code-coordinator 0.5.129__tar.gz → 0.5.131__tar.gz

{code_coordinator-0.5.129 → code_coordinator-0.5.131}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.129
+Version: 0.5.131
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.129 → code_coordinator-0.5.131}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.129
+Version: 0.5.131
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.129 → code_coordinator-0.5.131}/code_coordinator.egg-info/SOURCES.txt

@@ -539,6 +539,7 @@ tests/test_conflict_fix.py
 tests/test_conflict_fix_semantic.py
 tests/test_coord_test.py
 tests/test_coord_test_runner_baseline.py
+tests/test_coord_test_runner_populated_home.py
 tests/test_coord_test_runner_routing.py
 tests/test_coord_test_runner_toolchain.py
 tests/test_coord_web_sse_restart_live.py

{code_coordinator-0.5.129 → code_coordinator-0.5.131}/code_coordinator.egg-info/scm_file_list.json

@@ -581,6 +581,7 @@
     "tests/test_conflict_fix_semantic.py",
     "tests/test_coord_test.py",
     "tests/test_coord_test_runner_baseline.py",
+    "tests/test_coord_test_runner_populated_home.py",
     "tests/test_coord_test_runner_routing.py",
     "tests/test_coord_test_runner_toolchain.py",
     "tests/test_coord_web_sse_restart_live.py",

{code_coordinator-0.5.129 → code_coordinator-0.5.131}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.129",
+  "tag": "0.5.131",
   "distance": 0,
-  "node": "g35ed648ce7ee944d0c954c511918f971ef413bef",
+  "node": "g1b229fc47c746e85d1d360ebe7d49d415f544a8c",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-08-17"

{code_coordinator-0.5.129 → code_coordinator-0.5.131}/coord/agent.py

@@ -785,6 +785,44 @@ def _git(cwd: Path, *args: str, timeout: float = 15.0) -> str:
     return result.stdout.strip()
 
