code-coordinator 0.5.105__tar.gz → 0.5.107__tar.gz

{code_coordinator-0.5.105 → code_coordinator-0.5.107}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.105
+Version: 0.5.107
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.105 → code_coordinator-0.5.107}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.105
+Version: 0.5.107
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.105 → code_coordinator-0.5.107}/code_coordinator.egg-info/SOURCES.txt

@@ -53,6 +53,7 @@ coord/cli.py
 coord/client.py
 coord/comments.py
 coord/config.py
+coord/config_reload.py
 coord/conflict_fix.py
 coord/dao.py
 coord/db.py

{code_coordinator-0.5.105 → code_coordinator-0.5.107}/code_coordinator.egg-info/scm_file_list.json

@@ -77,6 +77,7 @@
     "coord/commands/tui.py",
     "coord/comments.py",
     "coord/config.py",
+    "coord/config_reload.py",
     "coord/conflict_fix.py",
     "coord/dao.py",
     "coord/dashboard/__init__.py",

{code_coordinator-0.5.105 → code_coordinator-0.5.107}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.105",
+  "tag": "0.5.107",
   "distance": 0,
-  "node": "ge1d2140a49bec59697930f77304b2c0f62eef7c1",
+  "node": "gd8477c280ee82a9279e982ed0b3aea53dc089761",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-08-16"

{code_coordinator-0.5.105 → code_coordinator-0.5.107}/coord/agent.py

@@ -26,6 +26,7 @@ from pathlib import Path
 from typing import TYPE_CHECKING, Any, Callable, Iterable
 
 from coord import cargo_cache
+from coord.config_reload import reload_config_if_stale
 from coord.models import DELIVERABLE_ANALYSIS_LABEL
 from coord.platform_paths import default_coord_dir
 
@@ -4010,6 +4011,25 @@ WRITE_CAPABLE_SPEC_TYPES: frozenset[str] = frozenset({
 })
 
 
+def _config_mtime_of(config: "Any | None") -> float | None:
+    """mtime of *config*'s backing ``coordinator.yml``, or None (#2299).
+
+    None whenever there is nothing to watch: config-free mode (no config at
+    all), thin-client mode (the config came from the daemon's ``GET /config``
+    and has no local ``path``), or a file that vanished between load and now.
+    Every one of those cases makes :meth:`AgentServer._maybe_reload_config` a
+    no-op, which is the correct degradation — an agent with no local file has
+    nothing to re-read.
+    """
+    path = getattr(config, "path", None) if config is not None else None
+    if path is None:
+        return None
+    try:
+        return Path(path).stat().st_mtime
+    except OSError:
+        return None
+
+
 class AgentServer:
     """Owns assignment state and subprocesses. Thread-safe."""
 
@@ -4022,6 +4042,14 @@ class AgentServer:
         state_dir: Path = DEFAULT_STATE_DIR,
         worker_command: WorkerCommandBuilder | None = None,
         repo_paths: dict[str, str] | None = None,
+        # RESTART-ONLY (#2299). These two are read by `_spawn` for every
+        # worker, but they are *process* tuning (how the daemon forks and how
+        # long it waits for first output), not fleet topology — they are NOT
+        # refreshed by the config reload below. Changing
+        # `concurrency.bash_wrap_spawn` / `concurrency.first_output_timeout`
+        # in coordinator.yml still requires `systemctl --user restart
+        # coord-agent`, as do the bind host/port (owned by uvicorn, which has
+        # already bound the socket by the time any reload could run).
         bash_wrap_spawn: bool = True,
         first_output_timeout: float = _FIRST_OUTPUT_TIMEOUT,
         # #305: per-repo artifact glob patterns; repo_name → list of globs.
@@ -4091,11 +4119,51 @@ class AgentServer:
         # :mod:`coord.providers` at module load time — concrete instances
         # are duck-typed (``build_command``, ``initial_input``,
         # ``capabilities``, ``env``) at call sites.
+        #
+        # RESTART-ONLY (#2299): the registry is deliberately NOT refreshed by
+        # the config reload. A running worker holds a provider resolved at
+        # dispatch time (`_resolve_provider`), and `_reap` re-resolves the
+        # SAME spec afterwards to pick a log parser — swapping the registry
+        # underneath would let a live session's provider silently change
+        # identity mid-flight (retargeting its model / log format), which is
+        # exactly the "never mutate state a running worker depends on"
+        # invariant this feature is bounded by. Adding or editing a provider
+        # still needs a restart.
         self._providers: dict[str, object] = dict(providers or {})
         self._worktree_writable_settings_files = worktree_writable_settings_files
         self._health_config = health_config
         self.config_free_reason = config_free_reason
 
