code-coordinator 0.5.117__tar.gz → 0.5.119__tar.gz

{code_coordinator-0.5.117 → code_coordinator-0.5.119}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.117
+Version: 0.5.119
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.117 → code_coordinator-0.5.119}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.117
+Version: 0.5.119
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.117 → code_coordinator-0.5.119}/code_coordinator.egg-info/SOURCES.txt

@@ -783,6 +783,15 @@ tests/acceptance/ms-51/home-active.spec.ts
 tests/acceptance/ms-51/manifest.yml
 tests/acceptance/ms-51/tsconfig.json
 tests/acceptance/ms-51/mocks/home-active.html
+tests/acceptance/ms-65/contract.md
+tests/acceptance/ms-65/mocks/board-baseline-no-tabs.screen
+tests/acceptance/ms-65/mocks/board-pinned-3-tabs.screen
+tests/acceptance/ms-65/mocks/board-preview-tab.screen
+tests/acceptance/ms-65/mocks/board-split-side-by-side.screen
+tests/acceptance/ms-65/mocks/board-tab-context-menu.screen
+tests/acceptance/ms-65/mocks/board-tabs-help-overlay.screen
+tests/acceptance/ms-65/mocks/board-tabs-overflow.screen
+tests/acceptance/ms-65/mocks/pipeline-tabs-independent.screen
 tests/acceptance/ms-example/mocks/home-active.html
 tests/fixtures/board-pipeline-basic.json
 tests/fixtures/board-pipeline-terminal-gates.json

{code_coordinator-0.5.117 → code_coordinator-0.5.119}/code_coordinator.egg-info/scm_file_list.json

@@ -428,6 +428,15 @@
     "tests/acceptance/ms-51/manifest.yml",
     "tests/acceptance/ms-51/mocks/home-active.html",
     "tests/acceptance/ms-51/tsconfig.json",
+    "tests/acceptance/ms-65/contract.md",
+    "tests/acceptance/ms-65/mocks/board-baseline-no-tabs.screen",
+    "tests/acceptance/ms-65/mocks/board-pinned-3-tabs.screen",
+    "tests/acceptance/ms-65/mocks/board-preview-tab.screen",
+    "tests/acceptance/ms-65/mocks/board-split-side-by-side.screen",
+    "tests/acceptance/ms-65/mocks/board-tab-context-menu.screen",
+    "tests/acceptance/ms-65/mocks/board-tabs-help-overlay.screen",
+    "tests/acceptance/ms-65/mocks/board-tabs-overflow.screen",
+    "tests/acceptance/ms-65/mocks/pipeline-tabs-independent.screen",
     "tests/acceptance/ms-example/mocks/home-active.html",
     "tests/conftest.py",
     "tests/fixtures/board-pipeline-basic.json",

code_coordinator-0.5.119/code_coordinator.egg-info/scm_version.json

@@ -0,0 +1,8 @@
+{
+  "tag": "0.5.119",
+  "distance": 0,
+  "node": "gb23236717c72c8a9be1338d9e8084ff44e2ae589",
+  "dirty": false,
+  "branch": "HEAD",
+  "node_date": "2026-08-17"
+}