 
+def _remote_already_has_head(
+    wt_path: Path, remote: str, branch: str, *, timeout: float = 30.0
+) -> bool:
+    """True when *remote*'s copy of *branch* already contains the worktree's
+    current ``HEAD`` as an ancestor (#2356).
+
+    Used by `_reap`'s belt-and-suspenders push-failure handling: an
+    auth-shaped failure pushing to *remote* does NOT necessarily mean the
+    worker's commits never reached it — a worker that hit the same broken
+    write-credential wall (e.g. an HTTPS credential helper with nothing to
+    expand in a non-interactive shell) may have already worked around it by
+    pushing the same commit over a different remote/protocol, most commonly
+    an explicit ``git@github.com:...`` SSH URL (the #2269 incident). That
+    push landed on the SAME GitHub-hosted branch this function now checks —
+    it never touches a second remote name in the worktree's own git config.
+
+    Fetching *branch* is a READ operation (``git fetch`` invokes
+    upload-pack, not receive-pack), which commonly still succeeds — via
+    anonymous access on a public repo, or a still-valid read-scoped
+    credential — even when the WRITE credential that just failed the push
+    is broken or missing entirely. So this is a meaningfully independent
+    signal from the push that just failed, not a re-run of the same failing
+    operation.
+
+    Returns ``False`` — never raises — on any git failure: the branch
+    missing on the remote, a network error, or `merge-base` reporting "not
+    an ancestor" all resolve to "unknown/genuinely behind", and an unknown
+    remote state must never suppress the real #1797 failure signal (nothing
+    ever reached the remote).
+    """
+    try:
+        _git(wt_path, "fetch", remote, branch, timeout=timeout)
+        _git(wt_path, "merge-base", "--is-ancestor", "HEAD", "FETCH_HEAD")
+        return True
+    except (_GitError, subprocess.TimeoutExpired):
+        return False
+
+
 def _is_linked_worktree(repo_path: Path) -> bool:
     """True when *repo_path* is a linked ``git worktree`` rather than the
     checkout that owns its ``.git`` directory (#1729, H-6's guard 2).
@@ -2988,7 +3026,14 @@ class AgentAssignment:
     # alongside `status == FAILED`; `None` on every other outcome —
     # including a push failure for an unrelated reason (no `origin`
     # configured, network blip), which stays non-fatal exactly as before
-    # this field was introduced.
+    # this field was introduced, AND (#2356) including an auth-shaped
+    # failure on THIS push that turns out to be superseded: when
+    # `_remote_already_has_head` confirms the content already reached
+    # `origin` via some other remote/protocol (e.g. the #2269 SSH-
+    # workaround case), the push failure is logged but this field stays
+    # `None` and the assignment keeps its normal (non-FAILED) outcome —
+    # the work is where it needs to be, so the failed push here is a
+    # non-event, not a signal.
     #
     # Exists to keep an auth break from being silently absorbed into either
     # DONE (worker had local commits that never reached origin) or the
@@ -8146,12 +8191,54 @@ class AgentServer:
                         # against repos with no `origin` at all (every test
                         # fixture, and any local-only deployment), and that
                         # failure mode must stay non-fatal exactly as before.
+                        #
+                        # #2356: an auth-shaped failure on THIS push doesn't
+                        # necessarily mean the content never reached origin
+                        # — a worker that hit the same broken-credential
+                        # wall may have already landed the same commit via
+                        # an alternate remote/protocol (#2269: an explicit
+                        # SSH URL, worked around a missing HTTPS
+                        # credential). Before promoting to FAILED, check
+                        # whether origin already has local HEAD as an
+                        # ancestor (`_remote_already_has_head` fetches — a
+                        # read, which commonly still works even when the
+                        # write credential just failed). Only genuinely
+                        # missing content — origin behind local HEAD, or the
+                        # check itself failing — is promoted, so #1797's
+                        # original "nothing ever reached origin" case is
+                        # unaffected.
                         _reason = str(e)
+                        _suppressed_as_already_pushed = False
                         if _is_auth_push_failure(_reason):
-                            _push_failure_reason = _reason
+                            _branch_for_check = (
+                                head if head and head != "HEAD" else None
+                            )
+                            if _branch_for_check and _remote_already_has_head(
+                                wt_path, "origin", _branch_for_check
+                            ):
+                                _suppressed_as_already_pushed = True
+                            else:
+                                _push_failure_reason = _reason
                         try:
                             with open(assignment.log_path, "a") as reopen:
-                                reopen.write(f"# reap: push failed ({_reason})\n")
+                                if _suppressed_as_already_pushed:
+                                    # Deliberately NOT the generic "push
+                                    # failed" line below: that line reads as
+                                    # a live failure signal, which this
+                                    # isn't — origin already has HEAD, so
+                                    # the failed push here is a non-event
+                                    # (#2356).
+                                    reopen.write(
+                                        "# reap: push failed but origin "
+                                        "already has HEAD as an ancestor "
+                                        "(pushed via another remote/"
+                                        "protocol?) — treating as success "
+                                        f"({_reason}) (#2356)\n"
+                                    )
+                                else:
+                                    reopen.write(
+                                        f"# reap: push failed ({_reason})\n"
+                                    )
                         except OSError:
                             pass
 

{code_coordinator-0.5.129 → code_coordinator-0.5.131}/scripts/coord-test-runner.sh

@@ -91,6 +91,24 @@
 #     see the long note above `ensure_baseline_worktree` for why the fallback
 #     arm is excluded rather than "not done yet".
 #
+#  7. THE POPULATED-$HOME ARM (#2269).  A branch can be green here and red in
+#     CI's `populated-home` job, and until #2269 whether that was caught
+#     depended on WHICH MACHINE the Test stage landed on.  That job's
+#     environment is SYNTHESIZED by scripts/run_tests_in_populated_home.sh (a
+#     thin-client ~/.coord with no coordinator.yml, no `sqlite3` on PATH, a
+#     $TMPDIR under an ancestor pytest config); this runner otherwise inherits
+#     whatever environment the assigned machine happens to have.  dellserver —
+#     the daemon host — is structurally incapable of reproducing knob 1, so
+#     #2174 passed the Test gate, spent a full adversarial review, and was
+#     caught only when `coord fix` noticed CI disagreed.  So once the ordinary
+#     python arm is green, the test files THE DIFF TOUCHED are re-run through
+#     that same harness.  Diff-scoped because running the suite twice is not
+#     affordable (#2169).  This arm can only ever FAIL, never downgrade: the
+#     harness's own `exit 2` ("a knob failed to take effect") is a
+#     FAIL-with-warning, never a skip.  Python arm only, and it names itself
+#     (`python-populated-home`) in every verdict line it emits, so a red result
+#     is attributable rather than a mystery.
+#
 # Exit codes: 0 pass (or skip — nothing to test), 1 genuine failure or refusal
 # (cannot determine what to test), 2 usage, 3 INFRASTRUCTURE — the suite could
 # not run at all (a required toolchain is missing); no verdict may be inferred
@@ -215,9 +233,77 @@ else
     log "routing: repo=$REPO_NAME — no path rule and no --fallback-command"
 fi
 