+        # ── #2299: hot config reload ────────────────────────────────────────
+        # The agent used to freeze every config-derived field above at process
+        # start, so adding a repo to coordinator.yml required `systemctl --user
+        # restart coord-agent` on every machine that should serve it — the one
+        # action that also kills live workers, which in practice meant waiting
+        # for the whole fleet to go quiet before a repo could be onboarded at
+        # all. Worse, the skew was silent and asymmetric: `coord config`,
+        # `coord status` and `coord assign --dry-run` all read the *file* and
+        # reported the repo as supported while `assign()` refused every single
+        # dispatch for it.
+        #
+        # `_maybe_reload_config` closes that, driven off the existing /health
+        # poll and the dispatch path (no new timer, no background thread).
+        # `_config_mtime` is seeded here from the file we were built from so
+        # the first poll after startup is a no-op stat(), not a redundant
+        # reparse.
+        self._config_mtime: float | None = _config_mtime_of(health_config)
+        # Serializes reload attempts so two concurrent /health polls (or a
+        # poll racing a dispatch) can't both parse the file and apply
+        # overlapping swaps. Held across stat + parse + apply. Lock order is
+        # always `_config_reload_lock` → `_lock`; nothing takes them the other
+        # way round.
+        self._config_reload_lock = threading.Lock()
+        # Observability for /health: how many times the on-disk config was
+        # successfully re-read into this process, and when. In-memory only —
+        # it exists to answer "did this agent pick up my edit?" without an
+        # SSH + journalctl, which is the question #2299 was really about.
+        self._config_reloads: int = 0
+        self._config_reloaded_at: float | None = None
+
         self._lock = threading.Lock()
         self._assignments: dict[str, AgentAssignment] = {}
         self._processes: dict[str, subprocess.Popen] = {}
@@ -4227,9 +4295,198 @@ class AgentServer:
         self.log_dir.mkdir(parents=True, exist_ok=True)
         self._load_state()
 