{code_coordinator-0.5.117 → code_coordinator-0.5.119}/coord/agent.py

@@ -3500,10 +3500,14 @@ MILESTONE_CHAT_DENY_COMMANDS: list[str] = [
     "Bash(git push *)",
     "Bash(git commit *)",
     "Bash(git reset --hard *)",
+    "Bash(git reset * --hard *)",
     "Bash(git branch -D *)",
+    "Bash(git branch * -D *)",
     "Bash(git checkout -- .)",
     "Bash(git clean -f *)",
+    "Bash(git clean * -f *)",
     "Bash(rm -rf *)",
+    "Bash(rm -fr *)",
     "Bash(coord approve *)",
     "Bash(coord merge *)",
     "Bash(coord assign *)",
@@ -3575,11 +3579,19 @@ manually verify in the rendered mock.
 MOCK_AUTHOR_DENY_COMMANDS: list[str] = [
     "Bash(gh *)",
     "Bash(git push --force*)",
+    # #2314: the entry above only matches `--force` IMMEDIATELY after
+    # `push` — a `git push --quiet --force ...` with another flag pushed
+    # in first would evade it.
+    "Bash(git push * --force*)",
     "Bash(git reset --hard *)",
+    "Bash(git reset * --hard *)",
     "Bash(git branch -D *)",
+    "Bash(git branch * -D *)",
     "Bash(git checkout -- .)",
     "Bash(git clean -f *)",
+    "Bash(git clean * -f *)",
     "Bash(rm -rf *)",
+    "Bash(rm -fr *)",
     "Bash(coord approve *)",
     "Bash(coord merge *)",
     "Bash(coord assign *)",
@@ -3599,10 +3611,14 @@ NEW_ISSUE_CHAT_DENY_COMMANDS: list[str] = [
     "Bash(git push *)",
     "Bash(git commit *)",
     "Bash(git reset --hard *)",
+    "Bash(git reset * --hard *)",
     "Bash(git branch -D *)",
+    "Bash(git branch * -D *)",
     "Bash(git checkout -- .)",
     "Bash(git clean -f *)",
+    "Bash(git clean * -f *)",
     "Bash(rm -rf *)",
+    "Bash(rm -fr *)",
 ]
 
 
@@ -3637,6 +3653,46 @@ def build_deny_prompt(deny_commands: list[str]) -> str:
     )
 
 
+def bash_deny_pattern_matches(pattern: str, command: str) -> bool:
+    """Whether *command* (a raw shell command string) is caught by a single
+    ``Bash(...)`` deny *pattern*, using the same shell-glob semantics those
+    patterns are written in throughout this module (``*`` matches any run of
+    characters, including none, and including across what would look like an
+    argv token boundary — this is a whole-string glob, not an argv-aware
+    parse).
+
+    #2314: a worker evaded ``Bash(pip install -e *)`` simply by inserting
+    another flag first (``pip install --user -e .``) — the pattern only
+    matched ``-e`` IMMEDIATELY after ``install``. This function exists so
+    that claim ("this deny list actually catches that evasion") is a
+    testable fact rather than something read off the pattern text by eye —
+    see the ``Bash(...)`` entries :data:`coord.config.DEFAULT_DENY_COMMANDS`
+    pairs for exactly this reason, and ``tests/test_worker_safety.py`` for
+    the regression tests built on top of this function.
+
+    Returns ``False`` for a *pattern* that isn't a ``Bash(...)`` rule at all
+    (e.g. an ``Edit(...)``/``Write(...)`` path rule) — those constrain a
+    different tool and never match a shell command string.
+    """
+    if not (pattern.startswith("Bash(") and pattern.endswith(")")):
+        return False
+    inner = pattern[5:-1]
+    return fnmatch.fnmatchcase(command.strip(), inner)
+
+
+def find_denying_bash_pattern(command: str, deny_commands: list[str]) -> str | None:
+    """The first pattern in *deny_commands* that blocks *command*, or ``None``.
+
+    Thin fold over :func:`bash_deny_pattern_matches` — a worker's own deny
+    list is small (single digits to low tens of entries), so a linear scan
+    needs no index.
+    """
+    for pattern in deny_commands:
+        if bash_deny_pattern_matches(pattern, command):
+            return pattern
+    return None
+
+
 # #1315: sealed-oracle path prefix that only an independent authoring type
 # (``"mock-author"``/a future ``"test-author"``) may ever write to
 # (docs/ORACLE_LOOP.md sealing v1). ``coord.dispatch.dispatch`` already

{code_coordinator-0.5.117 → code_coordinator-0.5.119}/coord/agents/opencode/agents/work.md

@@ -63,6 +63,40 @@ there are lost, or collide with other workers running at the same time. If \
 your worktree looks unexpectedly empty or unwritable, STOP and report it — \
 do not fall back to editing the base checkout and copying files over.
 