+# ── populated-$HOME arm scoping (#2269) ─────────────────────────────────────
+#
+# WHICH FILES. Only the python test files THIS DIFF touched, and only ones that
+# still exist in the worktree (a diff that DELETES a test file must not hand
+# pytest a path that is not there). `tests/acceptance/**` is excluded for the
+# same reason the ordinary arm passes `--ignore=tests/acceptance`: that sealed
+# suite is gated separately through the #2164 `--ci` wrapper, and a
+# red-by-design slice must not fail every concurrent branch.
+#
+# WHY DIFF-SCOPED AND NOT THE WHOLE SUITE. The full suite already exceeds
+# Claude Code's 600s Bash ceiling (#2169); running it a second time under the
+# harness is not on the table. Diff-scoping is what makes this arm affordable —
+# it costs roughly one test FILE's runtime, paid only by branches that touch
+# python tests at all. The always-on cover for the rest of the suite is
+# tests/test_ambient_home_isolation.py (which runs everywhere, on every branch);
+# this arm exists for the case that file cannot cover, a NEWLY WRITTEN test of
+# this class (#2174 was exactly that).
+#
+# Computed HERE, beside the routing decision, rather than inside `run_python`,
+# because `--print-routing` must be able to name the arm before a worker pushes.
+POPULATED_TESTS=""
+POPULATED_COUNT=0
+POPULATED_ARM=0
+POPULATED_SKIP_REASON=""
+
+is_python_test_file() {
+    case "$1" in
+        tests/acceptance/*) return 1 ;;
+        tests/*)            ;;
+        *)                  return 1 ;;
+    esac
+    case "${1##*/}" in
+        test_*.py) return 0 ;;
+        *)         return 1 ;;
+    esac
+}
+
+if [[ "$ROUTE_MODE" == "coordinator" && "$RUN_PY" -eq 1 ]]; then
+    if [[ "$DIFF_FAILED" -eq 1 ]]; then
+        POPULATED_SKIP_REASON="the diff against $BASE_REF could not be computed, so the arm has no scope to run over"
+    else
+        while IFS= read -r f; do
+            [[ -z "$f" ]] && continue
+            is_python_test_file "$f" || continue
+            # Deleted-by-the-diff files are still listed by `git diff --name-only`.
+            [[ -f "$WT/$f" ]] || continue
+            POPULATED_TESTS="${POPULATED_TESTS:+$POPULATED_TESTS }$f"
+            POPULATED_COUNT=$((POPULATED_COUNT + 1))
+        done <<<"$CHANGED"
+        [[ "$POPULATED_COUNT" -gt 0 ]] && POPULATED_ARM=1
+        [[ "$POPULATED_ARM" -eq 0 ]] && \
+            POPULATED_SKIP_REASON="the diff touches no python test files under tests/ (outside the sealed tests/acceptance/)"
+    fi
+elif [[ "$ROUTE_MODE" == "coordinator" ]]; then
+    POPULATED_SKIP_REASON="the python arm is not routed for this diff"
+else
+    POPULATED_SKIP_REASON="the populated-\$HOME arm is this repo's python arm only"
+fi
+
+if [[ "$ROUTE_MODE" == "coordinator" ]]; then
+    if [[ "$POPULATED_ARM" -eq 1 ]]; then
+        log "routing: populated-\$HOME arm (#2269) will re-run $POPULATED_COUNT diff-scoped test file(s): $POPULATED_TESTS"
+    else
+        log "routing: populated-\$HOME arm (#2269) SKIPPED — $POPULATED_SKIP_REASON"
+    fi
+fi
+
 if [[ "$PRINT_ROUTING" -eq 1 ]]; then
     case "$ROUTE_MODE" in
-        coordinator) printf 'ROUTING mode=coordinator pytest=%s cargo=%s\n' "$RUN_PY" "$RUN_RS" ;;
+        coordinator) printf 'ROUTING mode=coordinator pytest=%s cargo=%s populated-home=%s\n' \
+                        "$RUN_PY" "$RUN_RS" "$POPULATED_ARM" ;;
         fallback)    printf 'ROUTING mode=fallback run=%s\n' "$RUN_FALLBACK" ;;
         unknown)     printf 'ROUTING mode=unknown\n' ;;
     esac
@@ -245,6 +331,8 @@ EXIT_INFRA=3
 # baseline is red, so this is not a verdict on the branch either (#2170).
 BASELINE_RED_SUITES=()
 EXIT_BASELINE_RED=4
+# See the note at the dispatch site below.
+PY_FAIL_SUITE="python"
 
