane is swallowed by the prompt, the session sits in
+the roster reading ALIVE, and the daemon's liveness discipline (correctly)
+declines to respawn over a listed session. Observed 2026-09-16 on
+`dark-devloop-shared`: 108 minutes on `ali-fhr/docs.alissa.app#10`, until an
+operator accepted the dialog by hand.
+
+The container entrypoint seeds the gate at boot for the hubs it can NAME at
+boot: `{root}/{basename}` for every entry in `ALISSA_DEV_REPOS`, plus every
+hub already on disk. Under `repos_source: bows` `ALISSA_DEV_REPOS` is empty
+-- the allowlist is DERIVED from the feed Bodies of Work at runtime -- so a
+repo hub-ified after boot was never trusted. This module closes that gap
+from the daemon's side, in three places the loop calls:
+
+* after every successful feed refresh: the derived list is written to
+  `{root}/.alissa-derived-repos` (`DERIVED_REPOS_FILENAME`) so the NEXT boot's
+  entrypoint seeding can read it, and the derived hubs are trusted right
+  away, hub-ified or not (trusting a path that does not exist yet is exactly
+  what the entrypoint already does for the static allowlist);
+* at hub-ify time and before every spawn (`DevWatcher._ensure_hub`): the hub
+  root, `{hub}/main`, and every `{hub}/TASK-*` worktree on disk;
+* after a first-run-dialog wedge kill: the hub the wedged session started in,
+  so the re-enqueued attempt does not meet the same prompt.
+
+The merge is the entrypoint's, transposed: load-then-update of
+`~/.claude.json` and `$CLAUDE_CONFIG_DIR/.claude.json` (when set --
+`CLAUDE_CONFIG_DIR` reliably relocates only the credential file, so both
+targets are written and whichever claude reads carries the flag), only ever
+ADDING `projects[<path>].hasTrustDialogAccepted = true`. Idempotent: a target
+that already carries every entry is not rewritten at all, which is also what
+keeps the daemon's writes off a file Claude Code itself rewrites -- the only
+time this module touches the file is when a NEW directory has to be
+trusted. That write is guarded on three sides, because Claude Code itself
+rewrites the same file while sessions run (`_trust_hub` runs before EVERY
+spawn, and the `TASK-*` glob makes most of those writes real ones): the
+temp-file + rename keeps a concurrent READER from ever seeing a torn file;
+a compare-and-swap immediately before the rename (the file must still hold
+the bytes the merge was computed from) keeps the OTHER WRITER's update
+from being discarded wholesale -- the payload is the whole file, so a lost
+update could drop another session's `projects` entries or the persisted
+login; and a re-read after the rename catches a writer that landed right
+after ours and dropped OUR entries. Either miss restarts the merge on top
+of the newer file, a bounded number of times, and giving up is one WARNING.
+Never raises: trust is a convenience for the session about to spawn, and a
+failed write is one WARNING, never a lost poll.
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+import os
+import re
+from pathlib import Path
+from typing import Iterable, Sequence
+
+log = logging.getLogger(__name__)
+
+# The file the daemon writes the derived (bows-mode) allowlist to, under the
+# workspace root, one `owner/repo` per line -- and the file the entrypoint's
+# first-run seeding reads at the NEXT boot (`ALISSA_DERIVED_REPOS_FILE`
+# overrides the location on both sides).
+DERIVED_REPOS_FILENAME = ".alissa-derived-repos"
+ENV_DERIVED_REPOS_FILE = "ALISSA_DERIVED_REPOS_FILE"
+
+# The state file Claude Code keeps its per-directory trust in, relative to
+# $HOME and to $CLAUDE_CONFIG_DIR.
+CLAUDE_STATE_FILENAME = ".claude.json"
+ENV_CLAUDE_CONFIG_DIR = "CLAUDE_CONFIG_DIR"
+TRUST_KEY = "hasTrustDialogAccepted"
+
+# What a pane PARKED on one of Claude Code's first-run gates shows -- and
+# what corroborates that it is parked there rather than merely mentioning
+# it (PR #124 review round 1). The gates' words are quoted by this repo's
+# README, CHANGELOG, this module and issue #123, so a session that cats any
+# of them, greps the tree or shows its own diff has them on screen while at
+# work -- and a match kills the session. The classifier therefore asks for
+# the gate's SHAPE, not its vocabulary (see `pane_shows_first_run_dialog`):
+#
+# * the gate's ACCEPT option (`FIRST_RUN_DIALOG_OPTIONS`) is one of the last
+#   `FIRST_RUN_DIALOG_TAIL_LINES` non-blank lines of the capture, once the
+#   selection cursor, option numbering and box drawing are stripped;
+# * nothing follows it but the gate's own chrome (`FIRST_RUN_DIALOG_CHROME`):
+#   a session that printed ANYTHING after the text -- a spinner, a tool
+#   call, the `>` input prompt an idle session sits at, a shell prompt --
+#   is not on the gate;
+# * the gate's QUESTION (`FIRST_RUN_DIALOG_MARKERS`) appears at or above
+#   the option line.
+#
+# The trust dialog reads "Quick safety check: Is this a project you created
+# or one you trust? … ❯ No, exit / Yes, I trust this folder"; the
+# bypass-permissions gate reads "WARNING: Claude Code running in Bypass
+# Permissions mode … No, exit / Yes, I accept" (either option order, with
+# or without numbering, an optional "Enter to confirm · Esc to exit" footer
+# and box drawing). Both are gates the entrypoint's seeding is meant to
+# pre-answer, so a pane parked on either is a session the seeding missed,
+# not a session at work.
+FIRST_RUN_DIALOG_MARKERS = (
+    "trust this folder",
+    "bypass permissions mode",
+)
+FIRST_RUN_DIALOG_OPTIONS = (
+    "yes, i trust this folder",
+    "yes, i accept",
+)
+FIRST_RUN_DIALOG_CHROME = (
+    "no, exit",
+    "enter to confirm",
+)
+FIRST_RUN_DIALOG_TAIL_LINES = 6
+
+# What a gate draws AROUND its text: box drawing, the selection cursor and
+# whitespace (stripped from both ends of a line), then "1." / "2)" option
+# numbering. Nothing else is stripped -- a diff's `+`, a markdown bullet,
+# a quote's backtick and the `>` of Claude Code's input prompt all stay,
+# which is what keeps a line that merely quotes a gate from reading as one.
+_DIALOG_DECORATION = "❯ \t│┃║╭╮╰╯┌┐└┘├┤┬┴┼─━═"
+_DIALOG_NUMBERING = re.compile(r"^\d+[.)]\s*")
+
+# How many times `seed_trust` restarts a merge that another writer moved
+# the file under (see the module docstring) before it gives up with a
+# WARNING. Claude Code's own rewrites are bursts around a session's start
+# and end, not a stream, so a second pass is expected to land.
+SEED_TRUST_ATTEMPTS = 3
+
+# The wedge classification the loop logs and records for a stale session
+# whose pane shows one of those gates.
+WEDGE_FIRST_RUN_DIALOG = "wedged:first-run-dialog"
+
+
+def claude_state_targets(
+    home: "Path | str | None" = None, config_dir: "Path | str | None" = None
+) -> "list[Path]":
+    """The `.claude.json` files to merge trust into: `$HOME/.claude.json`,
+    plus `$CLAUDE_CONFIG_DIR/.claude.json` when that variable is set and
+    non-blank. Both arguments default to the environment (`~` expansion
+    honours `HOME`), which is what lets a test point the merge at scratch
+    directories without touching the daemon's own files."""
+    home_dir = Path(home) if home is not None else Path(os.path.expanduser("~"))
+    targets = [home_dir / CLAUDE_STATE_FILENAME]
+    raw = (
+        str(config_dir)
+        if config_dir is not None
+        else os.environ.get(ENV_CLAUDE_CONFIG_DIR, "")
+    ).strip()
+    if raw:
+        extra = Path(raw) / CLAUDE_STATE_FILENAME
+        if extra != targets[0]:
+            targets.append(extra)
+    return targets
+
+
+def hub_trust_paths(hub: "Path | str") -> "list[Path]":
+    """Every directory a session on this hub may START in: the hub root
+    (where develop/fix/maintain sessions are spawned), `{hub}/main`, and each
+    `{hub}/TASK-*` worktree already on disk (a retried or resumed attempt may
+    be started inside a surviving worktree). The root and `main` are listed
+    whether or not they exist yet -- the point of seeding is to be there
+    BEFORE the directory is used."""
+    root = Path(hub)
+    paths = [root, root / "main"]
+    try:
+        worktrees = sorted(
+            p for p in root.glob("TASK-*") if p.is_dir()
+        )
+    except OSError:
+        worktrees = []
+    paths.extend(worktrees)
+    return paths
+
+
+def _load_state(path: Path) -> "tuple[str | None, dict]":
+    """The state file's raw text (None when absent) and its parsed object
+    (`{}` when absent or not a JSON object). Only ABSENCE is folded into
+    "start fresh": an unparseable file raises `ValueError` up to
+    `seed_trust`, which skips that target rather than replacing it (a
+    corrupt state file is never silently overwritten). The raw text is what
+    `_write_atomic` compares against before its rename."""
+    try:
+        with open(path, encoding="utf-8") as fh:
+            raw = fh.read()
+    except FileNotFoundError:
+        return None, {}
+    data = json.loads(raw)
+    return raw, (data if isinstance(data, dict) else {})
+
+
+def _raw_text(path: Path) -> "str | None":
+    try:
+        return path.read_text(encoding="utf-8")
+    except FileNotFoundError:
+        return None
+
+
+def _write_atomic(path: Path, data: dict, expected: "str | None") -> bool:
+    """Write `data` over `path` by temp file + rename -- unless the file no
+    longer holds `expected` (the raw text the caller merged from), in which
+    case nothing is replaced and False is returned so the caller merges