+    # ── #2299: hot config reload ────────────────────────────────────────────
+
+    #: Config-derived state that a reload refreshes, versus the state it must
+    #: leave alone. Kept as a docstring-adjacent constant so the *decision*
+    #: (issue #2299's "needs a decision, not an assumption" list) is recorded
+    #: in the code rather than only in the issue thread.
+    #:
+    #: HOT (refreshed on the next health poll / dispatch):
+    #:   * ``repos``          — the point of the feature; gates ``assign()``
+    #:                          and is what ``/health`` advertises.
+    #:   * ``repo_paths``     — resolved per dispatch.
+    #:   * ``artifact_paths`` — read when a finished worker's artifacts are
+    #:                          stashed.
+    #:   * ``build_commands`` — read just before that stash.
+    #:   * ``capabilities``   — published in ``/health``; the coordinator does
+    #:                          smoke/review routing from that published list,
+    #:                          and nothing in the *worker* path reads it, so a
+    #:                          capability that disappears simply stops
+    #:                          attracting new work (degrade) instead of
+    #:                          stranding anything in flight.
+    #:
+    #: RESTART-ONLY (documented at their assignment sites in ``__init__``):
+    #:   * ``providers``      — a live worker holds a resolved provider.
+    #:   * ``bash_wrap_spawn`` / ``first_output_timeout`` — process tuning.
+    #:   * bind host/port     — uvicorn has already bound the socket.
+    _RELOADABLE_FIELDS = (
+        "repos",
+        "repo_paths",
+        "artifact_paths",
+        "build_commands",
+        "capabilities",
+    )
+
+    def _maybe_reload_config(self) -> bool:
+        """Re-read ``coordinator.yml`` if it changed on disk; return True if applied.
+
+        This is #2299's whole mechanism. It reuses the board daemon's #1081
+        helper (:func:`coord.config_reload.reload_config_if_stale`) rather than
+        inventing a second one, so the malformed-edit behaviour is identical by
+        construction: a bad hand-edit is logged and swallowed, the agent keeps
+        running on the last-good config, and the tracked mtime still advances
+        so the bad edit is not re-parsed on every subsequent poll.
+
+        Cheap enough to call on the hot paths that already exist (``health()``
+        and ``assign()``): the steady-state cost is one ``stat()`` under an
+        uncontended lock — no new timer and no background thread.
+
+        Fail-soft in every direction. A missing/thin-client config, a vanished
+        file, a malformed edit, or a config whose ``machines:`` list no longer
+        contains this machine all leave the agent exactly as it was.
+        """
+        cfg = self._health_config
+        if cfg is None or getattr(cfg, "path", None) is None:
+            # Config-free (docs/EPHEMERAL_WORKERS.md) or thin-client mode —
+            # there is no local file to watch. Both are legitimate; neither
+            # can drift against a file it doesn't have.
+            return False
+
+        with self._config_reload_lock:
+            # Re-read under the lock: a concurrent caller may already have
+            # applied this same edit while we waited, in which case
+            # `_config_mtime` has moved past it and the helper no-ops.
+            cfg = self._health_config
+            reloaded, mtime = reload_config_if_stale(
+                cfg,
+                self._config_mtime,
+                log_name=__name__,
+                label="coord agent",
+            )
+            self._config_mtime = mtime
+            if reloaded is cfg:
+                return False
+
+            machine = next(
+                (m for m in reloaded.machines if m.name == self.machine_name), None
+            )
+            if machine is None:
+                # The edit removed/renamed this machine. Adopting a config
+                # that doesn't describe us would mean publishing an empty repo
+                # list and refusing every dispatch — a far worse outcome than
+                # staying on the last-good snapshot until an operator notices.
+                # `_config_mtime` has still advanced, so this logs once per
+                # edit rather than once per poll.
+                _log.warning(
+                    "coord agent: %s reloaded but no longer declares machine "
+                    "%r (has: %s); keeping the previous config",
+                    reloaded.path,
+                    self.machine_name,
+                    [m.name for m in reloaded.machines],
+                )
+                return False
+
+            self._apply_reloaded_config(reloaded, machine)
+            return True
+
+    def _apply_reloaded_config(self, cfg: "Any", machine: "Any") -> None:
+        """Swap the reloadable fields in place, pinning anything in flight.
+
+        The invariant from #2299: *a reload must never mutate state a running
+        worker depends on.* In-flight assignments keep the values they started
+        with; the new config governs the next dispatch onward.
+
+        Concretely, any repo with a PENDING or RUNNING assignment is "pinned":
+        its ``repo_paths`` / ``artifact_paths`` / ``build_commands`` entries
+        keep their pre-reload values (including *absence* — a repo that had no
+        build command before must not acquire one halfway through a worker's
+        leg, or the pre-stash build would run a command the worker never
+        expected). The pin lifts as soon as that assignment reaches a terminal
+        state and the next reload runs.
+
+        ``repos`` and ``capabilities`` are replaced wholesale: they gate and
+        advertise *new* work only, so removing a repo correctly means "take no
+        more dispatches for it", not "abandon the worker already running".
+
+        Every field is *rebound* to a freshly-built list/dict rather than
+        mutated in place, so the many unsynchronized readers elsewhere in this
+        class (``_servable_repos``, ``_stash_artifacts``, ``assign``, ...) see
+        either the whole old value or the whole new one — never a half-updated
+        dict.
+        """
+        new_repos = list(machine.repos)
+        new_capabilities = list(machine.capabilities)
+        new_repo_paths = dict(machine.repo_paths or {})
+        new_artifact_paths: dict[str, list[str]] = {
+            r.name: list(r.artifact_paths) for r in cfg.repos if r.artifact_paths
+        }
+        new_build_commands: dict[str, str] = {
+            r.name: r.build_command for r in cfg.repos if r.build_command
+        }
+
+        def _pin(old: dict, new: dict, keys: "Iterable[str]") -> None:
+            """Restore *old*'s entry for each pinned key — including absence."""
+            for key in keys:
+                if key in old:
+                    new[key] = old[key]
+                else:
+                    new.pop(key, None)
+
+        with self._lock:
+            in_flight = {
+                a.spec.repo_name
+                for a in self._assignments.values()
+                if a.status in (PENDING, RUNNING)
+            }
+            _pin(self.repo_paths, new_repo_paths, in_flight)
+            _pin(self.artifact_paths, new_artifact_paths, in_flight)
+            _pin(self.build_commands, new_build_commands, in_flight)
+
+            added = [r for r in new_repos if r not in self.repos]
+            removed = [r for r in self.repos if r not in new_repos]
+            caps_changed = new_capabilities != self.capabilities
+
+            self.repos = new_repos
+            self.capabilities = new_capabilities
+            self.repo_paths = new_repo_paths
+            self.artifact_paths = new_artifact_paths
+            self.build_commands = new_build_commands
+            self._health_config = cfg
+            self._config_reloads += 1
+            self._config_reloaded_at = time.time()
+
+        # The H-1 block in /health is built from `_health_config`'s checkouts,
+        # so a stale cache would keep reporting the pre-reload repo set for up
+        # to a full TTL after the swap — exactly the skew this issue is about,
+        # just moved one layer down.
+        self._local_health_cache = None
+
+        _log.info(
+            "coord agent: applied config reload from %s — repos=%s "
+            "(added=%s removed=%s) capabilities=%s%s",
+            getattr(cfg, "path", None),
+            new_repos,
+            added or "[]",
+            removed or "[]",
+            new_capabilities if caps_changed else "unchanged",
+            (
+                f" (pinned in-flight repos: {sorted(in_flight)})"
+                if in_flight
+                else ""
+            ),
+        )
+
     # ── Public API ──────────────────────────────────────────────────────────
 