+Write incrementally — this is the single most important rule in this file:
+- Every request you make has a hard output-token budget, and on a \
+reasoning model those tokens are shared with your own thinking. Truncation \
+can happen at any budget size — raising the ceiling makes it rarer, not \
+impossible — so the rule below holds regardless of what the current limit \
+is.
+- Write each file as soon as its content is decided. Do NOT design the \
+whole change, plan every file, and only then start emitting `write`/`edit` \
+calls — a turn that spends its whole budget reasoning can be truncated \
+before it emits a single tool call. Truncation produces a clean-looking \
+exit with zero commits and nothing on disk: the work is not "mostly done", \
+it is entirely lost, because nothing you only thought about was ever sent \
+as a tool call.
+- Prefer many small steps over one large one: read/understand one file, \
+write it, move to the next. Small increments stay nowhere near the cap; \
+a single-shot "figure out the whole diff, then write it all" turn is what \
+exhausts it.
+- Issue one command per `bash` call — do not chain with `&&`, `;` or `|`. \
+Permission rules are prefix-matched against the whole command string, so \
+`git status && git log` matches no `allow` entry and is denied outright, \
+wasting a turn for nothing. Run `git status`, then separately `git log`.
+- These are the only `bash` commands you can run; everything else is \
+denied, including `pwd`, `ls`, `cat` and `grep` (use your own file-read \
+and search tools for those): `git status`, `git diff`, `git log`, \
+`git show`, `git add`, `git commit`, `git checkout`, `git branch`, \
+`git rev-parse`, `git push`, `cargo …`, `make…`, `pytest…`, \
+`python3 -m pytest…`, `python -m pytest…`, `npm …`, `pip install…`, \
+`pip3 install…`. `gh` is denied — the coordinator owns GitHub.
+- If a `bash` or `edit` call does come back denied, don't probe with \
+variations to find what's allowed — every denial replays the entire \
+permission ruleset back to you, burning output budget you need for \
+`write` calls without telling you anything the list above didn't already \
+say. Take the denial as final and move on.
+
 This session is ONE-SHOT and non-interactive:
 - There is no next turn and no human to reply to you. Background-task \
 completion notifications will NEVER reach you — nothing wakes you up.

{code_coordinator-0.5.117 → code_coordinator-0.5.119}/coord/cli.py

@@ -300,49 +300,80 @@ def _warn_if_source_install_drift() -> None:
         pass
 
 
-def _warn_if_editable_checkout_moved() -> None:
-    """#561/#601 backstop: when running from an EDITABLE checkout, warn loudly if
-    its branch was moved off the default.
-
-    A Build/`coord test`/smoke that git-checkout'd the base — or an interactive
-    agent inspecting a branch in the live checkout — silently puts the running
-    coordinator on that branch's code until restored (#561 incident: disabled
-    guards; #601 incident: old code + retired local DB). This makes that state
-    visible on every command instead of waiting for a verdict or manual restore.
+def _editable_checkout_drift() -> tuple[Path, str] | None:
+    """Pure query behind both #561/#601's CLI warning and #2314's
+    drive-queue tick refusal (:mod:`coord.drive_queue`): is THIS process an
+    EDITABLE checkout of coord, and if so, is it on a branch other than the
+    default one?
+
+    A Build/`coord test`/smoke that git-checkout'd the base — or an
+    interactive agent inspecting a branch in the live checkout — silently
+    puts the running coordinator on that branch's code until restored (#561
+    incident: disabled guards; #601 incident: old code + retired local DB).
+
+    Returns ``(repo_root, shown)`` when drifted — ``shown`` is the branch
+    name formatted the way both callers print it (quoted, or
+    ``"(detached HEAD)"``) — or ``None`` when this is a non-editable/
+    site-packages install, isn't a git checkout at all, is cleanly on
+    ``main``/``master``, or the check itself couldn't be completed (git not
+    on PATH, no ``.git``, a timeout). Every failure mode here is read-only
+    and best-effort, so it degrades to "no drift detected" rather than
+    raising — a flaky read must never itself block a tick or crash a
+    command.
     """
     import subprocess  # noqa: PLC0415
-    import sys as _sys  # noqa: PLC0415
 