+    again on top of whoever wrote in between. The rename keeps READERS
+    safe (never a torn file); the check before it keeps the OTHER WRITER's
+    update safe, down to the gap between the check and the rename."""
+    path.parent.mkdir(parents=True, exist_ok=True)
+    tmp = path.with_name(path.name + ".tmp")
+    with open(tmp, "w", encoding="utf-8") as fh:
+        json.dump(data, fh, indent=2)
+        fh.write("\n")
+    if _raw_text(path) != expected:
+        tmp.unlink(missing_ok=True)
+        return False
+    os.replace(tmp, path)
+    return True
+
+
+def _add_trust(state: dict, wanted: "list[str]") -> "list[str]":
+    """Merge `projects[<path>].hasTrustDialogAccepted = true` for every
+    wanted path into `state` (in place, repairing a missing or non-object
+    `projects`). Returns the paths that were NOT already trusted."""
+    projects = state.get("projects")
+    if not isinstance(projects, dict):
+        projects = {}
+        state["projects"] = projects
+    added = []
+    for p in wanted:
+        entry = projects.get(p)
+        if not isinstance(entry, dict):
+            entry = {}
+            projects[p] = entry
+        if entry.get(TRUST_KEY) is not True:
+            entry[TRUST_KEY] = True
+            added.append(p)
+    return added
+
+
+def _untrusted(state: dict, wanted: "list[str]") -> "list[str]":
+    projects = state.get("projects")
+    if not isinstance(projects, dict):
+        return list(wanted)
+    return [
+        p for p in wanted
+        if not isinstance(projects.get(p), dict)
+        or projects[p].get(TRUST_KEY) is not True
+    ]
+
+
+def _merge_target(target: Path, wanted: "list[str]") -> bool:
+    """Merge `wanted` into ONE claude state file. True when the file was
+    written. Load, merge, compare-and-swap, verify -- and start over, up to
+    SEED_TRUST_ATTEMPTS times, whenever another writer moved the file
+    between the load and the rename (the swap refuses) or right after the
+    rename (the verify finds an entry missing). Never raises."""
+    wrote = False
+    for _ in range(SEED_TRUST_ATTEMPTS):
+        try:
+            raw, state = _load_state(target)
+        except (OSError, ValueError) as exc:
+            if wrote:
+                # Our write landed; whoever replaced it since left something
+                # this daemon will not touch. Nothing more to do here.
+                log.debug("trust: %s unreadable after the merge (%s)", target, exc)
+                return True
+            log.warning(
+                "trust: could not read %s (%s) — leaving it untouched; the "
+                "directories are NOT pre-trusted there: %s",
+                target, exc, ", ".join(wanted),
+            )
+            return False
+        added = _add_trust(state, wanted)
+        if not added:
+            # Every entry is present: it always was, or the pass before
+            # this one landed and survived.
+            return wrote
+        try:
+            swapped = _write_atomic(target, state, raw)
+        except OSError as exc:
+            log.warning(
+                "trust: could not write %s (%s) — the directories are NOT "
+                "pre-trusted there: %s", target, exc, ", ".join(added),
+            )
+            return wrote
+        if not swapped:
+            log.info(
+                "trust: %s changed underneath the merge — merging %s again "
+                "on top of the newer file", target, ", ".join(added),
+            )
+            continue
+        wrote = True
+        try:
+            _, after = _load_state(target)
+        except (OSError, ValueError) as exc:
+            log.debug("trust: %s unreadable right after the merge (%s)", target, exc)
+            return True
+        missing = _untrusted(after, wanted)
+        if not missing:
+            log.debug("trust: %s now pre-trusts %s", target, ", ".join(added))
+            return True
+        log.info(
+            "trust: %s was rewritten right after the merge and lost %s — "
+            "merging again", target, ", ".join(missing),
+        )
+    log.warning(
+        "trust: gave up merging into %s after %d attempts — another writer "
+        "kept rewriting it, so the directories may NOT be pre-trusted there: %s",
+        target, SEED_TRUST_ATTEMPTS, ", ".join(wanted),
+    )
+    return wrote
+
+
+def seed_trust(
+    paths: "Iterable[Path | str]",
+    *,
+    home: "Path | str | None" = None,
+    config_dir: "Path | str | None" = None,
+) -> "list[Path]":
+    """Merge `projects[<path>].hasTrustDialogAccepted = true` for every path
+    into every claude state target. Returns the targets that were WRITTEN
+    (a target already carrying every entry is left untouched -- byte for
+    byte, no rewrite). Never raises and never removes anything: an
+    unparseable target is skipped with a WARNING rather than replaced, a
+    failed write is a WARNING too, and a target another writer keeps
+    moving under the merge is retried a bounded number of times (see
+    `_merge_target` and the module docstring) before that, too, is one
+    WARNING.
+
+    Paths are recorded as absolute strings, which is how Claude Code keys
+    them; a relative path is resolved against the cwd, which is never what a
+    caller means, so callers pass absolute hubs."""
+    wanted = [os.fspath(Path(p)) for p in paths]
+    changed: "list[Path]" = []
+    if not wanted:
+        return changed
+    for target in claude_state_targets(home, config_dir):
+        if _merge_target(target, wanted):
+            changed.append(target)
+    return changed
+
+
+def derived_repos_path(root: "Path | str") -> Path:
+    """Where the derived allowlist is written under this workspace root, or
+    wherever `ALISSA_DERIVED_REPOS_FILE` points (the same override the
+    entrypoint honours, so an operator relocating one relocates both)."""
+    override = os.environ.get(ENV_DERIVED_REPOS_FILE, "").strip()
+    if override:
+        return Path(override)
+    return Path(root) / DERIVED_REPOS_FILENAME
+
+
+def write_derived_repos(root: "Path | str", repos: "Sequence[str]") -> "Path | None":
+    """Record the derived allowlist, one `owner/repo` per line, for the next
+    boot's entrypoint seeding. Rewritten only when the content differs.
+    Returns the path written, or None when nothing changed or the write
+    failed (logged; never raised -- the daemon has already trusted the hubs
+    itself, so this file only matters to a future boot)."""
+    path = derived_repos_path(root)
+    body = "".join(f"{r}\n" for r in repos)
+    try:
+        if path.is_file() and path.read_text(encoding="utf-8") == body:
+            return None
+        path.parent.mkdir(parents=True, exist_ok=True)
+        tmp = path.with_name(path.name + ".tmp")
+        tmp.write_text(body, encoding="utf-8")
+        os.replace(tmp, path)
+    except OSError as exc:
+        log.warning(
+            "could not record the derived allowlist at %s (%s) — the next "
+            "boot's entrypoint seeding will not pre-trust these hubs until a "
+            "refresh succeeds: %s", path, exc, ", ".join(repos),
+        )
+        return None
+    return path
+
+
+def read_derived_repos(root: "Path | str") -> "tuple[str, ...]":
+    """The recorded derived allowlist (`owner/repo` per line; blank lines and
+    `#` comments ignored), or `()` when absent or unreadable."""
+    path = derived_repos_path(root)
+    try:
+        text = path.read_text(encoding="utf-8")
+    except OSError:
+        return ()
+    out = []
+    for line in text.splitlines():
+        line = line.strip()
+        if line and not line.startswith("#") and "/" in line:
+            out.append(line)
+    return tuple(out)
+
+
+def _dialog_line(line: str) -> str:
+    """A pane line reduced to the text a gate would render there (see
+    _DIALOG_DECORATION), casefolded."""
+    text = line.strip(_DIALOG_DECORATION)
+    text = _DIALOG_NUMBERING.sub("", text).strip(_DIALOG_DECORATION)
+    return text.casefold()
+
+
+def _is_dialog_chrome(text: str) -> bool:
+    return any(text.startswith(chrome) for chrome in FIRST_RUN_DIALOG_CHROME)
+
+
+def pane_shows_first_run_dialog(pane: str) -> bool:
+    """Whether a session's terminal tail is PARKED on one of Claude Code's
+    first-run gates: the gate's accept option among the last
+    FIRST_RUN_DIALOG_TAIL_LINES non-blank lines, nothing but the gate's own
+    chrome below it, and the gate's question at or above it (the notes on
+    FIRST_RUN_DIALOG_MARKERS say why each leg is there). An empty capture
+    (the CLI could not tail) is never a dialog -- absence of evidence keeps
+    the defer -- and neither is a pane that merely MENTIONS a gate: a
+    session at work or idle at its prompt has printed something below the
+    words, and that something is not the gate's chrome."""
+    if not pane:
+        return False
+    lines = [t for t in (_dialog_line(ln) for ln in pane.splitlines()) if t]
+    tail = lines[-FIRST_RUN_DIALOG_TAIL_LINES:]
+    for offset in range(len(tail) - 1, -1, -1):
+        if any(tail[offset].startswith(o) for o in FIRST_RUN_DIALOG_OPTIONS):
+            break
+    else:
+        return False
+    if not all(_is_dialog_chrome(t) for t in tail[offset + 1:]):
+        return False
+    above = lines[:len(lines) - len(tail) + offset + 1]
+    return any(m in t for t in above for m in FIRST_RUN_DIALOG_MARKERS)