 # ── baseline comparison (#2170) ──────────────────────────────────────────────
 #
@@ -570,6 +658,98 @@ run_python_acceptance_ci() {
     return 1
 }
 
+# ── the populated-$HOME arm (#2269) ─────────────────────────────────────────
+#
+# Re-run the diff's own python test files in the environment of a REAL FLEET
+# MACHINE instead of this machine's, using the SAME harness CI's
+# `populated-home` job uses (scripts/run_tests_in_populated_home.sh, from the
+# BRANCH's tree — so a branch that changes the harness is tested against its own
+# version, exactly like CI). See item 7 in the header for why this is not
+# optional: without it, catching this failure class is a property of which
+# machine the Test stage was routed to.
+#
+# THIS ARM ONLY EVER FAILS. It is the mirror image of #2170's baseline check,
+# which only ever downgrades and is therefore deliberately hard to trigger. This
+# one is the STRICT direction, so every ambiguity resolves the other way:
+#
+#   * The harness's own `exit 2` — "a knob failed to take effect", i.e. the
+#     environment it claims to synthesize was not synthesized — is a FAIL with a
+#     warning, NOT a skip. A guard that cannot guard reporting green is the exact
+#     failure mode #2170 exists to prevent, and a Test gate that silently
+#     tolerates it is back to routing luck.
+#   * Any other non-zero exit is a FAIL naming this arm.
+#
+# There is no flake filter here on purpose: these same files went green in the
+# ordinary arm moments ago, so a failure here is by construction environmental,
+# and re-running would only launder it.
+#
+# The two SKIPs it can report (no python test files in the diff; the harness
+# absent from this branch's tree) are announced in the verdict stream and by
+# `--print-routing`, never silent.
+run_python_populated_home() {
+    local venv="$1"
+    local rel="scripts/run_tests_in_populated_home.sh"
+    local script="$WT/$rel"
+
+    if [[ "$POPULATED_ARM" -eq 0 ]]; then
+        say "SKIP(python-populated-home): not run — $POPULATED_SKIP_REASON (#2269)"
+        return 0
+    fi
+    if [[ ! -f "$script" ]]; then
+        # A branch (or a checkout) predating the harness. Skipping is the only
+        # option that does not redden every such branch, but it is stated out
+        # loud rather than inferred from silence.
+        warn "populated-home: $rel is not present in this worktree — the arm cannot run"
+        say "SKIP(python-populated-home): not run — the harness $rel is absent from this branch's tree (#2269)"
+        return 0
+    fi
+
+    local out="$WT/.pytest-populated-home.out"
+    local started=$SECONDS
+    local rc=0
+    log "running: $rel over $POPULATED_COUNT diff-scoped test file(s): $POPULATED_TESTS"
+    # shellcheck disable=SC2086  # the file list is intentionally word-split
+    (cd "$WT" && bash "$script" "$venv/bin/python" -m pytest -q --tb=short $POPULATED_TESTS) \
+        >"$out" 2>&1 || rc=$?
+    local elapsed=$((SECONDS - started))
+
+    if [[ "$rc" -eq 0 ]]; then
+        say "PASS(python-populated-home): $POPULATED_COUNT diff-scoped test file(s) green in a synthesized fleet \$HOME (+${elapsed}s)"
+        return 0
+    fi
+
+    # The harness's own guard failures. `run_tests_in_populated_home.sh`
+    # reserves exit 2 for exactly this case, so check `rc` directly first —
+    # it can't drift out of sync with itself. The message grep is a second,
+    # belt-and-braces signal for a harness that fails this way but exits with
+    # some other code (or an older/forked copy of the script); if the exact
+    # wording ever changes, `rc -eq 2` alone still catches the exit-2 case.
+    # Distinguished from a test failure because the two need different fixes
+    # — but BOTH are a FAIL, so mis-classifying one as the other can only
+    # ever mis-word a red verdict, never hide one.
+    if [[ "$rc" -eq 2 ]] || grep -qE "the guard itself is broken|the guard is too broad|is not thin-client shaped" "$out"; then
+        say "FAIL(python-populated-home): the harness $rel exited $rc because A KNOB FAILED TO TAKE EFFECT — the environment it claims to synthesize (thin-client ~/.coord, no sqlite3, \$TMPDIR under an ancestor pytest config) was not the environment the tests ran in, so a green here would have meant nothing. This is reported as a FAILURE, not a skip, on purpose (#2269)."
+        tail -n 20 "$out" | sed 's/^/      /'
+        return 1
+    fi
+
+    say "FAIL(python-populated-home): $POPULATED_COUNT diff-scoped test file(s) PASS in this machine's ambient environment but FAIL in a synthesized fleet \$HOME (thin-client ~/.coord with no coordinator.yml, no sqlite3 on PATH, \$TMPDIR under an ancestor pytest config) — this is CI's populated-home job's failure class, caught here instead of at the merge gate (#2269). Reproduce with: $rel python -m pytest $POPULATED_TESTS"
+    printf '%s\n' "$POPULATED_TESTS" | tr ' ' '\n' | sed 's/^/      /'
+    tail -n 40 "$out" | sed 's/^/      /'
+    return 1
+}
+
+# The arms that run AFTER the ordinary pytest suite has gone green (or been
+# judged a tolerated flake), in cost order. Short-circuiting on the first
+# failure is deliberate: the verdict is already attributable to a named arm, and
+# there is nothing to learn from paying for the next one.
+run_python_post_arms() {
+    local venv="$1"
+    run_python_acceptance_ci "$venv" || return 1
+    run_python_populated_home "$venv" || { PY_FAIL_SUITE="python-populated-home"; return 1; }
+    return 0
+}
+
 run_python() {
     local venv="$WT/.venv"
     if [[ ! -x "$venv/bin/python" ]]; then
@@ -618,7 +798,7 @@ run_python() {
     # `set -u` on older bash.
     if (cd "$WT" && "$venv/bin/python" -m pytest -q --tb=short --ignore=tests/acceptance ${par[@]+"${par[@]}"}) >"$out" 2>&1; then
         log "ordinary suite: $(grep -oE '[0-9]+ passed[^)]*' "$out" | tail -1)"
-        run_python_acceptance_ci "$venv"
+        run_python_post_arms "$venv"
         return $?
     fi
 