     def health(self) -> dict:
+        # #2299: the health poll IS the reload tick. The coordinator polls
+        # every agent's /health continuously, so piggybacking here means a
+        # coordinator.yml edit lands within one poll with no new timer, and —
+        # critically — the `repos` list published below is the post-reload one,
+        # so `coord repo doctor`'s `machines.agent_repo_skew` clears itself
+        # instead of instructing an operator to restart a busy agent.
+        self._maybe_reload_config()
         with self._lock:
             active = sum(1 for a in self._assignments.values() if a.status == RUNNING)
             completed = sum(
@@ -4240,6 +4497,9 @@ class AgentServer:
         worktree_bytes = self._cached_worktree_bytes()
         artifact_bytes = self._cached_artifact_bytes()
         servable_repos, degraded_repos = self._servable_repos()
+        # #2299: the coordinator.yml this agent re-reads on every poll, or
+        # None when there is nothing local to watch (config-free / thin-client).
+        watched_config = getattr(self._health_config, "path", None)
         return {
             "machine": self.machine_name,
             "capabilities": self.capabilities,
@@ -4309,6 +4569,18 @@ class AgentServer:
                 "skipped_active": self._graph_heal_skipped_active,
                 "last_skip_at": self._graph_heal_last_skip_at,
             },
+            # #2299: is this agent actually watching a coordinator.yml, and
+            # has it picked anything up? `watching` is None for a
+            # config-free/thin-client agent (nothing local to re-read), which
+            # is the one case where a restart IS still the only way to change
+            # the repo list. Lets an operator answer "did my edit land?"
+            # from `coord doctor` instead of SSH + journalctl — the whole
+            # complaint in #2299 was that the skew was invisible from outside.
+            "config_reload": {
+                "watching": str(watched_config) if watched_config else None,
+                "reloads": self._config_reloads,
+                "last_reload_at": self._config_reloaded_at,
+            },
         }
 
     def _cached_local_health(self) -> dict:
@@ -5614,6 +5886,13 @@ class AgentServer:
 
     def assign(self, spec: AssignmentSpec) -> AgentAssignment:
         """Accept an assignment and spawn the worker. Returns immediately."""
+        # #2299: refresh from coordinator.yml before the repo gate below.
+        # /health already reloads on every poll, but gating dispatch on
+        # "someone happened to poll first" would make repo onboarding depend
+        # on poll timing; this costs one stat() in the steady state and makes
+        # the guarantee unconditional — the dispatch that arrives after the
+        # edit is served, full stop.
+        self._maybe_reload_config()
         if self.repos and spec.repo_name not in self.repos:
             raise ValueError(
                 f"this agent does not handle repo {spec.repo_name!r} "