alissa/tools/github/devloop/loop.py

@@ -442,6 +442,14 @@ from . import loop_events as loop_events_mod
 from .alissa import Alissa
 from .alissa_client import AlissaClient
 from .bows import BowRepoSource
+from .hubs import (
+    FIRST_RUN_DIALOG_MARKERS,
+    WEDGE_FIRST_RUN_DIALOG,
+    hub_trust_paths,
+    pane_shows_first_run_dialog,
+    seed_trust,
+    write_derived_repos,
+)
 from .config import (
     FOREIGN_IGNORE,
     FOREIGN_REAP,
@@ -810,6 +818,24 @@ RESUME_DIRECTIVE = (
     "(best-effort — the daemon's reaper sweep collects stragglers)."
 )
 
+# The handover clause (issue #121), shared by FIX_DIRECTIVE and
+# FIX_RESUME_DIRECTIVE. When a later review round lands on the head a fix
+# session is still working (the 2026-09-15 studio#1243 shape: a phantom round
+# 2 on round 1's head, minutes after round 1), the daemon no longer spawns a
+# second session onto the same branch -- it posts FIX_HANDOVER_COMMENT on the
+# PR and moves the live session's ledger row to the new round. The triage
+# loop reads review THREADS, not the PR's issue comments, so the contract has
+# to say it: look for a newer round before the terminal re-request.
+_NEWER_ROUNDS = (
+    "Before you re-request review, check the PR for a NEWER review round: "
+    "if another `request_changes` round (or a daemon comment beginning "
+    "`Round N+1 arrived while the round-N fix session … is still working "
+    "on this head`) landed while you worked, the daemon has handed that "
+    "round to THIS session instead of spawning a second one on your branch "
+    "— triage and address its findings here as well, and re-request review "
+    "ONCE, after the newest round is answered. "
+)
+
 FIX_DIRECTIVE = (
     "You are an IMPLEMENTER in a fix round, not a reviewer. PR {pr_url} "
     "received a `request_changes` review (round {round}; this is fix attempt "
@@ -831,6 +857,7 @@ FIX_DIRECTIVE = (
     "one reasoned `[triage:*]` reply on each finding's thread — post any that "
     "are missing. Then fix the pursued findings on the same branch and VERIFY "
     "locally (run the repo's test/style/type scripts). "
+    + _NEWER_ROUNDS
     + _FIX_DELIVERY_NOTE
     + " "
     + _APPROVE_FOLLOWUP
@@ -887,6 +914,7 @@ FIX_RESUME_DIRECTIVE = (
     "the ORIGINAL acceptance criteria the issue set, and VERIFY locally (run "
     "the repo's test/style/type scripts). NEVER force-push: history stays "
     "append-only, or the review threads lose their anchors. "
+    + _NEWER_ROUNDS
     + _FIX_DELIVERY_NOTE
     + " "
     + _APPROVE_FOLLOWUP
@@ -1000,6 +1028,29 @@ FIX_STALLED_COMMENT = (
     "close the PR to park the work."
 )
 
+# The hidden marker that identifies a fix-round handover comment (issue #121)
+# -- a machine-findable anchor for the live session and for anyone auditing
+# the PR, distinct from ACTIVITY_MARKER so the two kinds of comment never
+# collide on one PR. Dedupe is NOT by marker but by the fix-handover:r<k>
+# ledger row (see fix_handover_kind): once per (PR, round).
+FIX_HANDOVER_MARKER = "<!-- alissa-devloop:fix-handover -->"
+
+# The steering comment the fix edge posts INSTEAD of spawning when a later
+# review round lands on the head a fix session is still working. The first
+# sentence is the issue's mandated text verbatim; the trailer says what the
+# daemon did and what happens if the session dies anyway.
+FIX_HANDOVER_COMMENT = (
+    FIX_HANDOVER_MARKER + "\n"
+    "Round {new_round} arrived while the round-{round} fix session "
+    "`{session}` is still working on this head — handing it over: address "
+    "the round-{new_round} findings in the same session and re-request "
+    "review once.\n\n"
+    "_devloop: no second fix session was spawned for round {new_round} (head "
+    "`{head}` is the one `{session}` is working). If that session dies "
+    "without re-requesting review, the stale path re-enqueues round "
+    "{new_round} as its next attempt._"
+)
+
 MAINTAIN_CAP_COMMENT = (
     "**Maintain loop cap-out** — {attempts} maintenance attempt(s) were "
     "spawned on this PR without any of them completing (attempt cap: {cap}; "
@@ -1190,6 +1241,11 @@ ESCALATION_ASSIGNMENT = "assignment"
 ESCALATION_STALLED = "stalled"
 ESCALATION_FIX_CAP = "fix-cap"
 ESCALATION_FIX_STALLED = "fix-stalled"
+# The round handover's once-per-(PR, round) row (issue #121, see
+# fix_handover_kind). A steering comment, not an operator page -- it lives in
+# the escalations table because that is the daemon's dedupe gate for
+# comments that must land exactly once and survive a degraded ledger.
+ESCALATION_FIX_HANDOVER = "fix-handover"
 
