code-coordinator 0.5.217__tar.gz → 0.5.218__tar.gz

{code_coordinator-0.5.217 → code_coordinator-0.5.218}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.217
+Version: 0.5.218
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.217 → code_coordinator-0.5.218}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.217
+Version: 0.5.218
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.217 → code_coordinator-0.5.218}/code_coordinator.egg-info/SOURCES.txt

@@ -36,6 +36,7 @@ coord/acceptance_drivers.py
 coord/agent.py
 coord/agent_app.py
 coord/agent_update.py
+coord/approved_work.py
 coord/audit.py
 coord/auto_loop.py
 coord/block_log.py
@@ -364,6 +365,7 @@ tests/test_agent_zero_commit.py
 tests/test_ambient_home_isolation.py
 tests/test_approve_reject_plan.py
 tests/test_approve_usage_gate.py
+tests/test_approved_work_2532.py
 tests/test_assignment_already_recorded_daemon.py
 tests/test_audit_log.py
 tests/test_audit_outcome.py
@@ -770,6 +772,7 @@ tui/src/commands.rs
 tui/src/lib.rs
 tui/src/main.rs
 tui/src/settings.rs
+tui/src/app/approved.rs
 tui/src/app/audit.rs
 tui/src/app/chat.rs
 tui/src/app/data.rs

{code_coordinator-0.5.217 → code_coordinator-0.5.218}/code_coordinator.egg-info/scm_file_list.json

@@ -30,6 +30,7 @@
     "coord/agents/opencode/.gitignore",
     "coord/agents/opencode/agents/work.md",
     "coord/agents/opencode/routing.jsonc",
+    "coord/approved_work.py",
     "coord/audit.py",
     "coord/auto_loop.py",
     "coord/block_log.py",
@@ -434,6 +435,7 @@
     "tests/test_ambient_home_isolation.py",
     "tests/test_approve_reject_plan.py",
     "tests/test_approve_usage_gate.py",
+    "tests/test_approved_work_2532.py",
     "tests/test_assignment_already_recorded_daemon.py",
     "tests/test_audit_log.py",
     "tests/test_audit_outcome.py",
@@ -760,6 +762,7 @@
     "tui/Cargo.lock",
     "tui/Cargo.toml",
     "tui/cargo-config-local-quadraui.toml.example",
+    "tui/src/app/approved.rs",
     "tui/src/app/audit.rs",
     "tui/src/app/chat.rs",
     "tui/src/app/data.rs",

{code_coordinator-0.5.217 → code_coordinator-0.5.218}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.217",
+  "tag": "0.5.218",
   "distance": 0,
-  "node": "gbfdae79e2c8dc4a4bdc2faac45f8212b0f4d4fbf",
+  "node": "ge3d2e92010c272a4de2492c97e24a763480894bd",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-08-22"