{code_coordinator-0.5.105 → code_coordinator-0.5.107}/coord/auto_loop.py

@@ -43,7 +43,7 @@ import httpx
 from coord.config import Config
 from coord.dispatch import AGENT_PORT
 from coord import github_ops
-from coord.models import Assignment, Board
+from coord.models import SEALED_PATH_AUTHOR_TYPES, Assignment, Board
 from coord.review import (
     ReviewFindings,
     blocking_findings_confirmed_absent,
@@ -64,7 +64,16 @@ log = logging.getLogger(__name__)
 # ``coord.notify``'s fix-completion detector doesn't hardcode ``"work"`` and
 # silently miss a newer fix-dispatch type — the same class of bug as #1141
 # ("test-author was never added to WORK_LIKE_TYPES").
-FIX_DISPATCH_TYPES: frozenset[str] = frozenset({"work", "test-author"})
+#
+# #2302: "mock-author" (Gate A) is the same class of bug repeating — a
+# request-changes fix for a mock-author row dispatched as plain "work",
+# which trips coord/review.py's sealed-path tamper rule on every round
+# (the fix worker isn't authorized to write tests/acceptance/ms-NN/, but
+# that's exactly where the diff has to land) until max_review_iterations
+# burns out. `_dispatch_fix` derives `fix_type` from
+# ``coord.models.SEALED_PATH_AUTHOR_TYPES`` rather than a hardcoded string
+# so this set — and this one — never drift from it again.
+FIX_DISPATCH_TYPES: frozenset[str] = frozenset({"work"}) | SEALED_PATH_AUTHOR_TYPES
 
 
 # Every :class:`LoopAction` kind whose production means the in-memory board was
@@ -816,9 +825,16 @@ def _build_fix_briefing(
     instructions instead — "make the acceptance suite pass" is actively
     wrong guidance for an oracle that must stay RED until the real
     implementation lands.
+
+    #2302: a ``type="mock-author"`` source row (Gate A) gets its own
+    variant for the same reason one level up the pipeline — the diff is a
+    specification (``contract.md`` + rendered mocks), not an
+    implementation, so "run tests, make them pass" is equally wrong there.
     """
     if work.type == "test-author":
         return _build_test_author_fix_briefing(work, findings, iteration, max_iter)
+    if work.type == "mock-author":
+        return _build_mock_author_fix_briefing(work, findings, iteration, max_iter)
 
     lines: list[str] = [
         f"# Fix assignment (iteration {iteration}/{max_iter}): {work.issue_title}",
@@ -929,6 +945,93 @@ def _build_test_author_fix_briefing(
     return "\n".join(lines)
 
 
+def _build_mock_author_fix_briefing(
+    work: Assignment,
+    findings,
+    iteration: int,
+    max_iter: int,
+) -> str:
+    """Fix briefing for a ``type="mock-author"`` slice (#2302, Gate A).
+
+    The diff here is a SPECIFICATION — ``contract.md`` plus rendered
+    ``tests/acceptance/ms-NN/mocks/*`` — not an implementation. There is no
+    suite to run, so "run the tests and make them pass" (the generic fix
+    instruction) is actively wrong guidance, the same shape #1176 already
+    fixed for ``test-author``. Findings on a Gate A review are almost
+    always an internal-consistency defect: a mock depicting an end state
+    that the contract's own stated rules cannot produce from the narrated
+    input sequence — so the contract and the mocks must be reconciled to
+    agree with each other in BOTH directions, not just patched locally.
+    The dispatcher pairs this briefing with a bare ``type="mock-author"``
+    dispatch (see ``_dispatch_fix``) — ``agent.py``'s own
+    ``elif spec.type == "mock-author"`` branch supplies
+    ``MOCK_AUTHOR_SYSTEM_PROMPT`` and its deny-list on its own, so no
+    explicit ``system_prompt``/``deny_commands`` injection is needed here
+    the way ``test-author`` (which has no such branch) requires.
+    """
+    lines: list[str] = [
+        f"# Gate A fix (iteration {iteration}/{max_iter}): {work.issue_title}",
+        "",
+        (
+            f"You are the independent mock-author fixing review findings "
+            f"against the Gate A contract and mocks for issue "
+            f"#{work.issue_number}."
+        ),
+        (
+            f"Work on branch `{work.branch or '(check your git branches)'}` — "
+            "**do not change the branch name**."
+        ),
+        "",
+        "## Reviewer findings to address",
+        "",
+        findings.body.strip(),
+        "",
+        "## Instructions",
+        "",
+        (
+            "1. Read the reviewer findings above carefully. Your diff is a "
+            "SPECIFICATION (`contract.md` + rendered `mocks/*`), not an "
+            "implementation — there is no suite to run and nothing to make "
+            "pass. Findings on a Gate A review are almost always an "
+            "internal-consistency defect: a mock depicting an end state "
+            "that the contract's own stated rules cannot produce from the "
+            "narrated input sequence."
+        ),
+        (
+            "2. Fix **every** issue identified by the reviewer so the "
+            "contract and the mocks agree with each other in BOTH "
+            "directions — every rule the contract states must be reachable "
+            "from the mocks' narrated sequence, and every state the mocks "
+            "depict must be producible by the contract's stated rules."
+        ),
+        "3. Stay on the **same branch** — push your fixes to the existing branch.",
+        (
+            "4. Do NOT touch any file outside `tests/acceptance/ms-NN/`. "
+            "Touching anything outside that directory is a mandatory "
+            "`request-changes` for this assignment type — you are pinning "
+            "the milestone's contract, not implementing it."
+        ),
+        (
+            f"5. This is fix iteration {iteration} of {max_iter} allowed. "
+            "Address all findings completely so the next review can approve."
+        ),
+        "",
+        (
+            "STATUS: reading review findings → reconciling contract and mocks "
+            "→ confidence: high"
+        ),
+        "",
+    ]
+    if work.briefing and work.briefing.strip():
+        lines += [
+            "## Original mock-author briefing",
+            "",
+            work.briefing.strip(),
+            "",
+        ]
+    return "\n".join(lines)
+
+
 def _dispatch_fix(
     work: Assignment,
     briefing: str,
@@ -945,11 +1048,18 @@ def _dispatch_fix(
     Prefers the same machine as the original worker (the branch is already
     checked out there).  Falls back to any capable machine.
 