 # The pre-PR liveness deferral's own kind (see live_stalled_kind). Distinct
 # from ESCALATION_STALLED because the two stories are different and so are
@@ -1210,6 +1266,16 @@ ESCALATION_LIVE_STALLED = "live-stalled"
 # poll is the remedy, not a bug.
 ESCALATION_WEDGED = "wedged"
 
+# The first-run-dialog wedge's once-per-episode marker (issue #123; see
+# first_run_dialog_kind). Like ESCALATION_WEDGED an ACT, not a page: the
+# daemon killed a session whose pane showed one of Claude Code's first-run
+# gates, seeded the trust the gate was asking for, and re-enqueued the
+# attempt itself. The row dedupes the WARNING (one per episode -- a kill
+# that fails and is retried next poll logs its retry at INFO) and the
+# activity-comment line; the loop-events emitter turns it into the generic
+# `escalation.first-run-dialog`, anchored on the issue.
+ESCALATION_FIRST_RUN_DIALOG = "first-run-dialog"
+
 # The maintenance edge's cap-out kind prefix. The `maintain-` prefix keeps
 # rows from ever colliding with the issue edge's `cap` when an issue and a
 # PR share a number; the epoch suffix is maintain_cap_kind's job below.
@@ -1503,6 +1569,21 @@ def fix_stalled_kind(round_: int, attempt: int) -> str:
     return f"{ESCALATION_FIX_STALLED}:r{round_}a{attempt}"
 
 
+def fix_handover_kind(round_: int) -> str:
+    """The ledger kind that dedupes ONE round's handover comment (issue #121).
+
+    Keyed per round (`fix-handover:r<k>`): round k+1 handed to a live session
+    must not silence a round k+2 handed to the same session later, and the
+    `fix-` prefix keeps the row from colliding with issue-edge kinds when an
+    issue and a PR share a number. Delivery contract as fix_stalled_kind's:
+    the row lands only AFTER the comment posts, so a transient failure
+    retries next poll and the steering lands exactly once per round. The
+    ledger round bump rides BEHIND the comment for the same reason -- a
+    bumped row would close this edge's fresh-in-flight gate before the
+    comment ever landed."""
+    return f"{ESCALATION_FIX_HANDOVER}:r{round_}"
+
+
 def stalled_kind(attempt: int) -> str:
     """The ledger kind for the stalled ping of ONE deferral episode.
 
@@ -1551,6 +1632,17 @@ def wedge_kind(attempt: int) -> str:
     return f"{ESCALATION_WEDGED}:a{attempt}"
 
 
+def first_run_dialog_kind(attempt: int) -> str:
+    """The ledger kind for ONE first-run-dialog wedge episode (issue #123).
+
+    wedge_kind's episode reasoning: every attempt can meet the dialog (a
+    hub trusted after attempt k spawned is trusted for attempt k+1, but a
+    seeding that failed to land leaves the next attempt on the same prompt),
+    and attempt k's row must not silence attempt k+1's WARNING.
+    """
+    return f"{ESCALATION_FIRST_RUN_DIALOG}:a{attempt}"
+
+
 def deferral_activity_kind(session: str) -> str:
     """The activity-log kind that dedupes ONE capacity-deferral episode's line.
 
@@ -2345,6 +2437,12 @@ MANAGED_SESSION_PREFIX = "ali-"
 # pane said "Nothing left -- the review task is done.").
 FOREIGN_PANE_TAIL_LINES = 20
 
+# How many pane lines the first-run-dialog check reads (issue #123). The
+# trust dialog is a ~12-line box and the bypass-permissions gate ~20; a
+# session sitting on either has printed nothing since, so the last 40 lines
+# hold the whole prompt with room for the banner above it.
+FIRST_RUN_PANE_TAIL_LINES = 40
+
 # NOTE on where that capture goes: NOT onto the operator-facing line. The tail
 # is untrusted third-party terminal content and the console serves the log over
 # HTTP, so only its SHAPE (a line count) reaches WARNING and the transcript
@@ -2797,6 +2895,7 @@ class DevWatcher:
         # terminal one.
         resume_pr: "PullRequest | None" = None
         dead_session: "str | None" = None
+        wedged_dialog = False
         if age is not None:
             # `exhaustive` only when a resume could actually fire: the probe's
             # default early break answers the boolean the deferral needs, but
@@ -2920,6 +3019,25 @@ class DevWatcher:
                 # successful listing without this name) -- so the retry below
                 # can name the session it proved gone instead of presuming.
                 dead_session = live_session
+                if liveness is Liveness.ALIVE:
+                    # Issue #123: ALIVE is a process, not a worker. A session
+                    # sitting on Claude Code's first-run "trust this folder?"
+                    # (or bypass-permissions) gate is listed, idle, and will
+                    # never publish anything -- the directive typed into the
+                    # pane was swallowed by the prompt. Only on ALIVE (a
+                    # successful listing naming the row), and only when the
+                    # pane SHOWS the gate: every other alive-but-idle case
+                    # keeps the floored defer below, exactly as before.
+                    if self._wedged_on_first_run_dialog(
+                        issue, attempts, live_session
+                    ):
+                        wedged_dialog = True
+                        # The kill landed and the hub is seeded: fall through
+                        # to the cap check and the re-enqueue below as the
+                        # CONFIRMED-dead path would -- one WARNING for the
+                        # episode was logged by the classifier, so the
+                        # respawn's own line is suppressed.
+                        liveness = Liveness.DEAD
                 if liveness is not Liveness.DEAD:
                     # Floored exactly like the linked-PR deferral, and needing
                     # it for the same reason: this sits ABOVE the cap check,
@@ -2973,7 +3091,7 @@ class DevWatcher:
                 dead_session,
                 attempts + 1,
             )
-        elif age is not None:
+        elif age is not None and not wedged_dialog:
             log.warning(
                 "%s attempt %d has been in flight %.0f min with no completion "
                 "and no linked open PR, and its session %s is absent from the "
@@ -3518,6 +3636,132 @@ class DevWatcher:
             return None
         return min(youngest, max(0.0, now - committed))
 