code_coordinator-0.5.218/coord/approved_work.py

@@ -0,0 +1,157 @@
+"""``/board``'s ``approved_submissions`` block — the "Approved work items"
+panel's data source (#2532, ms-67 contract §5).
+
+**Why this is server-side.** The TUI is a thin client: it renders what
+``coord serve`` computes and never reads ``coordinator.yml`` or the local
+SQLite DB itself (#2336). The portal bridge's tables live on the *daemon
+host* and are canonical only there (:mod:`coord.portal_store`'s module doc),
+so a client that read them locally would show an empty panel on every
+machine that is not the daemon — which is exactly the failure mode #2532's
+issue body calls out. Everything this module resolves — which submissions
+are approved, which repos their project maps to, how the timestamp is
+spelled — is therefore decided here and shipped as plain JSON.
+
+**What "approved" means today.** A submission whose most recent sign-off
+event carries an ``approved`` verdict. Nothing coord-side consumes those
+events (:func:`coord.portal_sync._consume_verdicts` deliberately leaves an
+``approved`` verdict unhandled pending #2509's policy question), so they
+accumulate as exactly the FIFO backlog the panel exists to work through.
+A later ``changes_requested`` on the same submission takes it back off the
+list — last verdict wins, not "was ever approved".
+
+**Field-name honesty (contract §6.9).** coord-portal's submission schema
+lives in a separate repo that is not visible from here, so the intake fields
+(outcome / audience / done-definition / constraints, plus client and project
+identity) are read out of the read-only customer mirror
+(``portal_submissions.customer_json``, which
+:func:`coord.portal_sync._mirror_event` fills with whatever the portal sent
+minus coord-owned keys) under the contract's own key spelling, with the
+camelCase variant accepted as an alias because the portal is a TypeScript
+worker. A field the portal never sent renders as an empty string — the panel
+shows a blank cell, it does not omit the row or crash. If coord-portal's
+real spelling turns out to be something else entirely, this alias table is
+the one place to correct it.
+"""
+
+from __future__ import annotations
+
+from datetime import datetime, timezone
+from typing import TYPE_CHECKING, Any
+
+if TYPE_CHECKING:  # pragma: no cover - typing only
+    from coord.config import Config
+
+#: The wire keys :class:`ApprovedSubmission` (``tui/src/app/types.rs``)
+#: deserializes without ``#[serde(default)]``, i.e. the ones this module must
+#: always emit even when the mirror has nothing for them.
+_TEXT_FIELD_ALIASES: dict[str, tuple[str, ...]] = {
+    "client": ("client", "client_name", "clientName"),
+    "project_id": ("project_id", "projectId"),
+    "project_label": ("project_label", "projectLabel"),
+    "outcome": ("outcome",),
+    "audience": ("audience",),
+    "done_definition": ("done_definition", "doneDefinition"),
+    "constraints": ("constraints",),
+}
+
+
+def _first_str(mirror: dict[str, Any], keys: tuple[str, ...]) -> str:
+    """The first non-blank string *mirror* has under *keys*, else ``""``.
+
+    Non-string values (a number, a nested object the portal decided to send)
+    are stringified rather than dropped: a rendered-but-odd cell is easier to
+    diagnose from the panel than a silently blank one.
+    """
+    for key in keys:
+        value = mirror.get(key)
+        if isinstance(value, str):
+            if value.strip():
+                return value.strip()
+        elif value is not None and not isinstance(value, (list, dict, bool)):
+            return str(value)
+    return ""
+
+
+def _iso8601(epoch: Any) -> str:
+    """``first_seen_at`` (a float epoch) as ``YYYY-MM-DDTHH:MM:SSZ``.
+
+    The TUI keeps this as a raw string and parses it defensively, so a bad
+    value must degrade to ``""`` rather than raise — a submission with an
+    unreadable timestamp still belongs on the list.
+    """
+    try:
+        stamp = float(epoch)
+    except (TypeError, ValueError):
+        return ""
+    try:
+        return (
+            datetime.fromtimestamp(stamp, tz=timezone.utc)
+            .strftime("%Y-%m-%dT%H:%M:%SZ")
+        )
+    except (OverflowError, OSError, ValueError):
+        return ""
+
+
+def approved_submission_ids() -> set[str]:
+    """Submission ids whose LATEST sign-off verdict is ``approved``.
+
+    Folds :func:`coord.portal_store.signoff_events` (oldest first) into one
+    verdict per submission, so a walked-back approval drops out. Reuses
+    :mod:`coord.portal_sync`'s own verdict readers rather than re-deriving
+    them: the portal's sign-off event shape is not fully pinned down, and two
+    independent guesses at it would drift.
+    """
+    from coord import portal_store  # noqa: PLC0415 — avoid import cycle
+    from coord.portal_sync import (  # noqa: PLC0415
+        _normalize_verdict,
+        _signoff_verdict,
+    )
+
+    latest: dict[str, str] = {}
+    for event in portal_store.signoff_events():
+        submission_id = (event.submission_id or "").strip()
+        if not submission_id:
+            continue
+        verdict = _signoff_verdict(event)
+        if verdict is None:
+            continue
+        latest[submission_id] = _normalize_verdict(verdict)
+    return {sid for sid, verdict in latest.items() if verdict == "approved"}
+
+
+def approved_submissions(config: "Config") -> list[dict[str, Any]]:
+    """The ``/board`` ``approved_submissions`` payload, **oldest first**.
+
+    Oldest-first is the panel's contract (§3c: a FIFO backlog, the longest
+    unactioned sign-off at the top) and comes for free from
+    :func:`coord.portal_store.list_submissions`' own
+    ``first_seen_at ASC, submission_id ASC`` ordering — the tie-break matters
+    because a pull page can land several submissions on the same stamp.
+
+    ``repos`` is resolved here via
+    :meth:`coord.config.PortalConfig.repos_for_project`; an unmapped project
+    yields ``[]``, which the panel renders as "— no mapping —". That is a
+    normal state, not an error, so it never suppresses the row: an operator
+    who cannot see the unmapped submission cannot know to map it.
+    """
+    from coord import portal_store  # noqa: PLC0415 — avoid import cycle
+
+    approved = approved_submission_ids()
+    if not approved:
+        return []
+
+    portal = getattr(config, "portal", None)
+    rows: list[dict[str, Any]] = []
+    for record in portal_store.list_submissions():
+        if record.submission_id not in approved:
+            continue
+        mirror = record.customer if isinstance(record.customer, dict) else {}
+        row: dict[str, Any] = {"submission_id": record.submission_id}
+        for wire_key, aliases in _TEXT_FIELD_ALIASES.items():
+            row[wire_key] = _first_str(mirror, aliases)
+        row["repos"] = (
+            portal.repos_for_project(row["project_id"]) if portal is not None else []
+        )
+        row["received_at"] = _iso8601(record.first_seen_at)
+        rows.append(row)
+    return rows

{code_coordinator-0.5.217 → code_coordinator-0.5.218}/coord/config.py

@@ -1787,6 +1787,21 @@ class NotificationsConfig:
     cold_ceiling_mins: dict[str, float] = field(default_factory=dict)
 
 
+@dataclass(frozen=True)
+class PortalProjectRepo:
+    """One portal-project → coord-repo(s) mapping (ms-67 contract §2).
+
+    ``project_id`` is the portal's own opaque identifier: coord never mints
+    one and never validates its *shape*, only that it is non-empty and
+    declared at most once. ``repos`` must each name a configured
+    ``repos[].name`` — the same cross-reference posture
+    :func:`_validate_dependencies` already applies to ``depends_on``.
+    """
+
+    project_id: str
+    repos: list[str]
+
+
 @dataclass
 class PortalConfig:
     """The outbound client to coord-portal's sync bridge (#2179, ``docs/CUSTOMER_PORTAL.md``).
@@ -1820,6 +1835,28 @@ class PortalConfig:
     # coord.portal_bridge.PortalBridgeClient. A 401 never retries: a bad
     # credential does not become a good one on attempt two.
     max_retries: int = 2
+    # ms-67 contract §2: portal project ↔ coord repo(s). Absent == nothing
+    # mapped == every lookup returns [], which the "Approved work items"
+    # panel renders as its literal "— no mapping —" placeholder rather than
+    # a blank cell. Mapping is *operator* knowledge (which repo a client's
+    # project lands in), so it lives here and not in the portal's schema.
+    project_repos: list[PortalProjectRepo] = field(default_factory=list)
+
+    def repos_for_project(self, project_id: str) -> list[str]:
+        """The coord repo name(s) *project_id* maps to — ``[]`` if unmapped.
+
+        **Never raises.** An unmapped project is a valid, common state (a
+        brand-new portal project the operator has not routed yet), not an
+        error: the caller renders "no mapping", it does not fail. Returns a
+        fresh list so a caller cannot mutate the parsed config.
+        """
+        wanted = (project_id or "").strip()
+        if not wanted:
+            return []
+        for entry in self.project_repos:
+            if entry.project_id == wanted:
+                return list(entry.repos)
+        return []
 
 
 @dataclass
@@ -1920,7 +1957,7 @@ def parse_mapping(raw: Any, *, path: Path | None = None) -> Config:
     pricing = _parse_pricing(raw.get("pricing"))
     health = _parse_health(raw.get("health"))
     notifications = _parse_notifications(raw.get("notifications"))
-    portal = _parse_portal(raw.get("portal"))
+    portal = _parse_portal(raw.get("portal"), {r.name for r in repos})
 
     return Config(
         repos=repos,
@@ -3498,12 +3535,18 @@ _PORTAL_PLAIN_STR_FIELDS = ("base_url",)
 _PORTAL_SECRET_STR_FIELDS = ("bridge_client_id", "bridge_client_secret")
 
 
-def _parse_portal(raw: Any) -> PortalConfig:
+def _parse_portal(raw: Any, repo_names: set[str] | None = None) -> PortalConfig:
     """Parse the optional ``portal:`` block from coordinator.yml (#2179).
 
     An absent block returns a **disabled** :class:`PortalConfig` — unchanged
     behaviour for every existing deployment, and the correct default until
     ``BRIDGE_CLIENT_ID``/``BRIDGE_CLIENT_SECRET`` exist in production.
+
+    *repo_names* (ms-67 contract §2) is the set of configured ``repos[].name``
+    that ``project_repos[*].repos`` entries are cross-checked against, the
+    same way ``reviews.repo_overrides`` already is. ``None`` skips that one
+    check (for callers that parse the block in isolation); every other
+    validation still applies.
     """
     if raw is None:
         return PortalConfig()
@@ -3561,6 +3604,9 @@ def _parse_portal(raw: Any) -> PortalConfig:
             raise ConfigError("portal.max_retries must be a non-negative integer")
         cfg.max_retries = value
 
+    if "project_repos" in raw:
+        cfg.project_repos = _parse_portal_project_repos(raw["project_repos"], repo_names)
+
     if cfg.enabled and not (cfg.base_url and cfg.bridge_client_id and cfg.bridge_client_secret):
         # Half a credential is not a credential — coord-portal's
         # isBridgeAuthorized takes the identical position and fails closed on
@@ -3573,6 +3619,64 @@ def _parse_portal(raw: Any) -> PortalConfig:
     return cfg
 
 
+def _parse_portal_project_repos(
+    raw: Any, repo_names: set[str] | None
+) -> list[PortalProjectRepo]:
+    """Parse ``portal.project_repos`` (ms-67 contract §2).
+
+    Rejects at LOAD, never at use — the same posture every other
+    ``portal.*`` field takes, and the reason
+    :meth:`PortalConfig.repos_for_project` can promise never to raise.
+    """
+    if raw is None:
+        return []
+    if not isinstance(raw, list):
+        raise ConfigError("portal.project_repos must be a list of mappings")
+
+    parsed: list[PortalProjectRepo] = []
+    seen: set[str] = set()
+    for i, entry in enumerate(raw):
+        if not isinstance(entry, dict):
+            raise ConfigError(f"portal.project_repos[{i}] must be a mapping")
+        unknown = sorted(set(entry) - {"project_id", "repos"})
+        if unknown:
+            raise ConfigError(
+                f"unknown portal.project_repos[{i}] option(s): {', '.join(unknown)} "
+                "(valid: project_id, repos)"
+            )
+        project_id = entry.get("project_id")
+        if not isinstance(project_id, str) or not project_id.strip():
+            raise ConfigError(
+                f"portal.project_repos[{i}].project_id must be a non-empty string"
+            )
+        project_id = project_id.strip()
+        if project_id in seen:
+            raise ConfigError(
+                f"portal.project_repos has duplicate project_id {project_id!r}"
+            )
+        seen.add(project_id)
+
+        repos_raw = entry.get("repos")
+        if (
+            not isinstance(repos_raw, list)
+            or not repos_raw
+            or not all(isinstance(r, str) and r.strip() for r in repos_raw)
+        ):
+            raise ConfigError(
+                f"portal.project_repos[{i}].repos must be a non-empty list of repo names"
+            )
+        repos = [r.strip() for r in repos_raw]
+        if repo_names is not None:
+            unknown_repos = [r for r in repos if r not in repo_names]
+            if unknown_repos:
+                raise ConfigError(
+                    f"portal.project_repos[{i}] ({project_id}) references unknown "
+                    f"repos: {unknown_repos}"
+                )
+        parsed.append(PortalProjectRepo(project_id=project_id, repos=repos))
+    return parsed
+
+
 def _parse_providers(raw: Any) -> ProvidersConfig:
     """Parse the optional ``providers:`` block from coordinator.yml.
 

{code_coordinator-0.5.217 → code_coordinator-0.5.218}/coord/deploy/coord-drive-queue.service

@@ -101,6 +101,34 @@ Wants=network-online.target
 [Service]
 Type=oneshot
 KillMode=process
+# #2532: WITHOUT this line the tick inherits the systemd *user manager's*
+# PATH (`/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:
+# /usr/games:/usr/local/games:/snap/bin`), which does NOT contain
+# `~/.cargo/bin` — and rustup installs `cargo` nowhere else. That matters
+# because this tick launches `coord drive`, which runs the oracle-loop trust
+# gate `coord acceptance record` IN-PROCESS on this host, which shells out to
+# the repo's acceptance driver command. For claude-coordinator's `tui/**`
+# route (and quadraui's, and every future cargo-based sealed suite) that
+# command starts with `cargo`, so it exited 127 `cargo: not found` with EMPTY
+# stdout. `coord.acceptance_drivers.run_driver` folds a non-zero exit into
+# its result rather than raising, so zero parsed verdicts became
+# `total=0/passed=0/green=false` and the board recorded a *false red* trust
+# gate with an empty reason string — indistinguishable, from every operator
+# surface, from the worker's code genuinely failing the sealed suite. It cost
+# #2532 a full fix-round dispatch against a branch whose 22 acceptance tests
+# were green the whole time.
+#
+# Ordering mirrors the sibling units on this same host that already got this
+# right (deploy/coord-serve.service, deploy/coord-agent.service,
+# deploy/coord-web-dist-build.service): the pinned `~/.coord-venv/bin` first
+# so nothing can shadow the release that is driving the fleet, then
+# `~/.cargo/bin`, then `~/.local/bin`. NO `.venv/bin` entry appears at all —
+# the #1831 `unit_drift` health check flags any unit whose PATH puts an
+# editable repo checkout ahead of `~/.local/bin` / `~/.coord-venv/bin`.
+# Everything the user manager's default PATH carried (tmux, git, gh, and
+# /snap/bin) is preserved below, so this is a strict superset of what the
+# tick could reach before — nothing it currently finds can go missing.
+Environment=PATH=%h/.coord-venv/bin:%h/.cargo/bin:%h/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin
 # --max-parallel 4 (#2012, raised from 3 in #2057) — the global ceiling,
 # ONE SLOT PER REPO IN THE FLEET: claude-coordinator, quadraui, vimcode,
 # coord-portal. It was 3 because the fleet had three repos when #2012 set

{code_coordinator-0.5.217 → code_coordinator-0.5.218}/coord/portal_store.py

@@ -206,6 +206,34 @@ def unhandled_events(limit: int = 100) -> list[PortalEvent]:
     return [_event_from_row(r) for r in rows]
 
 
+def signoff_events() -> list[PortalEvent]:
+    """Every sign-off event in the inbox, **oldest first** (#2532).
+
+    Deliberately unfiltered by ``handled_at``: an ``approved`` verdict is
+    never marked handled by anything today (see :func:`coord.portal_sync.
+    _consume_verdicts` — it advances its own watermark past one without
+    claiming it), so a ``handled_at IS NULL`` filter would be a no-op that
+    silently becomes wrong the day #2509 decides to consume them.
+
+    Oldest-first is what makes "the LATEST verdict wins" a plain
+    last-write-wins fold in the caller: a submission approved and then
+    walked back with ``changes_requested`` must not still read as approved.
+
+    Matching is on ``kind`` alone (``signoff`` / ``signoff.*``) — the same
+    prefix test :func:`coord.portal_sync._signoff_verdict` applies before it
+    looks at the payload — so this stays a cheap indexed-ish scan and the
+    verdict-shape guesswork lives in exactly one place.
+    """
+    rows = _conn().execute(
+        """
+        SELECT * FROM portal_events
+         WHERE kind = 'signoff' OR kind LIKE 'signoff.%'
+         ORDER BY received_at ASC, rowid ASC
+        """
+    ).fetchall()
+    return [_event_from_row(r) for r in rows]
+
+
 def events_after_verdict_watermark(
     received_at: float, rowid: int, *, limit: int = 100
 ) -> list[tuple[int, PortalEvent]]:

{code_coordinator-0.5.217 → code_coordinator-0.5.218}/coord/serve_app.py

@@ -4100,6 +4100,23 @@ def build_app(store: CoordStore, config: Config, *, token: str | None = None) ->
             # key is structurally unreachable from any of them — see
             # tests/test_health_advisory_only.py.
             projection["fleet_health"] = _fleet_health_refresher.snapshot().to_dict()
+            # #2532 (ms-67 contract §5): portal submissions the client has
+            # signed off on and that are waiting to be decomposed into
+            # coordinator work.  Computed HERE, on the daemon host, because
+            # the portal bridge's SQLite tables are canonical only here
+            # (coord/portal_store.py's module doc) and the `repos` column is
+            # resolved from `coordinator.yml` (#2531's project↔repo map),
+            # which a thin client never reads (#2336).  Same fail-open,
+            # sibling-key posture as `fleet_health` above: an empty list is a
+            # legitimate answer ("nothing approved yet"), so no error here
+            # may 503 the board or blank an otherwise-good projection.
+            try:
+                from coord.approved_work import (  # noqa: PLC0415
+                    approved_submissions as _approved_submissions,
+                )
+                projection["approved_submissions"] = _approved_submissions(_cfg)
+            except Exception:  # noqa: BLE001 — advisory panel, never fatal
+                projection["approved_submissions"] = []
             try:
                 from coord import merge_queue as _mq  # noqa: PLC0415
                 from coord.state import build_board as _build_board  # noqa: PLC0415

{code_coordinator-0.5.217 → code_coordinator-0.5.218}/deploy/coord-drive-queue.service

@@ -101,6 +101,34 @@ Wants=network-online.target
 [Service]
 Type=oneshot
 KillMode=process
+# #2532: WITHOUT this line the tick inherits the systemd *user manager's*
+# PATH (`/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:
+# /usr/games:/usr/local/games:/snap/bin`), which does NOT contain
+# `~/.cargo/bin` — and rustup installs `cargo` nowhere else. That matters
+# because this tick launches `coord drive`, which runs the oracle-loop trust
+# gate `coord acceptance record` IN-PROCESS on this host, which shells out to
+# the repo's acceptance driver command. For claude-coordinator's `tui/**`
+# route (and quadraui's, and every future cargo-based sealed suite) that
+# command starts with `cargo`, so it exited 127 `cargo: not found` with EMPTY
+# stdout. `coord.acceptance_drivers.run_driver` folds a non-zero exit into
+# its result rather than raising, so zero parsed verdicts became
+# `total=0/passed=0/green=false` and the board recorded a *false red* trust
+# gate with an empty reason string — indistinguishable, from every operator
+# surface, from the worker's code genuinely failing the sealed suite. It cost
+# #2532 a full fix-round dispatch against a branch whose 22 acceptance tests
+# were green the whole time.
+#
+# Ordering mirrors the sibling units on this same host that already got this
+# right (deploy/coord-serve.service, deploy/coord-agent.service,
+# deploy/coord-web-dist-build.service): the pinned `~/.coord-venv/bin` first
+# so nothing can shadow the release that is driving the fleet, then
+# `~/.cargo/bin`, then `~/.local/bin`. NO `.venv/bin` entry appears at all —
+# the #1831 `unit_drift` health check flags any unit whose PATH puts an
+# editable repo checkout ahead of `~/.local/bin` / `~/.coord-venv/bin`.
+# Everything the user manager's default PATH carried (tmux, git, gh, and
+# /snap/bin) is preserved below, so this is a strict superset of what the
+# tick could reach before — nothing it currently finds can go missing.
+Environment=PATH=%h/.coord-venv/bin:%h/.cargo/bin:%h/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin
 # --max-parallel 4 (#2012, raised from 3 in #2057) — the global ceiling,
 # ONE SLOT PER REPO IN THE FLEET: claude-coordinator, quadraui, vimcode,
 # coord-portal. It was 3 because the fleet had three repos when #2012 set