-    #1176: the dispatched type mirrors ``work.type`` for ``"test-author"``
-    (with ``TEST_AUTHOR_SYSTEM_PROMPT`` + its deny-list, since the fix needs
-    the same acceptance-path authorization and independence rules as the
-    original test-author dispatch); every other source type still gets the
-    long-standing plain ``"work"`` fix.
+    #1176/#2302: the dispatched type mirrors ``work.type`` for any
+    :data:`coord.models.SEALED_PATH_AUTHOR_TYPES` member (``"test-author"``,
+    ``"mock-author"``) — those types are the ones ``coord/review.py``
+    inverts its sealed-path tamper rule for, so a fix that needs to write
+    back into ``tests/acceptance/ms-NN/`` must carry the same type as the
+    row it's fixing or every round trips "TAMPER DETECTED" until the
+    iteration cap burns out. ``test-author`` additionally needs
+    ``TEST_AUTHOR_SYSTEM_PROMPT`` + its deny-list injected explicitly since
+    ``agent.py`` has no dispatch-table branch for it; ``mock-author``
+    doesn't — ``agent.py``'s own ``elif spec.type == "mock-author"`` branch
+    supplies its system prompt and deny-list unconditionally. Every other
+    source type still gets the long-standing plain ``"work"`` fix.
 
     Returns the new Assignment (already added to ``board.active``), or None
     on failure.
@@ -1016,12 +1126,16 @@ def _dispatch_fix(
     if repo is None:
         return None
 
-    # #1176: preserve the source row's type for a test-author slice fix —
-    # dispatching `type="work"` sends a plain worker that is forbidden from
-    # (and never given the system prompt authorizing) exactly the
-    # `tests/acceptance/**` path it needs to fix. Every other source type
-    # (including today's "work") keeps the long-standing "work" fix.
-    fix_type = "test-author" if work.type == "test-author" else "work"
+    # #1176/#2302: preserve the source row's type for a sealed-path-author
+    # slice fix (test-author, mock-author) — dispatching `type="work"`
+    # sends a plain worker that is forbidden from (and never given the
+    # system prompt authorizing) exactly the `tests/acceptance/**` path it
+    # needs to fix. Derived from SEALED_PATH_AUTHOR_TYPES rather than a
+    # hardcoded string so this stays in sync with that set — see the
+    # FIX_DISPATCH_TYPES comment above for the class of bug that guards
+    # against. Every other source type (including today's "work") keeps
+    # the long-standing "work" fix.
+    fix_type = work.type if work.type in SEALED_PATH_AUTHOR_TYPES else "work"
 
     payload = {
         "repo_name": work.repo_name,
@@ -1054,6 +1168,12 @@ def _dispatch_fix(
         # stay-RED rules a test-author session needs.
         payload["system_prompt"] = TEST_AUTHOR_SYSTEM_PROMPT
         payload["deny_commands"] = test_author_deny_commands(config, work.repo_name)
+    # #2302: no analogous branch for `fix_type == "mock-author"` — unlike
+    # test-author, `agent.py`'s `elif spec.type == "mock-author"` branch
+    # already supplies `MOCK_AUTHOR_SYSTEM_PROMPT` and unconditionally
+    # appends `MOCK_AUTHOR_DENY_COMMANDS` regardless of `spec.deny_commands`,
+    # so injecting either here would be redundant with what the agent-side
+    # dispatch table already does purely from `type="mock-author"`.
     # Escalated model per bounce iteration (None when pipeline
     # .escalate_fix_model is disabled — preserves today's no-model behaviour).
     # The board record keeps the alias for legibility; the wire payload is

{code_coordinator-0.5.105 → code_coordinator-0.5.107}/coord/commands/agent_ops.py

@@ -323,6 +323,28 @@ def _resolve_agent_startup(
         f"coord agent: config source={source} machine={machine.name} "
         f"capabilities={list(machine.capabilities)}"
     )
+    # #2299: say up front whether this process will notice a coordinator.yml
+    # edit, because the answer differs by deployment and the failure mode of
+    # guessing wrong is silent. An agent with a local file re-reads it on the
+    # next /health poll; a thin client has no local file to watch and its repo
+    # list really is fixed for the life of the process. Naming the
+    # restart-only fields here means the journal answers "do I need to
+    # restart?" without anyone having to remember the issue thread.
+    if cfg.path is not None:
+        notices.append(
+            f"coord agent: watching {cfg.path} for edits — repos, repo_paths, "
+            "capabilities, artifact_paths and build_command are re-read on the "
+            "next /health poll, no restart needed (#2299). RESTART-ONLY: "
+            "providers, concurrency (bash_wrap_spawn/first_output_timeout), "
+            "and the bind host/port."
+        )
+    else:
+        notices.append(
+            "coord agent: NOTICE config came from the daemon, not a local "
+            "file — there is nothing on this machine to re-read, so this "
+            "agent's repo list IS fixed until it restarts (#2299)."
+        )
+
     if not machine.capabilities:
         # Declaring no capabilities is legal, but it means dispatch_smoke can
         # never pick this machine for capability-gated work — say so once at

{code_coordinator-0.5.105 → code_coordinator-0.5.107}/coord/commands/dispatch.py

@@ -104,9 +104,14 @@ def _repo_capability_refusal(
     ``assign()``'s ``machine_obj.can_work_on(repo)`` check (just above this
     call site) only ever reads ``coordinator.yml`` — which the operator can
     edit any time — never the agent process actually running on that
-    machine. A repo added to config after the agent started stays invisible
-    to it until a full ``systemctl --user restart coord-agent`` (there is no
-    partial re-read today). Every pre-flight surface an operator would
+    machine. A repo added to config used to stay invisible to a running
+    agent until a full ``systemctl --user restart coord-agent``; since #2299
+    the agent re-reads its own ``coordinator.yml`` on the next ``/health``
+    poll, so the remaining ways the two can disagree are a *stale file* on
+    that machine, a malformed edit the agent refused to adopt, or an agent
+    too old to reload — all of which this refusal still catches, because it
+    compares against live ``/health`` rather than trusting either side.
+    Every pre-flight surface an operator would
     check before spending a dispatch reads config too: ``coord config``,
     ``coord status``, and — worst of all — ``coord assign ... --dry-run``,
     which is the documented way to sanity-check a dispatch before paying
@@ -169,9 +174,14 @@ def _repo_capability_refusal(
     return (
         f"{machine_obj.name!r} rejected the assignment: this agent does "
         f"not handle repo {repo!r} (supported: {live_repos}) — "
-        f"coordinator.yml lists it, but the live agent process hasn't "
-        f"re-read its config since {repo!r} was added (#2219). Restart "
-        f"coord-agent on {machine_obj.name!r} to pick it up, then retry."
+        f"coordinator.yml lists it, but the live agent process is running "
+        f"on a different repo list (#2219). Agents re-read coordinator.yml "
+        f"on their own /health poll since #2299, so retry in a moment "
+        f"first; if it persists, that machine's own copy of the config is "
+        f"stale (`git pull` the settings checkout on "
+        f"{machine_obj.name!r}), the edit is malformed (its journal will "
+        f"say `failed to reload`), or the agent predates #2299 "
+        f"(`coord agent update`)."
     )