+    def _wedged_on_first_run_dialog(
+        self, issue: Issue, attempts: int, session: str
+    ) -> bool:
+        """Issue #123: is this stale, ALIVE, PR-less session sitting on one of
+        Claude Code's first-run gates -- and if so, clear the lane.
+
+        Reads the pane (`alissa tmux tail`, the reaper's own evidence seam)
+        and asks `hubs.pane_shows_first_run_dialog` whether the session is
+        PARKED on a gate -- the gate's accept option among the last lines
+        with nothing but the gate's own chrome below it, its question
+        above -- not merely whether the gate's words appear: this repo's
+        own README, CHANGELOG, `hubs.py` and issue #123 quote them, so a
+        session that cats or diffs any of them has them on screen while at
+        work, and a kill here lands on the lane's own worktree. A pane not
+        parked on a gate, or one the CLI could not capture, answers False
+        and the caller keeps the floored defer it always took (runbook
+        caveat C7's other alive-but-idle causes -- expired OAuth, usage
+        limits, any other permission prompt -- are deliberately NOT
+        classified here).
+
+        A match is `wedged:first-run-dialog`: ONE WARNING per episode (keyed
+        first_run_dialog_kind(attempts) in the escalations ledger; a kill
+        that fails and is retried next poll logs at INFO), then the row's
+        own session is killed (`alissa tmux kill <name>`, never a sweep),
+        the hub it started in is trusted (root, main/, worktrees -- the very
+        entries the gate was asking for, so the retry does not meet it
+        again), one activity-comment line records the act, and True tells
+        the caller to re-enqueue as attempt k+1 NOW, counting toward
+        attempt_cap like any stale retry -- and on the TERMINAL attempt the
+        caller's cap check refuses that re-enqueue and pages the operator
+        instead, which is what the WARNING, the activity line and the
+        dry-run line say when `attempts >= attempt_cap`, rather than
+        promising a retry the lane will not get. Dry-run classifies and logs but
+        kills nothing and answers False (the defer holds). A kill that
+        fails answers False too: the defer holds and the next poll, reading
+        the same pane, tries again -- the remedy for a session that will not
+        die, not a loop to guard against.
+
+        The pane is untrusted third-party terminal content: only its
+        CLASSIFICATION reaches the log (see `_foreign_pane_evidence` for why
+        the capture itself stays at DEBUG)."""
+        pane = self.alissa.tail_session(session, FIRST_RUN_PANE_TAIL_LINES)
+        if not pane_shows_first_run_dialog(pane):
+            return False
+        log.debug(
+            "%s: last %d pane lines of %s:\n%s",
+            WEDGE_FIRST_RUN_DIALOG, FIRST_RUN_PANE_TAIL_LINES, session, pane,
+        )
+        hub = self.config.hub_for(issue.owner, issue.repo)
+        kind = first_run_dialog_kind(attempts)
+        # What the caller does with a True: the cap check sits right after
+        # this probe, so the terminal attempt caps out instead of retrying.
+        capping = attempts >= self.config.attempt_cap
+        if capping:
+            outcome = (
+                f"NOT re-enqueuing: attempt {attempts} was the last "
+                f"(attempt_cap {self.config.attempt_cap}), so the lane caps "
+                f"out and pages the operator"
+            )
+            activity_outcome = (
+                f"attempt_cap {self.config.attempt_cap} reached — the lane "
+                f"caps out and pages the operator instead of re-enqueuing"
+            )
+        else:
+            outcome = (
+                f"re-enqueuing as attempt {attempts + 1} (counting toward "
+                f"attempt_cap {self.config.attempt_cap})"
+            )
+            activity_outcome = f"re-enqueued as attempt {attempts + 1}"
+        if self.state.escalated(issue.full_name, issue.number, kind):
+            log.info(
+                "%s: session %s (%s attempt %d) is still on the claude "
+                "first-run dialog — retrying the kill",
+                WEDGE_FIRST_RUN_DIALOG, session, issue.issue_slug, attempts,
+            )
+        else:
+            log.warning(
+                "%s: session %s (%s attempt %d) reads alive but its pane shows "
+                "claude's first-run dialog (%s) — the directive was swallowed "
+                "by the prompt and nothing will ever be published. Killing "
+                "it, pre-trusting %s (root, main/, TASK-* worktrees) for "
+                "claude, and %s. Operator lever: `alissa tmux tail <session>` "
+                "to see the prompt, `tmux send-keys Down Enter` to accept it "
+                "by hand, or kill + seed as the daemon does",
+                WEDGE_FIRST_RUN_DIALOG, session, issue.issue_slug, attempts,
+                " / ".join(repr(m) for m in FIRST_RUN_DIALOG_MARKERS), hub,
+                outcome,
+            )
+            self.state.record_escalation(issue.full_name, issue.number, kind)
+        if self.config.dry_run:
+            log.info(
+                "[dry-run] would kill %s, pre-trust %s and %s",
+                session, hub,
+                f"cap out (attempt_cap {self.config.attempt_cap})" if capping
+                else f"re-enqueue attempt {attempts + 1}",
+            )
+            return False
+        try:
+            self.alissa.kill_session(session)
+        except CommandError as exc:
+            log.warning(
+                "%s: could not kill %s (%s) — kills are best-effort; the lane "
+                "keeps its defer and the kill is retried next poll",
+                WEDGE_FIRST_RUN_DIALOG, session, exc,
+            )
+            return False
+        self._trust_hub(hub, WEDGE_FIRST_RUN_DIALOG)
+        if not self.state.activity_logged(issue.full_name, issue.number, kind):
+            landed = self._append_activity(
+                issue.owner,
+                issue.repo,
+                issue.number,
+                self._activity_line(
+                    session,
+                    "issue edge",
+                    f"{ACTIVITY_WEDGE_KILLED} — {WEDGE_FIRST_RUN_DIALOG}: the "
+                    f"session read alive but its pane sat on claude's first-run "
+                    f"dialog (the hub was not pre-trusted); killed, hub {hub} "
+                    f"pre-trusted, {activity_outcome}",
+                ),
+                issue.issue_slug,
+            )
+            if landed:
+                self.state.record_activity(issue.full_name, issue.number, kind)
+        return True
+
     def _kill_wedged(
         self,
         issue: Issue,
@@ -3947,15 +4191,35 @@ class DevWatcher:
         age = self.state.fix_spawn_age(pr.full_name, number, round_)
 
         if age is not None and age < self.config.stale_minutes * 60:
+            # The row's own session name, not one re-derived from the
+            # attempt: after a handover (below) the row answering round k+1
+            # still carries its `-r<k>-` name, and the console reads this.
             return Decision(
                 Action.IN_FLIGHT,
                 f"fix attempt {attempts} for round {round_} enqueued "
                 f"{int(age)}s ago",
                 attempts,
-                session=fix_session_name(pr, round_, attempts),
+                session=self.state.newest_fix_spawn_session(
+                    pr.full_name, number, round_
+                ) or fix_session_name(pr, round_, attempts),
                 round=round_,
             )
 
+        # A round nothing was spawned for yet -- but the PREVIOUS round's fix
+        # session may still be alive on this very head (issue #121, the
+        # studio#1243 shape: the reviewer daemon posted a phantom round 2 on
+        # round 1's head four minutes after round 1, and this edge spawned a
+        # second session onto the branch the first was mid-work on). A live
+        # session on an unchanged head gets the new round handed to it with
+        # one steering comment; the spawn below is for a head that moved or a
+        # session that is gone. Above the external-claim check because it
+        # spends nothing (ledger + the pass's roster) and a live local session
+        # is the strongest evidence this edge can hold.
+        if age is None:
+            handed = self._hand_over_round(pr, round_, reviews, roster)
+            if handed is not None:
+                return handed
+
         # The cross-instance claim check, the issue edge's placement
         # transposed: past the fresh-in-flight return, the local ledger no
         # longer vouches for this round, and a peer instance's fresh spawn
@@ -4038,7 +4302,8 @@ class DevWatcher:
                         f"session may be there, already triaging (its CR8 "
                         f"replies are the footprint); not respawning",
                         attempts,
-                        session=fix_session_name(pr, round_, attempts),
+                        session=row_session
+                        or fix_session_name(pr, round_, attempts),
                         round=round_,
                         defer_token=loop_events_mod.DEFER_IN_FLIGHT,
                     )
@@ -5554,6 +5819,215 @@ class DevWatcher:
             pr.full_name, pr.number, fix_stalled_kind(round_, attempts)
         )
 
+    def _hand_over_round(
+        self,
+        pr: PullRequest,
+        round_: int,
+        reviews: list[Review],
+        roster: "SessionLiveness | None",
+    ) -> "Decision | None":
+        """Round `round_` just landed and nothing was spawned for it. Is the
+        previous round's fix session still ALIVE on this head? Then the round
+        is ITS to answer (issue #121): post one steering comment, move the
+        session's ledger row to this round, and spawn nothing. None means
+        "no handover -- spawn as always".
+
+        The gates, cheapest first, and every one of them is a reason to keep
+        the legacy spawn:
+
+        * no roster, or a listing that failed -- INDETERMINATE, and the issue
+          keeps today's behaviour for it (a spawn); the fail-safe direction
+          is inverted here on purpose: the wedge and resume gates defer
+          because their remedy is a MUTATION on a possibly-live branch, while
+          this gate's remedy is a comment, so ambiguity must not turn a real
+          new round into silence;
+        * the ledger holds no earlier round for this PR, or its newest round
+          is not below this one (a review deleted outright, or a ledger
+          written by a newer daemon -- NOT a dismissal: SUBMITTED_STATES
+          keeps DISMISSED records, so dismissing never shrinks the count);
+        * the newest session of that earlier round is not ALIVE -- DEAD is
+          the ordinary "session finished, next round" flow, and it spawns;
+        * the head is not that session's (see _head_is_sessions) -- the
+          round is on work someone else pushed, and it spawns.
+
+        The comment lands BEFORE the ledger moves, and the move is skipped
+        when the comment fails: a moved row closes the fresh-in-flight gate
+        above, so a comment that failed once would never be retried. With the
+        fix-handover:r<k> row down, the retry re-enters here with the comment
+        already deduped and just moves the row -- the same retry covers a
+        move that found no row to move (logged as an error: the ledger is
+        then not what the daemon just said it was). Dry-run comments nothing
+        and moves nothing. Both decisions ride Action.IN_FLIGHT with
+        DEFER_IN_FLIGHT: a handover is a hold behind own work already on the
+        lane, and the console must be able to tell it from a spawn.
+
+        What the live session does with it: FIX_DIRECTIVE's _NEWER_ROUNDS
+        clause tells it to look for a newer round before its terminal
+        re-request. If it dies without one, the moved row is what the stale
+        path ages: `stale_minutes` after the handover, with the session gone,
+        the edge re-enqueues attempt k+1 of THIS round (never of the old
+        one), because the row now says this is the round in flight."""
+        if roster is None or not roster.listed:
+            return None
+        previous = self.state.max_fix_round(pr.full_name, pr.number)
+        if not previous or previous >= round_:
+            return None
+        row = self.state.newest_fix_spawn(pr.full_name, pr.number, previous)
+        if row is None:
+            return None
+        session = str(row["session"])
+        if roster.of(session) is not Liveness.ALIVE:
+            return None
+        if not self._head_is_sessions(pr, row, reviews):
+            log.info(
+                "%s round %d landed while the round-%d fix session %s is "
+                "still listed, but head %s is not that session's — spawning "
+                "as usual",
+                pr.pr_slug,
+                round_,
+                previous,
+                session,
+                pr.head_sha[:8],
+            )
+            return None
+
+        kind = fix_handover_kind(round_)
+        body = FIX_HANDOVER_COMMENT.format(
+            new_round=round_,
+            round=previous,
+            session=session,
+            head=pr.head_sha[:8],
+        )
+        if self.config.dry_run:
+            log.info(
+                "[dry-run] would hand round %d of %s to the live fix session "
+                "%s and comment:\n%s",
+                round_,
+                pr.pr_slug,
+                session,
+                body,
+            )
+        elif not self.state.escalated(pr.full_name, pr.number, kind):
+            log.warning(
+                "%s round %d arrived while the round-%d fix session %s is "
+                "ALIVE on the same head %s — handing the round to it (one "
+                "steering comment), NOT spawning a second session",
+                pr.pr_slug,
+                round_,
+                previous,
+                session,
+                pr.head_sha[:8],
+            )
+            try:
+                self.github.comment(pr.owner, pr.repo, pr.number, body)
+            except CommandError as exc:
+                log.error(
+                    "could not post the round-%d handover comment on %s: %s "
+                    "— not moving the ledger row; the handover retries next "
+                    "poll",
+                    round_,
+                    pr.pr_slug,
+                    exc,
+                )
+                return Decision(
+                    Action.IN_FLIGHT,
+                    f"round {round_} is the live round-{previous} fix "
+                    f"session {session}'s to answer, but the steering comment "
+                    f"could not be posted — retrying next poll",
+                    int(row["attempt"]),
+                    session=session,
+                    round=round_,
+                    defer_token=loop_events_mod.DEFER_IN_FLIGHT,
+                )
+            self.state.record_escalation(pr.full_name, pr.number, kind)
+
+        if not self.config.dry_run:
+            moved = self.state.hand_over_fix_spawn(
+                repo_slug=pr.full_name,
+                number=pr.number,
+                session=session,
+                round_=round_,
+                head_sha=pr.head_sha,
+            )
+            if not moved:
+                log.error(
+                    "%s round %d handover: no fix_spawns row carries session "
+                    "%s any more — the ledger was not moved (the row is "
+                    "still on round %d); retrying the move next poll",
+                    pr.pr_slug,
+                    round_,
+                    session,
+                    previous,
+                )
+                return Decision(
+                    Action.IN_FLIGHT,
+                    f"round {round_} is the live round-{previous} fix "
+                    f"session {session}'s to answer (steering comment "
+                    f"posted), but its ledger row could not be moved — "
+                    f"retrying next poll",
+                    int(row["attempt"]),
+                    session=session,
+                    round=round_,
+                    defer_token=loop_events_mod.DEFER_IN_FLIGHT,
+                )
+        # The moved row is attempt 1 of the new round (see
+        # State.hand_over_fix_spawn); dry-run moved nothing and reports the
+        # row as it stands.
+        return Decision(
+            Action.IN_FLIGHT,
+            f"round {round_} handed to the live round-{previous} fix session "
+            f"{session} on the same head {pr.head_sha[:8]} (steering comment "
+            f"posted once; no second session)",
+            int(row["attempt"]) if self.config.dry_run else 1,
+            session=session,
+            round=round_,
+            defer_token=loop_events_mod.DEFER_IN_FLIGHT,
+        )
+
+    def _head_is_sessions(
+        self, pr: PullRequest, row: "sqlite3.Row", reviews: list[Review]
+    ) -> bool:
+        """Is the PR's current head the one the row's session is working --
+        the head it was spawned against, or one it has pushed since?
+
+        Three tiers, cheapest first, and the first two cost nothing:
+
+        1. the ledger's spawn head (`head_sha`, recorded since issue #121;
+           '' on older rows, which skip this tier);
+        2. the PREVIOUS verdict's head: the round before this one was
+           reviewed on `commit_id`, and a head still equal to it has not
+           moved between the rounds -- the issue's "simply" test, and the
+           #1243 shape exactly (round 2 on round 1's head);
+        3. a head that POSTDATES the session's spawn: one branch, one live
+           session, so a commit made after the session started is that
+           session's own push (the directives commit and push within
+           seconds). One GET, on this rare path only, and any failure to
+           read the instant answers False -- the legacy spawn.
+
+        False means "the head moved" for the handover's purposes, which keeps
+        today's behaviour (issue #121 §4)."""
+        spawn_head = str(row["head_sha"] or "")
+        if spawn_head and pr.head_sha == spawn_head:
+            return True
+        if len(reviews) >= 2:
+            before = reviews[-2]
+            if before.commit_id and before.commit_id == pr.head_sha:
+                return True
+        try:
+            committed = self.github.commit_time(pr.owner, pr.repo, pr.head_sha)
+        except CommandError as exc:
+            log.warning(
+                "could not read the commit instant of %s head %s (%s) — "
+                "treating the head as moved",
+                pr.pr_slug,
+                pr.head_sha[:8],
+                exc,
+            )
+            return False
+        if committed is None:
+            return False
+        return committed >= int(row["spawned_at"])
+
     def _verdict(self, pr: PullRequest, newest: Review) -> "str | None":
         """The newest review's verdict, mirroring reviewloop's precedence:
         the GitHub review state is authoritative where it can speak, and
@@ -5787,6 +6261,9 @@ class DevWatcher:
                 round_=round_,
                 attempt=attempt,
                 session=name,
+                # The head this session takes the round against -- the
+                # handover check's first tier (issue #121).
+                head_sha=pr.head_sha,
             )
 
         resumed = (
@@ -6264,6 +6741,12 @@ class DevWatcher:
         full_name = f"{owner}/{repo}"
         hub = self.config.hub_for(owner, repo)
         if hub.is_dir():
+            # An existing hub may have grown TASK-* worktrees since boot (a
+            # session creates its own), and a hub that appeared between
+            # boots was never seeded by the entrypoint at all: trust is
+            # re-asserted before EVERY spawn. Idempotent and cheap -- a
+            # state file already carrying every path is not rewritten.
+            self._trust_hub(hub, "before spawn")
             return hub, None
 
         if self.config.on_missing_hub != HUB_ADD:
@@ -6304,8 +6787,39 @@ class DevWatcher:
                 f"success but {hub} still does not exist — check hub_template "
                 f"against the manifest's `dir:` override"
             )
+        # Issue #123: the entrypoint pre-trusts only the hubs it can name at
+        # boot, and under `repos_source: bows` a hub created here was never
+        # among them -- the first session on it hung on Claude Code's "trust
+        # this folder?" dialog for 108 minutes (ali-fhr/docs.alissa.app#10).
+        # Seed the hub root (the spawn cwd), main/ and any worktree BEFORE
+        # the session is enqueued.
+        self._trust_hub(hub, "hub-ified")
         return hub, None
 
+    def _trust_hub(self, hub: Path, why: str) -> "list[Path]":
+        """Pre-accept Claude Code's trust dialog for every directory a
+        session on this hub may start in (see `hubs.hub_trust_paths`), in
+        both claude state files. Returns the state files that changed.
+        Dry-run seeds nothing. Best-effort by construction (`seed_trust`
+        never raises): a session can still be spawned into an untrusted hub
+        -- it just may wedge on the dialog, which the stale-session branch
+        now detects -- so a failed seed must never cost the spawn."""
+        paths = hub_trust_paths(hub)
+        if self.config.dry_run:
+            log.info(
+                "[dry-run] would pre-trust %d claude dir(s) for hub %s (%s)",
+                len(paths), hub, why,
+            )
+            return []
+        changed = seed_trust(paths)
+        if changed:
+            log.info(
+                "trusted hub %s for claude (%s): %d dir(s) — %s — written to %s",
+                hub, why, len(paths), ", ".join(str(p) for p in paths),
+                ", ".join(str(t) for t in changed),
+            )
+        return changed
+
     # -- the derived allowlist (repos_source: "bows") ----------------------
 
     def _apply_repos(self, repos: "tuple[str, ...]") -> None:
@@ -6396,6 +6910,36 @@ class DevWatcher:
             )
             return
         self._apply_repos(source.repos())
+        self._record_derived(source.derived)
+
+    def _record_derived(self, derived: "tuple[str, ...]") -> None:
+        """Issue #123: make the derived allowlist visible to the entrypoint's
+        boot-time trust seeding (`{root}/.alissa-derived-repos`) and trust
+        the derived hubs NOW -- hub-ified or not, exactly as the entrypoint
+        trusts a static allowlist's hubs before they exist. Both are
+        best-effort and idempotent; dry-run writes nothing."""
+        if not derived:
+            return
+        if self.config.dry_run:
+            log.info(
+                "[dry-run] would record %d derived repo(s) and pre-trust "
+                "their hubs", len(derived),
+            )
+            return
+        write_derived_repos(self.config.workspace_root, derived)
+        paths: "list[Path]" = []
+        for full_name in derived:
+            owner, _, repo = full_name.partition("/")
+            if not owner or not repo:
+                continue
+            paths.extend(hub_trust_paths(self.config.hub_for(owner, repo)))
+        changed = seed_trust(paths)
+        if changed:
+            log.info(
+                "repos_source=bows: pre-trusted the hubs of %d derived "
+                "repo(s) for claude in %s",
+                len(derived), ", ".join(str(t) for t in changed),
+            )
 
     # -- preflight ---------------------------------------------------------
 

alissa/tools/github/devloop/loop_events.py

@@ -127,7 +127,9 @@ _FOREIGN_RE = re.compile(r"^foreign-session:(.+)$")
 # lane is working, not the draft PR behind it) -- PR and issue numbers share
 # GitHub's namespace, so a kind missing here does not merely mislabel, it
 # points the operator at an unrelated PR or at nothing.
-_ISSUE_ANCHORED = ("cap", "assignment", "stalled", "live-stalled", "wedged")
+_ISSUE_ANCHORED = (
+    "cap", "assignment", "stalled", "live-stalled", "wedged", "first-run-dialog",
+)
 
 
 def _ms(ts: "int | float | str") -> int:

alissa/tools/github/devloop/state.py

@@ -8,7 +8,11 @@ can be retried, and to remember which escalations were already raised.
 The review-response edge keeps its own additive table, `fix_spawns`, keyed
 (repo_slug, number, round, attempt): `number` is the PULL REQUEST number (the
 edge has no issue), `round` is the substantive-review count the fix session
-answers, and `attempt` retries a presumed-dead fix session within one round.
+is CURRENTLY ANSWERING (the round it was spawned for, until a handover -- see
+`hand_over_fix_spawn` -- moves the row to a later round without spawning),
+`attempt` retries a presumed-dead fix session within one round, and
+`head_sha` is the PR head the row's session took that round against (the
+spawn head, refreshed on handover; '' on rows written before the column).
 A separate table rather than new columns on `spawns` because the two edges
 age and dedupe on different keys (issue vs PR+round), and an additive table
 leaves every existing ledger untouched. Fix-round cap-outs reuse the
@@ -135,6 +139,7 @@ CREATE TABLE IF NOT EXISTS fix_spawns (
     attempt    INTEGER NOT NULL,
     session    TEXT    NOT NULL,
     spawned_at INTEGER NOT NULL,
+    head_sha   TEXT    NOT NULL DEFAULT '',
     PRIMARY KEY (repo_slug, number, round, attempt)
 );
 
@@ -193,6 +198,10 @@ CREATE TABLE IF NOT EXISTS poll_snapshots (
 _COLUMN_MIGRATIONS = (
     ("poll_snapshots", "deferred", "INTEGER NOT NULL DEFAULT 0"),
     ("poll_snapshots", "foreign_reaped", "INTEGER NOT NULL DEFAULT 0"),
+    # The head a fix session took its round against (issue #121): rows
+    # written before the column read '' and the handover check falls back to
+    # the previous verdict's head for them.
+    ("fix_spawns", "head_sha", "TEXT NOT NULL DEFAULT ''"),
 )
 
 
@@ -558,18 +567,74 @@ class State:
         return row is not None
 
     def record_fix_spawn(
-        self, *, repo_slug: str, number: int, round_: int, attempt: int, session: str
+        self, *, repo_slug: str, number: int, round_: int, attempt: int, session: str,
+        head_sha: str = "",
     ) -> None:
         """Record a fix-session spawn for one review round. `repo_slug` is
-        `owner/repo`; `number` is the PR number."""
+        `owner/repo`; `number` is the PR number; `head_sha` is the PR head the
+        session was spawned against (the handover check's first tier -- see
+        loop.DevWatcher._hand_over_round)."""
         self._db.execute(
             "INSERT OR REPLACE INTO fix_spawns "
-            "(repo_slug, number, round, attempt, session, spawned_at) "
-            "VALUES (?,?,?,?,?,?)",
-            (repo_slug, number, round_, attempt, session, int(time.time())),
+            "(repo_slug, number, round, attempt, session, spawned_at, head_sha) "
+            "VALUES (?,?,?,?,?,?,?)",
+            (repo_slug, number, round_, attempt, session, int(time.time()),
+             head_sha or ""),
         )
         self._db.commit()
 
+    def newest_fix_spawn(
+        self, repo_slug: str, number: int, round_: int
+    ) -> "sqlite3.Row | None":
+        """The newest fix-spawn row of THIS PR round (session, attempt,
+        spawned_at, head_sha), or None when the round was never spawned --
+        newest_fix_spawn_session with the rest of the row, for the handover
+        check that needs the head and the spawn instant too."""
+        return self._db.execute(
+            "SELECT session, attempt, spawned_at, head_sha FROM fix_spawns "
+            "WHERE repo_slug=? AND number=? AND round=? "
+            "ORDER BY spawned_at DESC, attempt DESC LIMIT 1",
+            (repo_slug, number, round_),
+        ).fetchone()
+
+    def hand_over_fix_spawn(
+        self, *, repo_slug: str, number: int, session: str, round_: int,
+        head_sha: str,
+    ) -> bool:
+        """Move a live fix session's row to the round it is now answering
+        (issue #121): a later review round landed on the head that session is
+        still working, so the daemon handed the round to it instead of
+        spawning a second session. The row's `round` becomes `round_`, its
+        `head_sha` the head handed over, and `spawned_at` NOW -- the staleness
+        clock restarts at the handover, because the session took the new
+        round at that instant and the stale path must not fire on it one poll
+        later just because the session was already old.
+
+        ONE row moves, not a copy: the console's inbox then shows one session
+        answering one round, `max_fix_round` reads the handed-over round (so
+        the reaper never counts the session as superseded by the round it is
+        answering), and the round's attempt budget starts at this row -- so
+        the row is RENUMBERED to attempt 1 (PR #122 review round 1). The
+        attempt ledger's contract is that a round's attempts are contiguous
+        from 1 (`fix_attempt_count` is a COUNT, and `attempts + 1` must be a
+        free slot for the next spawn); a resumed session's row is attempt 2,
+        and moving it as attempt 2 would leave the new round with one row
+        that COUNTs as one attempt -- the stale respawn would then
+        `INSERT OR REPLACE` over it as attempt 2 every stale window, and the
+        attempt cap would never fire. The target key (repo_slug, number,
+        round_, 1) is free by construction: the caller only hands over a
+        round nothing was spawned for. Strict like record_fix_spawn: a row
+        the daemon believes it moved but did not would spawn over the live
+        session next poll. Returns False when no row carries `session` on
+        this PR."""
+        cursor = self._db.execute(
+            "UPDATE fix_spawns SET round=?, attempt=1, head_sha=?, spawned_at=? "
+            "WHERE repo_slug=? AND number=? AND session=?",
+            (round_, head_sha or "", int(time.time()), repo_slug, number, session),
+        )
+        self._db.commit()
+        return cursor.rowcount > 0
+
     def fix_attempt_count(self, repo_slug: str, number: int, round_: int) -> int:
         """Fix attempts already spawned for THIS round of this PR. Keyed per
         round on purpose: a new review round starts a fresh attempt budget."""

alissa/tools/github/devloop/version

@@ -1 +1 @@
-0.8.22
+0.8.24

{alissa_tools_github_devloop-0.8.22.dist-info → alissa_tools_github_devloop-0.8.24.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: alissa-tools-github-devloop
-Version: 0.8.22
+Version: 0.8.24
 Summary: ALISSA-TOOLS-GITHUB-DEVLOOP
 Home-page: https://alissa.app
 Author: Fahera

{alissa_tools_github_devloop-0.8.22.dist-info → alissa_tools_github_devloop-0.8.24.dist-info}/RECORD

@@ -6,12 +6,13 @@ alissa/tools/github/devloop/bows.py,sha256=pzDNMRk_S78FX7vMNYMlXHxW6VPHPo1Xd2EzF
 alissa/tools/github/devloop/config.py,sha256=2ifQx1LvqXZhtt44adQAFmKIMOK8iVAK53hi56U00gw,60399
 alissa/tools/github/devloop/fleet_vitals.py,sha256=m3rIKojFt5oCW2K-0qFkehmgR3uJQrvUddAnfW-Ob1k,15620
 alissa/tools/github/devloop/ghclient.py,sha256=UlDRF8V-oECdaUfIUdnbyl054403Q4019mTJD24FRXc,57554
+alissa/tools/github/devloop/hubs.py,sha256=yjnsnSHLG7GNNP8X2hILeAMV6P5n4JGc_IaAxpSP_YQ,18974
 alissa/tools/github/devloop/janitor.py,sha256=R8REoHBeY2cfW7fYJVhKr-F5z9Mjlc-vmv-z4KtvBZc,27360
-alissa/tools/github/devloop/loop.py,sha256=hyDZk3s94xw0UqOjZCgE8IFMdsS0uV234osEcZ5v0q8,425050
-alissa/tools/github/devloop/loop_events.py,sha256=qyvIkQGfl2k4zULlddQdV_u1pd5RbWmmTmWiCsnnhRc,23807
+alissa/tools/github/devloop/loop.py,sha256=cxKbMKyff3STTaiHq7xJ4tpc4HOjAqw5_yI9TQo4omo,452375
+alissa/tools/github/devloop/loop_events.py,sha256=WNVa8gR8Uuv4pQcVxjwg9TtJbLmWs4t54XkD6XvKvgg,23834
 alissa/tools/github/devloop/proc.py,sha256=_dDr3g76WEf2DRyLUz1Dzl4KvLVptJant_UZOrRixNk,1649
-alissa/tools/github/devloop/state.py,sha256=nYADHYgOGNmkCdl7lx3DeeJkcPAwkg4mxA9-i0m7ybw,60150
-alissa/tools/github/devloop/version,sha256=hkVrzGKdmB4uNNf9UwlvDbqWkEYFk7O4RYO-BfP9VE4,7
+alissa/tools/github/devloop/state.py,sha256=kuQRtjtJXvSnsI1_wCng4855MPMgVwkbU8szVxa4iws,63925
+alissa/tools/github/devloop/version,sha256=Bdd85i5avnISwPpcp0fxY0jQEsOQFggOmcEPj39eIL8,7
 alissa/tools/github/devloop/version.py,sha256=znuuOaitXGrBpbskNy78_rlVpFdtmKmk_3k1ACxZrl0,1418
 alissa/tools/github/devloop/webui/__init__.py,sha256=vdXYoyGYzD7BrJ5lV6XdH8Bpw_pej8-RK0hjfxop7-8,1513
 alissa/tools/github/devloop/webui/__main__.py,sha256=FCkklWZLPUJtRPZTrPRkCdMInWPXLaLyCWm9hy3jhg8,5097
@@ -20,10 +21,10 @@ alissa/tools/github/devloop/webui/page.py,sha256=48siJM-aVSjaZIHJrPDNPeAlCtIPJOH
 alissa/tools/github/devloop/webui/server.py,sha256=LP7KKUL1Kd85F119rh8ce9s1GyYeZ-ETh91Y-ZCxzCA,13333
 alissa/tools/github/devloop/webui/sources.py,sha256=fiity1aMpz9KdnQ-MzWYCdqBRmhJfuIYCN_FePw9akE,31825
 alissa/tools/github/devloop/webui/sysinfo.py,sha256=ptlogH9alFv0vZ-pQfyUaA3w-K7LQS3tQHGv0d8Tdlk,9649
-alissa_tools_github_devloop-0.8.22.dist-info/licenses/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358
-alissa_tools_github_devloop-0.8.22.dist-info/licenses/NOTICE,sha256=FKstNs3uw_tQod4_1XcFLD1FUTJQXf4FC0oXJAOA_HE,260
-alissa_tools_github_devloop-0.8.22.dist-info/METADATA,sha256=lNAnUJOEcPDwzey16pyLtwuk0XfxR2oenQwJQ-uJg58,2654
-alissa_tools_github_devloop-0.8.22.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
-alissa_tools_github_devloop-0.8.22.dist-info/entry_points.txt,sha256=8aC7Ajzx4bu9ZRR37a40IDfuStacvZP5KsAxY1dbFKU,145
-alissa_tools_github_devloop-0.8.22.dist-info/top_level.txt,sha256=DodjDg-l-TWQnlxG-Vuc3G5sB4O7cWGQwe6XrVx3u-A,7
-alissa_tools_github_devloop-0.8.22.dist-info/RECORD,,
+alissa_tools_github_devloop-0.8.24.dist-info/licenses/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358
+alissa_tools_github_devloop-0.8.24.dist-info/licenses/NOTICE,sha256=FKstNs3uw_tQod4_1XcFLD1FUTJQXf4FC0oXJAOA_HE,260
+alissa_tools_github_devloop-0.8.24.dist-info/METADATA,sha256=Fycs9dGIUvkr8lOmd49FGm6NKeKhvz3EOIMvKNhFlB0,2654
+alissa_tools_github_devloop-0.8.24.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+alissa_tools_github_devloop-0.8.24.dist-info/entry_points.txt,sha256=8aC7Ajzx4bu9ZRR37a40IDfuStacvZP5KsAxY1dbFKU,145
+alissa_tools_github_devloop-0.8.24.dist-info/top_level.txt,sha256=DodjDg-l-TWQnlxG-Vuc3G5sB4O7cWGQwe6XrVx3u-A,7
+alissa_tools_github_devloop-0.8.24.dist-info/RECORD,,