@@ -645,7 +825,7 @@ run_python() {
         say "FLAKE(python): $count test(s) failed in the full run but PASS in isolation"
         printf '%s\n' "$failed" | sed 's/^/      /'
         FLAKES+=("python:$count")
-        run_python_acceptance_ci "$venv"
+        run_python_post_arms "$venv"
         return $?
     fi
 
@@ -854,8 +1034,13 @@ mark_failed() {
     FAILED_SUITES+=("$suite")
 }
 
+# Which name a failing python arm books itself under. "python" for every arm
+# that existed before #2269; the populated-$HOME arm overwrites it with its own
+# name so `RESULT: FAIL (python-populated-home)` says which environment went
+# red, not merely that pytest did (#2269's "a red result is attributable"
+# requirement). It is only ever read after `run_python` returns non-zero.
 if [[ "$RUN_PY" -eq 1 ]]; then
-    run_python || mark_failed python
+    run_python || mark_failed "$PY_FAIL_SUITE"
 fi
 if [[ "$RUN_RS" -eq 1 ]]; then
     run_rust || mark_failed rust

{code_coordinator-0.5.129 → code_coordinator-0.5.131}/tests/test_agent_push_failure.py

@@ -31,6 +31,7 @@ from coord.agent import (
     AgentServer,
     AssignmentSpec,
     _is_auth_push_failure,
+    _remote_already_has_head,
 )
 
 
@@ -40,6 +41,42 @@ def _git(cwd: Path, *args: str) -> str:
     ).stdout.strip()
 