-    if "pytest" in _sys.modules:
-        return  # don't add startup noise to the test suite
     try:
         import coord as _coord  # noqa: PLC0415
 
         coord_file = _coord.__file__ or ""
         if "site-packages" in coord_file:
-            return  # PyPI/snapshot install — moving a checkout can't affect it.
+            return None  # PyPI/snapshot install — moving a checkout can't affect it.
         repo_root = Path(coord_file).resolve().parents[1]
         if not (repo_root / ".git").exists():
-            return
+            return None
         head = subprocess.run(
             ["git", "rev-parse", "--abbrev-ref", "HEAD"],
             cwd=str(repo_root), capture_output=True, text=True, timeout=3,
         )
         if head.returncode != 0:
-            return
+            return None
         branch = head.stdout.strip()
         if branch in ("main", "master"):
-            return
+            return None
         shown = "(detached HEAD)" if branch == "HEAD" else f"'{branch}'"
-        click.echo(
-            f"⚠ coord: editable checkout {repo_root} is on {shown}, not the "
-            "default branch — the running coordinator is on THAT code. A "
-            "Build/smoke/test may have checked it out. Restore with:  "
-            f"git -C {repo_root} checkout main",
-            err=True,
-        )
-    except Exception:  # noqa: BLE001 — best-effort, never break the CLI
-        pass
+        return (repo_root, shown)
+    except Exception:  # noqa: BLE001 — best-effort, never break the caller
+        return None
+
+
+def _warn_if_editable_checkout_moved() -> None:
+    """#561/#601 backstop: when running from an EDITABLE checkout, warn loudly if
+    its branch was moved off the default.
+
+    This makes that state visible on every command instead of waiting for a
+    verdict or manual restore. #2314 escalated the SAME underlying reading
+    (:func:`_editable_checkout_drift`) from advisory-only here to a hard
+    refusal inside the drive-queue tick gate — see
+    ``coord.drive_queue.plan_tick``'s ``editable_drift`` parameter — because
+    a warning nobody is watching an unattended tick's log for is not a gate.
+    This function stays as the interactive/human-facing half of that fix.
+    """
+    import sys as _sys  # noqa: PLC0415
+
+    if "pytest" in _sys.modules:
+        return  # don't add startup noise to the test suite
+    drift = _editable_checkout_drift()
+    if drift is None:
+        return
+    repo_root, shown = drift
+    click.echo(
+        f"⚠ coord: editable checkout {repo_root} is on {shown}, not the "
+        "default branch — the running coordinator is on THAT code. A "
+        "Build/smoke/test may have checked it out. Restore with:  "
+        f"git -C {repo_root} checkout main",
+        err=True,
+    )
 
 
 @click.group(help="Multi-agent coordinator for Claude Code workers.")

{code_coordinator-0.5.117 → code_coordinator-0.5.119}/coord/commands/drive_queue.py

@@ -1634,6 +1634,42 @@ def _fetch_cordons() -> dict[str, str]:
         return {}
 
 
+def _fetch_editable_drift() -> tuple[str, str] | None:
+    """``(repo_root, shown)`` when THIS host's own `coord` is an editable
+    checkout that has drifted off its default branch, else ``None`` (#2314).
+
+    Thin wrapper around ``coord.cli._editable_checkout_drift`` — the exact
+    same read `coord.cli._warn_if_editable_checkout_moved` uses for its
+    CLI-startup warning — reshaped to a plain ``(str, str)`` tuple so
+    :func:`coord.drive_queue.plan_tick` (a pure function; see its module
+    docstring) never has to import ``coord.cli`` or touch a ``Path``.
+    Already fail-soft/best-effort at the source (see that function's
+    docstring); this wrapper adds nothing on top beyond the reshape and the
+    ``str(repo_root)`` conversion.
+
+    Same ``"pytest" in sys.modules`` guard as
+    ``_warn_if_editable_checkout_moved`` — for the identical reason: this
+    repo's OWN test suite runs from an editable checkout on a feature
+    branch as a matter of course (that is what a worker's worktree is), so
+    without the guard every CLI-level `drive-queue tick` test would trip
+    this exact gate on itself. `coord.drive_queue.plan_tick`'s own tests
+    (tests/test_drive_queue.py) exercise the real gate logic directly via
+    its ``editable_drift`` parameter, unaffected by this guard.
+    """
+    import sys as _sys  # noqa: PLC0415
+
+    if "pytest" in _sys.modules:
+        return None
+
+    from coord.cli import _editable_checkout_drift  # noqa: PLC0415
+
+    drift = _editable_checkout_drift()
+    if drift is None:
+        return None
+    repo_root, shown = drift
+    return (str(repo_root), shown)
+
+
 def _fetch_board_view() -> BoardView:
     """Board + live drive sessions, typed.
 
@@ -2316,6 +2352,13 @@ def drive_queue_tick(
         # a rollable state.
         cordons = _fetch_cordons()
 
+        # #2314: is THIS host's own `coord` a drifted editable checkout?
+        # Escalates `coord.cli._warn_if_editable_checkout_moved` from an
+        # advisory-only startup warning (nothing unattended ever reads) to
+        # an actual refusal — see `_editable_drift_alert` and `plan_tick`'s
+        # `editable_drift` parameter for the gate itself.
+        editable_drift = _fetch_editable_drift()
+
         # #1794: the clock is the shell's to read, never `coord.drive_queue`'s.
         # It powers the startup grace window on both sides of the tick — a
         # drive launched seconds ago is `starting`, not dead, and cannot be
@@ -2342,6 +2385,7 @@ def drive_queue_tick(
             cordons=cordons,
             live_ci_gate=live_ci_gate,
             live_blocked_gate=live_blocked_gate,
+            editable_drift=editable_drift,
         )
 
         if reconcile_only:

{code_coordinator-0.5.117 → code_coordinator-0.5.119}/coord/config.py

@@ -73,15 +73,66 @@ def is_canonical_config_path(path: Path) -> bool:
 
 
 # Safety-by-default: repos without explicit worker_permissions get this deny-list.
+#
+# #2314: every ``Bash(<verb> <flag> *)`` entry only matches *flag* IMMEDIATELY
+# after *verb* — a worker that inserted one more flag first (or swapped a
+# combined short flag's letter order) sailed straight through undetected. The
+# `git push`/`rm` entries below each pair the original adjacent form with a
+# reordering-safe one (an interior ``*`` before the flag, or — for `rm` — the
+# `-fr` letter-swap of `-rf`); this is the "audit other Bash(...) deny
+# patterns for the same positional weakness" half of #2314, not exhaustive
+# (it does not attempt to catch shell chaining/subshells, which is a
+# different, much larger problem than argv flag position).
 DEFAULT_DENY_COMMANDS: list[str] = [
     "Bash(gh *)",
     "Bash(git push --force *)",
     "Bash(git push -f *)",
+    "Bash(git push * --force *)",
+    "Bash(git push * -f *)",
     "Bash(git reset --hard *)",
+    "Bash(git reset * --hard *)",
     "Bash(git branch -D *)",
+    "Bash(git branch * -D *)",
     "Bash(git checkout -- .)",
     "Bash(git clean -f *)",
+    "Bash(git clean * -f *)",
     "Bash(rm -rf *)",
+    "Bash(rm -fr *)",
+    # #2314: a worker ran `pip install --break-system-packages -e .` — an
+    # editable install of coord's own source re-links (or, combined with
+    # `--user`/`--break-system-packages`, outright shadows) the interpreter
+    # `coord` itself is running under, out from under this and every other
+    # session on the box (see coord/cli.py's
+    # `_warn_if_source_install_drift`/`_editable_checkout_drift`). The old
+    # single `Bash(pip install -e *)` entry only matched `-e` IMMEDIATELY
+    # after `install`, so putting any other flag first evaded it entirely.
+    # Every entry below is duplicated with a leading `*` (covers `python -m
+    # pip install ...` / `python3 -m pip install ...`, which reach the exact
+    # same installer) and, for `-e`/`--editable` specifically, ALSO with an
+    # interior `*` before the flag (covers it appearing anywhere in argv,
+    # not just first) — the adjacent form alone still catches
+    # `pip install -e --break-system-packages .` (the flag being pushed
+    # AFTER `-e` doesn't break the immediate `install -e` adjacency), but
+    # not `pip install --break-system-packages -e .` (something pushed
+    # BEFORE it).
+    "Bash(pip install -e *)",
+    "Bash(*pip install -e *)",
+    "Bash(pip install * -e *)",
+    "Bash(*pip install * -e *)",
+    "Bash(pip install --editable *)",
+    "Bash(*pip install --editable *)",
+    "Bash(pip install * --editable *)",
+    "Bash(*pip install * --editable *)",
+    # `--break-system-packages` / `--user` are denied INDEPENDENTLY of
+    # `-e`/`--editable` — either flag alone, on a perfectly ordinary
+    # non-editable `pip install`, still lets a worker write into (or
+    # reconfigure) the interpreter coord itself runs under. No adjacency
+    # requirement at all: both are boolean flags a real `pip install`
+    # invocation can place anywhere after `install`.
+    "Bash(pip install *--break-system-packages*)",
+    "Bash(*pip install *--break-system-packages*)",
+    "Bash(pip install *--user*)",
+    "Bash(*pip install *--user*)",
 ]
 
 

{code_coordinator-0.5.117 → code_coordinator-0.5.119}/coord/conflict_fix.py

@@ -70,6 +70,13 @@ CONFLICT_FIX_DENY_COMMANDS = [
     "Bash(gh *)",
     "Bash(git push --force *)",
     "Bash(git push -f *)",
+    # #2314: the two entries above only match `--force`/`-f` IMMEDIATELY
+    # after `push` — a `--force-with-lease` push (the sanctioned, allowed
+    # form, see this module's own guidance above) must stay clear, but
+    # `git push --quiet --force ...` / `git push --quiet -f ...` (the flag
+    # pushed after some other one) must not evade the ban either.
+    "Bash(git push * --force *)",
+    "Bash(git push * -f *)",
 ]
 
 

{code_coordinator-0.5.117 → code_coordinator-0.5.119}/coord/deploy/coord-drive-queue.service

@@ -20,14 +20,21 @@
 #
 # COORD_BIN — the runner's own CLI must be a PINNED, NON-EDITABLE install
 # (#1523): worker branch churn must never be able to rewrite the tool that is
-# driving it, mid-run. On dellserver, ~/.local/bin/coord is a symlink into
-# ~/.coord-venv — the SAME venv deploy/coord-agent.service runs `coord agent`
-# from (see install-agent.sh) — so that already satisfies #1523, and it rides
-# the ordinary agent-venv upgrade lane rather than needing its own. Before
-# relying on a fix landing on this host:
+# driving it, mid-run. #2314: ExecStart below points at ~/.coord-venv/bin/coord
+# DIRECTLY, the same way deploy/coord-agent.service, coord-serve.service,
+# coord-notify.service and coord-web.service already do — NOT at
+# ~/.local/bin/coord. On dellserver ~/.local/bin/coord is normally a symlink
+# into that same venv, but it is still just an ordinary path on disk: a
+# worker running `pip install --user` (or an editable `pip install -e .`
+# that lands its own console-script shim there) can silently overwrite it
+# with something that no longer points at the pinned venv at all, and the
+# first this tick would know about that is the next `coord drive-queue tick`
+# running whatever the worker just wrote. Pointing ExecStart at the venv path
+# directly makes that overwrite structurally irrelevant to this unit —
+# nothing a worker does to ~/.local/bin/coord can change what systemd execs.
 #
 #   coord agent update --machine dellserver   # or --all; the standard lane
-#   ~/.local/bin/coord --version              # VERIFY it took — an upgrade
+#   ~/.coord-venv/bin/coord --version         # VERIFY it took — an upgrade
 #                                              # silently no-ops more often
 #                                              # than you would think
 #
@@ -37,15 +44,21 @@
 # stale on 2026-07-29. This unit intentionally does not use that pattern.
 #
 # If you ever install this timer on a DIFFERENT machine, first confirm THAT
-# machine's `coord` is a non-editable install before trusting it unattended:
-#
-#   readlink -f ~/.local/bin/coord
-#   pip show code-coordinator | grep -i editable     # must print NOTHING
-#
-# An editable checkout (e.g. elitebook's dev box, where ~/.local/bin/coord
-# points at ~/src/code-coordinator) lets a worker's branch churn rewrite the
-# runner's own code out from under a live tick. Do not install this unit
-# there. See docs/DRIVE_QUEUE.md.
+# machine actually has a `~/.coord-venv` — the same pinned, non-editable
+# install every other daemon lane already depends on — before trusting it
+# unattended:
+#
+#   readlink -f ~/.coord-venv/bin/coord                  # must resolve INTO
+#                                                         # the venv, not out
+#                                                         # to a checkout
+#   ~/.coord-venv/bin/pip show code-coordinator | grep -i editable
+#                                                         # must print NOTHING
+#
+# An editable ~/.coord-venv (rare, but possible on a dev box someone
+# repointed by hand) lets a worker's branch churn rewrite the runner's own
+# code out from under a live tick just as badly as the ~/.local/bin/coord
+# symlink-overwrite case this fix closes — do not install this unit on a
+# machine whose ~/.coord-venv is editable. See docs/DRIVE_QUEUE.md.
 #
 # Install:
 #   mkdir -p ~/.config/systemd/user
@@ -109,7 +122,7 @@ KillMode=process
 # ceiling (>= the release carrying #1972). A higher global ceiling on an
 # older coord launches two same-repo drives, which stale each other's
 # Test verdicts (#1479) — the exact collision #1972 exists to prevent.
-ExecStart=%h/.local/bin/coord drive-queue tick --max-parallel 4 --config %h/.coord/coordinator.yml
+ExecStart=%h/.coord-venv/bin/coord drive-queue tick --max-parallel 4 --config %h/.coord/coordinator.yml
 # Generous relative to the tick's own ~120s launch-subprocess timeout
 # (_LAUNCH_TIMEOUT_SECONDS in coord/commands/drive_queue.py), but well below
 # the timer's 15-minute cadence (coord-drive-queue.timer) so a genuinely

{code_coordinator-0.5.117 → code_coordinator-0.5.119}/coord/drive_queue.py

@@ -1240,6 +1240,14 @@ class TickPlan:
     # a bool, because a queue that stops with no stated reason is the failure
     # the cordon mechanism exists to stop repeating.
     cordon_reason: str = ""
+    # #2314: non-empty when THIS host's own `coord` is an editable checkout
+    # that has drifted off its default branch (see `editable_drift` on
+    # `plan_tick` and `coord.cli._editable_checkout_drift`), in which case
+    # nothing launched this tick and `launch` is guaranteed None — same
+    # shape as `cordon_reason` and for the same reason: a queue that stops
+    # must say why in a field the shell can render, not just a log line
+    # nobody is watching an unattended tick for.
+    drift_reason: str = ""
 
     @property
     def free_slots(self) -> int:
@@ -2412,6 +2420,37 @@ def _normalized_cordons(cordons: Mapping[str, str] | None) -> dict[str, str]:
     }
 
 
+def _editable_drift_alert(repo_root: str, shown: str) -> QueueAlert:
+    """The queue-level record for "this host's own coord has drifted" (#2314).
+
+    Mirrors :func:`_cordon_alert`: a queue that stops must say why, in the
+    same channel and with the same one-key remedy field. Unlike a cordon
+    (an operator-declared, self-expiring pause) this is an *accident* —
+    something (a Build, a `coord test`/smoke run, an interactive agent
+    poking at the live checkout) git-checked-out this host's editable
+    ``coord`` install onto a non-default branch, and every tick since has
+    been reconciling and launching under whatever code that branch happens
+    to carry. #2314: this used to be advisory-only (a warning at CLI
+    startup nobody unattended is watching for); now it is a hard refusal —
+    a worker branch that silently swaps out the tool driving it is exactly
+    the #561/#601 failure class this whole module exists to avoid adding
+    to.
+    """
+    return QueueAlert(
+        reason=(
+            f"no launch — this host's coord ({repo_root}) is an editable "
+            f"checkout on {shown}, not its default branch — the tick would "
+            "be reconciling and launching under whatever code that branch "
+            "carries. Restore it before anything launches here again."
+        ),
+        details=(
+            "reconciliation (steps 1/1b) still runs — this only refuses to "
+            "launch NEW work, the same posture a release cordon takes",
+        ),
+        command=f"git -C {repo_root} checkout main",
+    )
+
+
 def _cordon_alert(host: str, reason: str) -> QueueAlert:
     """The queue-level record for "this host is cordoned" (#2101 trap E).
 
@@ -2490,6 +2529,7 @@ def plan_tick(
     cordons: Mapping[str, str] | None = None,
     live_ci_gate: Mapping[str, bool] | None = None,
     live_blocked_gate: Mapping[str, bool] | None = None,
+    editable_drift: tuple[str, str] | None = None,
 ) -> TickPlan:
     """Decide one tick.  Pure; the caller executes the returned plan.
 
@@ -2566,6 +2606,20 @@ def plan_tick(
     #2110 deadlock, re-created by the very mechanism meant to end it.  A
     cordoned tick is exactly `--reconcile-only`.
 
+    *editable_drift* is ``(repo_root, shown)`` (a rendered branch label —
+    see :func:`coord.cli._editable_checkout_drift`) when THIS host's own
+    ``coord`` is an editable checkout that has drifted off its default
+    branch, or ``None`` when it hasn't (the overwhelming common case — a
+    release install, or an editable one still cleanly on `main`). #2314:
+    this used to be advisory-only — a warning printed at CLI startup
+    (`coord.cli._warn_if_editable_checkout_moved`) that nothing unattended
+    ever reads. Non-``None`` here launches NOTHING this tick, same posture
+    and same position as a local cordon (checked immediately after it,
+    before capacity) — reconciliation still runs, for the identical #2110
+    reason a cordon doesn't freeze it either. Deliberately host-scoped, not
+    fleet-scoped: a drifted checkout only makes THIS host's tick
+    untrustworthy, not every host's.
+
     *live_ci_gate* maps a `parked` entry's key to whether a FRESH,
     single-entry re-derivation of its gate — computed by the shell THIS
     tick, via :func:`coord.merge_queue.entry_gate_status` with a live
@@ -3018,6 +3072,25 @@ def plan_tick(
             cordon_reason=local_cordon,
         )
 
+    # #2314 step 2c: is THIS host's own `coord` a drifted editable checkout?
+    # Checked right after the cordon (same reasoning: reconciliation must
+    # still run — see the docstring) and, like the cordon, before capacity —
+    # a drifted checkout launches nothing however many slots are free. This
+    # is the escalation of `coord.cli._warn_if_editable_checkout_moved` from
+    # advisory-only to an actual refusal.
+    if editable_drift is not None:
+        drift_repo_root, drift_shown = editable_drift
+        drift_text = f"drifted onto {drift_shown} ({drift_repo_root})"
+        return TickPlan(
+            **plan_base,
+            reconciles=tuple(reconciles),
+            blocked=tuple(blocked),
+            deferrals=(),
+            alert=_editable_drift_alert(drift_repo_root, drift_shown),
+            launch=None,
+            drift_reason=drift_text,
+        )
+
     if capacity - occupied <= 0:
         return TickPlan(
             **plan_base,
@@ -3440,6 +3513,11 @@ def render_plan(plan: TickPlan, *, dry_run: bool = False) -> list[str]:
             f"  no launch — this host is {plan.cordon_reason}; in-flight "
             "drives are draining and the queue resumes once it is rolled"
         )
+    elif plan.drift_reason:
+        # #2314: same "name it or it reads as a mystery" reasoning as the
+        # cordon branch above — this host's own `coord` is untrustworthy
+        # right now, not the queue.
+        lines.append(f"  no launch — this host's coord is {plan.drift_reason}")
     elif plan.capacity and plan.free_slots == 0:
         # Naming the reason matters more here than anywhere else in this
         # render: #1794 was diagnosed entirely from a journal, and "no launch"