 
+def _write_always_failing_receive_pack(tmp_path: Path) -> Path:
+    """A `receive-pack` replacement that unconditionally fails every push
+    with an auth-shaped error, regardless of whether the push has anything
+    new to send (#2356 review).
+
+    A `pre-receive` hook is the WRONG tool for simulating "reap's own push
+    fails while the remote already has HEAD": git's client-side ref
+    negotiation short-circuits to `Everything up-to-date` (exit 0) whenever
+    local HEAD already matches what the remote advertises, and that
+    short-circuit happens BEFORE a pack is ever sent — so a `pre-receive`
+    hook, which only runs after `receive-pack` unpacks an incoming pack,
+    never gets invoked at all in that case. Verified independently: a
+    `pre-receive`-based rejecting remote lets a same-SHA `git push -u
+    origin HEAD` succeed silently, hook untouched.
+
+    Overriding `remote.<name>.receivepack` instead replaces the
+    `receive-pack` PROGRAM itself, which git invokes unconditionally at the
+    start of every `git push` (for ref advertisement) — before any
+    comparison against what the client already has. It fires every time,
+    including when there is nothing new to send, which is exactly the
+    shape this scenario needs. Deliberately leaves `uploadpack` untouched,
+    so `git fetch` (what `_remote_already_has_head` uses) keeps working
+    normally.
+    """
+    script = tmp_path / "fail_receive_pack.sh"
+    script.write_text(
+        "#!/bin/sh\n"
+        "echo 'remote: Invalid username or token.' >&2\n"
+        "echo 'remote: Password authentication is not supported for "
+        "Git operations.' >&2\n"
+        "exit 1\n"
+    )
+    script.chmod(script.stat().st_mode | stat.S_IEXEC)
+    return script
+
+
 class TestIsAuthPushFailure:
     """Direct unit tests for `_is_auth_push_failure` (#1797 review nit): the
     three FAILED-vs-non-fatal tests above only exercise it indirectly
@@ -98,6 +135,90 @@ class TestIsAuthPushFailure:
         assert _is_auth_push_failure(message) is False
 
 
+def _init_repo(d: Path) -> None:
+    d.mkdir()
+    _git(d, "init", "-b", "main")
+    _git(d, "config", "user.email", "t@t.com")
+    _git(d, "config", "user.name", "Test")
+
+
+def _commit_file(d: Path, name: str, contents: str, message: str) -> None:
+    (d / name).write_text(contents)
+    _git(d, "add", name)
+    _git(d, "commit", "-m", message)
+
+
+class TestRemoteAlreadyHasHead:
+    """Direct unit tests for `_remote_already_has_head` (#2356 review nit):
+    the full-round-trip tests only exercise it indirectly through an entire
+    `AgentServer`/`_reap` cycle, which proves the wiring but not the
+    ancestor-check logic itself in isolation. These pin down the four cases
+    the function's docstring promises: caught up, genuinely behind, branch
+    missing on the remote, and the remote unreachable outright — mirroring
+    `TestIsAuthPushFailure`'s role for `_is_auth_push_failure`.
+    """
+
+    def test_true_when_remote_already_has_head_as_ancestor(
+        self, tmp_path: Path
+    ) -> None:
+        origin = tmp_path / "origin.git"
+        origin.mkdir()
+        _git(origin, "init", "--bare", "-b", "main")
+
+        clone = tmp_path / "clone"
+        _init_repo(clone)
+        _git(clone, "remote", "add", "origin", str(origin))
+        _commit_file(clone, "f", "x\n", "c1")
+        _git(clone, "push", "-u", "origin", "main")
+
+        assert _remote_already_has_head(clone, "origin", "main") is True
+
+    def test_false_when_local_head_is_ahead_of_remote(
+        self, tmp_path: Path
+    ) -> None:
+        """The genuine #1797 shape: local HEAD moved on past whatever the
+        remote has, so the remote does NOT already have this content —
+        must return False so the real failure signal is never suppressed.
+        """
+        origin = tmp_path / "origin.git"
+        origin.mkdir()
+        _git(origin, "init", "--bare", "-b", "main")
+
+        clone = tmp_path / "clone"
+        _init_repo(clone)
+        _git(clone, "remote", "add", "origin", str(origin))
+        _commit_file(clone, "f", "x\n", "c1")
+        _git(clone, "push", "-u", "origin", "main")
+
+        # A second local commit that never reaches origin.
+        _commit_file(clone, "f", "y\n", "c2 (never reaches origin)")
+
+        assert _remote_already_has_head(clone, "origin", "main") is False
+
+    def test_false_when_remote_branch_does_not_exist(
+        self, tmp_path: Path
+    ) -> None:
+        origin = tmp_path / "origin.git"
+        origin.mkdir()
+        _git(origin, "init", "--bare", "-b", "main")
+
+        clone = tmp_path / "clone"
+        _init_repo(clone)
+        _git(clone, "remote", "add", "origin", str(origin))
+        _commit_file(clone, "f", "x\n", "c1")
+        # Never pushed anywhere — "main" doesn't exist on origin at all.
+
+        assert _remote_already_has_head(clone, "origin", "main") is False
+
+    def test_false_when_remote_is_unreachable(self, tmp_path: Path) -> None:
+        clone = tmp_path / "clone"
+        _init_repo(clone)
+        _git(clone, "remote", "add", "origin", str(tmp_path / "does-not-exist"))
+        _commit_file(clone, "f", "x\n", "c1")
+
+        assert _remote_already_has_head(clone, "origin", "main") is False
+
+
 @pytest.fixture
 def repo_with_rejecting_remote(tmp_path: Path) -> tuple[Path, Path]:
     """A working clone whose `origin` rejects every push with a git
@@ -222,6 +343,71 @@ def test_push_failure_with_zero_commits_is_failed_not_advisory(
     server.shutdown()
 
 
+def test_push_failure_when_already_on_origin_via_other_route_is_not_failed(
+    tmp_path: Path, repo_with_rejecting_remote: tuple[Path, Path]
+) -> None:
+    """#2356: a worker that hits the same broken-write-credential wall as
+    #1797 may work around it by landing the same commit on origin via some
+    other route (the #2269 incident: pushing over an explicit SSH URL when
+    the worktree's configured HTTPS remote had no usable credentials in a
+    non-interactive shell). Reap's own belt-and-suspenders push against
+    `origin` still fails with the exact same auth-shaped error in that case
+    — but the content is already on the remote branch.
+
+    The worker lands its own commit on `origin` first (hook briefly
+    lifted — standing in for "reached origin via another path"), THEN we
+    install `_write_always_failing_receive_pack`'s override so reap's own
+    subsequent push — which has nothing new to send, since the worker
+    already pushed this exact SHA — still fails with an auth-shaped error.
+    (A `pre-receive` hook cannot do this: see that helper's docstring for
+    why git's own "nothing to push" short-circuit bypasses it here.) The
+    assignment must land on DONE, not FAILED: the work is exactly where it
+    needs to be, however it got there.
+    """
+    clone, origin = repo_with_rejecting_remote
+    hook = origin / "hooks" / "pre-receive"
+    fail_receive_pack = _write_always_failing_receive_pack(tmp_path)
+
+    worker_sh = (
+        "git config user.email w@w.com && "
+        "git config user.name Worker && "
+        "echo change > change.txt && "
+        "git add change.txt && "
+        "git commit -m 'real work' && "
+        f"chmod -x {hook} && "
+        "git push origin HEAD && "
+        f"chmod +x {hook} && "
+        f"git config remote.origin.receivepack {fail_receive_pack}"
+    )
+    server = AgentServer(
+        machine_name="t",
+        repos=["api"],
+        repo_paths={"api": str(clone)},
+        state_dir=tmp_path / "state",
+        worker_command=lambda spec: ["/bin/sh", "-c", worker_sh],
+    )
+    spec = AssignmentSpec(
+        repo_name="api",
+        repo_path=str(clone),
+        issue_number=4,
+        issue_title="already pushed elsewhere, origin push still broken",
+        briefing="b",
+        branch="main",
+    )
+    a = server.assign(spec)
+    final = server.wait_for(a.id, timeout=15)
+
+    assert final.status == DONE, (
+        "origin already had HEAD (however it got there) — reap's own push "
+        f"failing on top of that must not be FAILED, got {final.status!r}"
+    )
+    assert final.push_failure_reason is None, (
+        "the auth-shaped failure must be suppressed once the fetch-based "
+        "check confirms origin already has HEAD as an ancestor"
+    )
+    server.shutdown()
+
+
 def test_successful_push_leaves_push_failure_reason_none(
     tmp_path: Path, repo_with_rejecting_remote: tuple[Path, Path]
 ) -> None: