code-coordinator 0.5.305__tar.gz → 0.5.307__tar.gz

{code_coordinator-0.5.305 → code_coordinator-0.5.307}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.305
+Version: 0.5.307
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.305 → code_coordinator-0.5.307}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.305
+Version: 0.5.307
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.305 → code_coordinator-0.5.307}/code_coordinator.egg-info/SOURCES.txt

@@ -812,51 +812,4 @@ tests/fixtures/test_report/pytest_collection_error.txt
 tests/fixtures/test_report/pytest_error_string_in_body.txt
 tests/fixtures/test_report/pytest_internal_error.txt
 tests/fixtures/test_report/pytest_mixed_failures.txt
-tests/fixtures/test_report/pytest_no_parseable_failures.txt
-tui/tests/acceptance.rs
-tui/tests/acceptance/ms-33/audit_1039.rs
-tui/tests/acceptance/ms-33/contract.md
-tui/tests/acceptance/ms-33/manifest.yml
-tui/tests/acceptance/ms-33/mocks/audit-panel-detail.screen
-tui/tests/acceptance/ms-33/mocks/audit-panel-empty.screen
-tui/tests/acceptance/ms-33/mocks/audit-panel-filters.screen
-tui/tests/acceptance/ms-33/mocks/audit-panel-populated.screen
-tui/tests/acceptance/ms-38/contract.md
-tui/tests/acceptance/ms-38/manifest.yml
-tui/tests/acceptance/ms-38/plans_detail_1122.rs
-tui/tests/acceptance/ms-38/plans_help_1124.rs
-tui/tests/acceptance/ms-38/plans_rightclick_1123.rs
-tui/tests/acceptance/ms-38/mocks/plans-base.screen
-tui/tests/acceptance/ms-38/mocks/plans-detail-pane.screen
-tui/tests/acceptance/ms-38/mocks/plans-help-overlay.screen
-tui/tests/acceptance/ms-38/mocks/plans-palette.screen
-tui/tests/acceptance/ms-38/mocks/plans-rightclick-epic.screen
-tui/tests/acceptance/ms-38/mocks/plans-rightclick-header.screen
-tui/tests/acceptance/ms-38/mocks/plans-rightclick-stub.screen
-tui/tests/acceptance/ms-65/board_split_2288.rs
-tui/tests/acceptance/ms-65/board_tabs_2282.rs
-tui/tests/acceptance/ms-65/board_tabs_close_2283.rs
-tui/tests/acceptance/ms-65/contract.md
-tui/tests/acceptance/ms-65/detail_substate_2285.rs
-tui/tests/acceptance/ms-65/manifest.yml
-tui/tests/acceptance/ms-65/pipeline_tabs_2284.rs
-tui/tests/acceptance/ms-65/tabs_discoverability_2287.rs
-tui/tests/acceptance/ms-65/tabs_persistence_2286.rs
-tui/tests/acceptance/ms-65/mocks/board-baseline-no-tabs.screen
-tui/tests/acceptance/ms-65/mocks/board-pinned-3-tabs.screen
-tui/tests/acceptance/ms-65/mocks/board-preview-tab.screen
-tui/tests/acceptance/ms-65/mocks/board-split-side-by-side.screen
-tui/tests/acceptance/ms-65/mocks/board-tab-context-menu.screen
-tui/tests/acceptance/ms-65/mocks/board-tabs-help-overlay.screen
-tui/tests/acceptance/ms-65/mocks/board-tabs-overflow.screen
-tui/tests/acceptance/ms-65/mocks/pipeline-tabs-independent.screen
-tui/tests/acceptance/ms-67/approved_items_2532.rs
-tui/tests/acceptance/ms-67/contract.md
-tui/tests/acceptance/ms-67/manifest.yml
-tui/tests/acceptance/ms-67/pull_decomposition_2533.rs
-tui/tests/acceptance/ms-67/manifest.d/2533.yml
-tui/tests/acceptance/ms-67/mocks/approved-items-chat-opened.screen
-tui/tests/acceptance/ms-67/mocks/approved-items-context-menu.screen
-tui/tests/acceptance/ms-67/mocks/approved-items-detail.screen
-tui/tests/acceptance/ms-67/mocks/approved-items-empty.screen
-tui/tests/acceptance/ms-67/mocks/approved-items-populated.screen
+tests/fixtures/test_report/pytest_no_parseable_failures.txt

{code_coordinator-0.5.305 → code_coordinator-0.5.307}/code_coordinator.egg-info/scm_file_list.json

@@ -806,53 +806,6 @@
     "tests/test_worktree.py",
     "tests/test_worktree_rmtree_chokepoint.py",
     "tests/test_write_parity.py",
-    "tests/write_parity.py",
-    "tui/tests/acceptance.rs",
-    "tui/tests/acceptance/ms-33/audit_1039.rs",
-    "tui/tests/acceptance/ms-33/contract.md",
-    "tui/tests/acceptance/ms-33/manifest.yml",
-    "tui/tests/acceptance/ms-33/mocks/audit-panel-detail.screen",
-    "tui/tests/acceptance/ms-33/mocks/audit-panel-empty.screen",
-    "tui/tests/acceptance/ms-33/mocks/audit-panel-filters.screen",
-    "tui/tests/acceptance/ms-33/mocks/audit-panel-populated.screen",
-    "tui/tests/acceptance/ms-38/contract.md",
-    "tui/tests/acceptance/ms-38/manifest.yml",
-    "tui/tests/acceptance/ms-38/mocks/plans-base.screen",
-    "tui/tests/acceptance/ms-38/mocks/plans-detail-pane.screen",
-    "tui/tests/acceptance/ms-38/mocks/plans-help-overlay.screen",
-    "tui/tests/acceptance/ms-38/mocks/plans-palette.screen",
-    "tui/tests/acceptance/ms-38/mocks/plans-rightclick-epic.screen",
-    "tui/tests/acceptance/ms-38/mocks/plans-rightclick-header.screen",
-    "tui/tests/acceptance/ms-38/mocks/plans-rightclick-stub.screen",
-    "tui/tests/acceptance/ms-38/plans_detail_1122.rs",
-    "tui/tests/acceptance/ms-38/plans_help_1124.rs",
-    "tui/tests/acceptance/ms-38/plans_rightclick_1123.rs",
-    "tui/tests/acceptance/ms-65/board_split_2288.rs",
-    "tui/tests/acceptance/ms-65/board_tabs_2282.rs",
-    "tui/tests/acceptance/ms-65/board_tabs_close_2283.rs",
-    "tui/tests/acceptance/ms-65/contract.md",
-    "tui/tests/acceptance/ms-65/detail_substate_2285.rs",
-    "tui/tests/acceptance/ms-65/manifest.yml",
-    "tui/tests/acceptance/ms-65/mocks/board-baseline-no-tabs.screen",
-    "tui/tests/acceptance/ms-65/mocks/board-pinned-3-tabs.screen",
-    "tui/tests/acceptance/ms-65/mocks/board-preview-tab.screen",
-    "tui/tests/acceptance/ms-65/mocks/board-split-side-by-side.screen",
-    "tui/tests/acceptance/ms-65/mocks/board-tab-context-menu.screen",
-    "tui/tests/acceptance/ms-65/mocks/board-tabs-help-overlay.screen",
-    "tui/tests/acceptance/ms-65/mocks/board-tabs-overflow.screen",
-    "tui/tests/acceptance/ms-65/mocks/pipeline-tabs-independent.screen",
-    "tui/tests/acceptance/ms-65/pipeline_tabs_2284.rs",
-    "tui/tests/acceptance/ms-65/tabs_discoverability_2287.rs",
-    "tui/tests/acceptance/ms-65/tabs_persistence_2286.rs",
-    "tui/tests/acceptance/ms-67/approved_items_2532.rs",
-    "tui/tests/acceptance/ms-67/contract.md",
-    "tui/tests/acceptance/ms-67/manifest.d/2533.yml",
-    "tui/tests/acceptance/ms-67/manifest.yml",
-    "tui/tests/acceptance/ms-67/mocks/approved-items-chat-opened.screen",
-    "tui/tests/acceptance/ms-67/mocks/approved-items-context-menu.screen",
-    "tui/tests/acceptance/ms-67/mocks/approved-items-detail.screen",
-    "tui/tests/acceptance/ms-67/mocks/approved-items-empty.screen",
-    "tui/tests/acceptance/ms-67/mocks/approved-items-populated.screen",
-    "tui/tests/acceptance/ms-67/pull_decomposition_2533.rs"
+    "tests/write_parity.py"
   ]
 }

{code_coordinator-0.5.305 → code_coordinator-0.5.307}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.305",
+  "tag": "0.5.307",
   "distance": 0,
-  "node": "g1efaecf9c334685b978b9ee6b0ceb8ed9ca0ab27",
+  "node": "g82fe5f5ab0e0baa2d9fe5b79897b0aa0e7c3c889",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-08-30"

{code_coordinator-0.5.305 → code_coordinator-0.5.307}/coord/commands/release.py

@@ -1449,12 +1449,33 @@ def release_propagate(  # noqa: PLR0912, PLR0915 — a pipeline; the decisions a
         # operator got — "fix by hand" with no hand to follow. When the
         # finding names a host, name the two commands that actually clear
         # it, so nobody has to derive them from scratch under time pressure.
-        remedy = (
-            f" — run `coord agent update --machine {host}` then "
-            f"`coord release cordon --clear {host}`"
-            if host
-            else ""
-        )
+        #
+        # #2963: that fixed remedy is `coord agent update` — which swaps
+        # the venv and nothing else — for EVERY advisory finding, including
+        # ones on the `units` lane (`unit coord-agent.service`, #1831/#1927).
+        # `coord agent update` never installs a unit file, so printing it
+        # for a stale-unit finding sent an operator to run the one command
+        # guaranteed not to fix it (#2938's `Restart=always` fix shipped in
+        # four releases and reached zero hosts' live systemd). The units
+        # lane's own health check (`coord.health.checks.unit_drift`) already
+        # computed the exact per-host, per-unit remedy into `detail` — reuse
+        # it here instead of fabricating a wrong one.
+        lane = str(finding.get("lane") or "")
+        if rp.verify_lane_kind(lane) == rp.LANE_UNITS:
+            own_detail = str(finding.get("detail") or "").strip()
+            remedy = (
+                f" — {own_detail}"
+                if own_detail
+                else " — run `coord release propagate --lane units` to "
+                "install it (mask-safe since #2812)"
+            )
+        else:
+            remedy = (
+                f" — run `coord agent update --machine {host}` then "
+                f"`coord release cordon --clear {host}`"
+                if host
+                else ""
+            )
         click.echo(
             f"  ~ advisory [{finding.get('severity')}] {host} "
             f"{finding.get('lane')}: {finding.get('summary')} "

{code_coordinator-0.5.305 → code_coordinator-0.5.307}/coord/dispatch.py

@@ -17,7 +17,7 @@ from coord.comments import (
     format_refused_policy,
 )
 from coord.config import Config
-from coord.models import Proposal, Repo
+from coord.models import Proposal, Repo, coordinator_owned_docs
 
 AGENT_PORT = 7433
 
@@ -582,9 +582,14 @@ def dispatch(
         deny_commands = repo.worker_permissions.deny
 
     # Resolve coordinator-only files (workers must not read or modify these).
-    files_forbidden: list[str] = []
-    if repo is not None and repo.coordinator_only_files:
-        files_forbidden = list(repo.coordinator_only_files)
+    # #2966: coordinator_only_files was set by zero repos fleet-wide, so this
+    # started empty for every work dispatch and only ever grew sealed
+    # acceptance paths below — never a doc. coordinator_owned_docs() unions
+    # in a fleet-wide default (the repo's own CLAUDE.md) regardless of
+    # whether coordinator_only_files is configured, so "only the coordinator
+    # writes docs" is enforced (advisory, like every non-oracle
+    # files_forbidden entry) without depending on 10 repos' worth of config.
+    files_forbidden: list[str] = coordinator_owned_docs(repo)
 
     # #944 sealing v1 (docs/ORACLE_LOOP.md): the acceptance oracle is
     # read-only/run-only for the worker — it's authored by an independent

{code_coordinator-0.5.305 → code_coordinator-0.5.307}/coord/models.py

@@ -423,6 +423,50 @@ CLOSES_ISSUE_TYPES: frozenset[str] = frozenset({"work"})
 # which must also list it since it mutates GitHub via `gh pr create`.
 PR_HELPER_TYPE = "pr-helper"
 
+# #2966: "only the coordinator writes docs" (this repo's CLAUDE.md says so
+# for every worker) was text-only enforcement — `Repo.coordinator_only_files`
+# is the config key that was clearly designed to seed a work dispatch's
+# `files_forbidden` with the repo's shared docs (see `coord.dispatch.dispatch`
+# lines around #587), but it was set by ZERO of the fleet's 10 repos, so
+# `files_forbidden` started empty for every work dispatch and only ever
+# gained sealed acceptance paths (#944), never a doc. Two workers in the same
+# repo consequently rewrote the same CLAUDE.md section in the same week,
+# producing a semantic (prose) merge conflict that stalled a five-issue
+# cross-repo chain for ~98 ticks until an operator intervened.
+#
+# Mirror the #944 sealed-paths fix for the same class of problem: don't
+# depend on every operator remembering to configure this per repo. A repo's
+# own rulebook is auto-forbidden unconditionally — `coordinator_owned_docs()`
+# below UNIONS this default in regardless of what `coordinator_only_files`
+# says, the same way sealed acceptance paths are auto-added regardless of
+# `coordinator_only_files` (`coord.dispatch.dispatch`'s #944 comment).
+COORDINATOR_OWNED_DOC_DEFAULTS: tuple[str, ...] = ("CLAUDE.md",)
+
+
+def coordinator_owned_docs(repo: "Repo | None") -> list[str]:
+    """Coordinator-only doc paths for *repo* (#2966).
+
+    Returns :data:`COORDINATOR_OWNED_DOC_DEFAULTS` UNIONED with *repo*'s own
+    ``coordinator_only_files`` (if any), deduped and order-preserving
+    (defaults first). Callers use this instead of reading
+    ``repo.coordinator_only_files`` directly so the fleet-wide default keeps
+    applying even for the common case — today, every repo — where
+    ``coordinator_only_files`` is unset.
+
+    #1388-style fail-open: some ``Repo``-shaped stand-ins (a
+    wire-reconstructed object, or a stale install predating this field)
+    don't carry ``coordinator_only_files`` at all — ``getattr`` with a
+    default treats that the same as "unset" rather than raising, matching
+    how ``dispatch_review`` already tolerates a stand-in missing
+    ``develop_branch``.
+    """
+    result: list[str] = list(COORDINATOR_OWNED_DOC_DEFAULTS)
+    if repo is not None:
+        for f in getattr(repo, "coordinator_only_files", None) or []:
+            if f not in result:
+                result.append(f)
+    return result
+
 
 def trust_issue_closed_for(assignment_type: str | None) -> bool:
     """Whether :func:`coord.github_ops.work_is_terminal` may trust

{code_coordinator-0.5.305 → code_coordinator-0.5.307}/coord/review.py

@@ -48,6 +48,7 @@ from coord.models import (
     Assignment,
     Board,
     Machine,
+    coordinator_owned_docs,
     trust_issue_closed_for,
 )
 from coord.refine_chat import MAX_CLAUDE_MD_CHARS
@@ -1558,6 +1559,7 @@ def build_review_briefing(
     diff_text: str | None = None,
     sealed_paths: list[str] | None = None,
     sealed_entrypoints: list[str] | None = None,
+    coordinator_doc_paths: list[str] | None = None,
     assignment_type: str = "work",
     provider_same_as_worker: bool = False,
     review_provider: str | None = None,
@@ -1632,6 +1634,18 @@ def build_review_briefing(
     is expected and non-blocking. Every other type (default ``"work"``) keeps
     the original rule unchanged: any touch to *sealed_paths* is mandatory
     ``request-changes``.
+
+    *coordinator_doc_paths* (#2966) is the repo's coordinator-owned doc set —
+    :func:`coord.models.coordinator_owned_docs`, the repo's own CLAUDE.md plus
+    anything it additionally lists under ``coordinator_only_files``. CLAUDE.md
+    already states "only the coordinator writes docs" for every worker, but
+    that was prose-only: nothing structurally backstopped it, and two workers
+    independently rewriting the same CLAUDE.md section produced a semantic
+    merge conflict that stalled a five-issue chain (#2966). Unlike
+    *sealed_paths*, this rule never inverts — no assignment type's job is
+    ever editing the repo's own rulebook, so any diff that touches one of
+    these paths is mandatory ``request-changes`` regardless of
+    *assignment_type*.
     """
 
     lines: list[str] = []
@@ -1829,6 +1843,43 @@ def build_review_briefing(
                     "this is a hard rule, not a suggestion (docs/ORACLE_LOOP.md)."
                 )
 
+    if coordinator_doc_paths:
+        # #2966: "only the coordinator writes docs" was prose-only — nothing
+        # backstopped it structurally, and two workers independently
+        # rewrote the same CLAUDE.md section in the same week, producing a
+        # semantic (prose) merge conflict that stalled a five-issue chain.
+        # This rule never inverts by assignment_type (unlike sealed_paths
+        # above): no dispatched worker type's job is ever editing the
+        # repo's own rulebook.
+        lines.append("")
+        touched_docs = (
+            _diff_touched_sealed_paths(diff_text, coordinator_doc_paths)
+            if diff_text else []
+        )
+        if touched_docs:
+            lines.append("## \U0001f6a8 COORDINATOR-OWNED DOC EDITED")
+            lines.append("")
+            lines.append(
+                "The diff modifies a coordinator-owned doc: "
+                + ", ".join(f"`{p}`" for p in touched_docs)
+                + ". \"Only the coordinator writes docs\" — a worker must "
+                "never edit the repo's own rulebook or other shared docs; "
+                "parallel doc edits from independent workers collide "
+                "(#2966). **request-changes is mandatory here**, regardless "
+                "of anything else in this diff — even if the edit itself "
+                "looks correct in isolation."
+            )
+        else:
+            lines.append("## Coordinator-owned docs (do not touch)")
+            lines.append("")
+            lines.append(
+                "This repo reserves "
+                + ", ".join(f"`{p}`" for p in coordinator_doc_paths)
+                + " for the coordinator (#2966). If the diff modifies any of "
+                "them, **request-changes** — this is a hard rule, not a "
+                "suggestion, regardless of assignment type."
+            )
+
     lines.append("")
     lines.append("## What to do")
     lines.append("")
@@ -2637,6 +2688,12 @@ def dispatch_review(
     sealed_paths = config.acceptance.sealed_paths(completed.repo_name)
     sealed_entrypoints = config.acceptance.entrypoints(completed.repo_name)
 
+    # #2966: coordinator-owned docs (repo's own CLAUDE.md plus anything it
+    # additionally lists under coordinator_only_files) — see
+    # coordinator_owned_docs' docstring for why this doesn't depend on the
+    # repo actually configuring coordinator_only_files.
+    coordinator_doc_paths = coordinator_owned_docs(repo)
+
     client = http_client or httpx
 
     # Iterate candidates in priority order.  On agent rejection (4xx from a
@@ -2706,6 +2763,7 @@ def dispatch_review(
             diff_text=diff_text,
             sealed_paths=sealed_paths,
             sealed_entrypoints=sealed_entrypoints,
+            coordinator_doc_paths=coordinator_doc_paths,
             assignment_type=completed.type,
         )
 

{code_coordinator-0.5.305 → code_coordinator-0.5.307}/tests/test_cli_release_propagate.py

@@ -1434,6 +1434,61 @@ def test_the_outside_reach_message_names_the_manual_remedy(
     assert "coord release cordon --clear laptop" in result.output
 
 
+def test_a_stale_unit_advisory_names_the_units_remedy_not_agent_update(
+    valid_config_path, state_dir, no_network, monkeypatch
+):
+    """#2963: a `unit ...` lane finding (`coord.health.checks.unit_drift`,
+    #1831/#1927) got the exact same fixed remedy as every other advisory —
+    `coord agent update --machine <host>` — even though that command only
+    swaps the venv and never touches `~/.config/systemd/user/`. Followed
+    literally it does nothing for a stale unit, which is how #2938's
+    `Restart=always` fix (shipped four releases ago) reached zero hosts'
+    live systemd: every `--lane python` run reported '✓ verified' with the
+    units gap present only as a silenced advisory pointing at the wrong fix.
+
+    The health check itself already computes the correct, host-specific
+    remedy into `Finding.detail` (see `unit_drift.py`'s `cp ... &&
+    systemctl --user restart ...` / templated-`sed` remedies) — this must be
+    surfaced instead of a fabricated one."""
+    from coord import release_verify as rv
+
+    _stub_lanes(monkeypatch)
+    _stub_verify(
+        monkeypatch,
+        versions={"laptop": ["0.4.110"], "server": ["0.4.110"]},
+        daemon="server",
+        findings=[
+            rv.Finding(
+                severity="warn",
+                host="laptop",
+                lane="unit coord-agent.service",
+                summary="stale — installed 240h ago, 39 line(s) differ",
+                detail=(
+                    "cp /deploy/coord-agent.service "
+                    "~/.config/systemd/user/coord-agent.service && "
+                    "systemctl --user daemon-reload && systemctl --user "
+                    "restart coord-agent   # reference: packaged coord 0.4.111"
+                ),
+            ),
+        ],
+    )
+    # #1831: units are rolled by their OWN lane (`POST /deploy-units`), never
+    # by the python lane — `--lane python` here reproduces the exact
+    # invocation from #2963's repro, which is also this fleet's normal
+    # manual-release habit (the auto timer is disabled, per
+    # docs/AGENT_OPERATIONS.md). The units lane is therefore never part of
+    # this run's `attempted_scope`, so the finding lands as advisory.
+    result = CliRunner().invoke(
+        main,
+        ["release", "propagate", "--config", str(valid_config_path),
+         "--target", "0.4.111", "--lane", "python"],
+    )
+    assert result.exit_code == 0, result.output
+    assert "advisory" in result.output
+    assert "coord agent update --machine laptop" not in result.output
+    assert "systemctl --user restart coord-agent" in result.output
+
+
 def test_a_crit_on_a_lane_this_run_rolled_still_reverts(valid_config_path, state_dir,
                                                         no_network, monkeypatch):
     """Scoping the gate is not removing it."""

{code_coordinator-0.5.305 → code_coordinator-0.5.307}/tests/test_dispatch.py

@@ -302,7 +302,10 @@ class TestDispatch:
         )
         dispatch(proposal, cfg)
         payload = mock_post.call_args.kwargs["json"]
-        assert payload["files_forbidden"] == ["README.md", "CHANGELOG.md"]
+        # #2966: CLAUDE.md is unioned in as a fleet-wide default ahead of
+        # the repo's own configured coordinator_only_files — see
+        # coord.models.coordinator_owned_docs.
+        assert payload["files_forbidden"] == ["CLAUDE.md", "README.md", "CHANGELOG.md"]
 
     @patch("coord.dispatch.httpx.post")
     def test_payload_auto_seals_acceptance_dir_when_driver_configured(
@@ -404,7 +407,33 @@ class TestDispatch:
         mock_post.return_value = mock_resp
         dispatch(proposal, config)
         payload = mock_post.call_args.kwargs["json"]
-        assert payload["files_forbidden"] == []
+        # #2966: no acceptance driver and no coordinator_only_files configured
+        # still carries the fleet-wide doc default (CLAUDE.md) — the source
+        # list is never actually empty, unlike pre-#2966.
+        assert payload["files_forbidden"] == ["CLAUDE.md"]
+
+    @patch("coord.dispatch.httpx.post")
+    def test_payload_forbids_claude_md_by_default(
+        self, mock_post: MagicMock, proposal: Proposal,
+    ) -> None:
+        """#2966: repo.coordinator_only_files is set by zero repos fleet-wide,
+        so files_forbidden must not depend on it to protect the repo's own
+        rulebook — CLAUDE.md is auto-forbidden the same way sealed acceptance
+        paths are auto-added regardless of config (#944)."""
+        mock_resp = MagicMock()
+        mock_resp.json.return_value = {"ok": True}
+        mock_post.return_value = mock_resp
+
+        cfg = Config(
+            repos=[Repo(name="api", github="acme/api")],
+            machines=[Machine(
+                name="laptop", host="laptop.tailnet", repos=["api"],
+                repo_paths={"api": "/home/user/src/api"},
+            )],
+        )
+        dispatch(proposal, cfg)
+        payload = mock_post.call_args.kwargs["json"]
+        assert "CLAUDE.md" in payload["files_forbidden"]
 
     @patch("coord.dispatch.httpx.post")
     def test_payload_acceptance_seal_dedupes_with_coordinator_only_files(

{code_coordinator-0.5.305 → code_coordinator-0.5.307}/tests/test_models.py

@@ -158,3 +158,44 @@ def test_is_policy_refusal_reason_fails_open_on_anything_else(text):
     from coord.models import is_policy_refusal_reason
 
     assert is_policy_refusal_reason(text) is False
+
+
+# ── #2966: coordinator_owned_docs — "only the coordinator writes docs" ──────
+
+
+def test_coordinator_owned_docs_defaults_to_claude_md_when_unconfigured():
+    """coordinator_only_files was set by zero repos fleet-wide — the fleet
+    default must not depend on it."""
+    from coord.models import coordinator_owned_docs
+
+    repo = Repo(name="api", github="acme/api")
+    assert coordinator_owned_docs(repo) == ["CLAUDE.md"]
+
+
+def test_coordinator_owned_docs_unions_configured_files_after_default():
+    from coord.models import coordinator_owned_docs
+
+    repo = Repo(
+        name="api", github="acme/api",
+        coordinator_only_files=["README.md", "CLAUDE.md", "CHANGELOG.md"],
+    )
+    # Dedupe: CLAUDE.md is already in the default, so it must not repeat.
+    assert coordinator_owned_docs(repo) == ["CLAUDE.md", "README.md", "CHANGELOG.md"]
+
+
+def test_coordinator_owned_docs_handles_none_repo():
+    from coord.models import coordinator_owned_docs
+
+    assert coordinator_owned_docs(None) == ["CLAUDE.md"]
+
+
+def test_coordinator_owned_docs_fails_open_on_repo_stand_in_missing_attribute():
+    """#1388-style stand-in: a Repo-shaped object predating this field must
+    not raise AttributeError — same fail-open discipline as develop_branch."""
+    from coord.models import coordinator_owned_docs
+
+    class _StandInRepo:
+        name = "api"
+        github = "acme/api"
+
+    assert coordinator_owned_docs(_StandInRepo()) == ["CLAUDE.md"]

{code_coordinator-0.5.305 → code_coordinator-0.5.307}/tests/test_operational_defaults.py

@@ -300,7 +300,11 @@ def test_dispatch_includes_coordinator_only_files_in_forbidden() -> None:
         assert payload["files_forbidden"] == ["CLAUDE.md", "coordinator.yml"]
 
 
-def test_dispatch_with_no_coordinator_only_files_sends_empty_forbidden() -> None:
+def test_dispatch_with_no_coordinator_only_files_still_forbids_claude_md() -> None:
+    """#2966: coordinator_only_files was set by zero repos fleet-wide, so
+    files_forbidden must not depend on it to protect the repo's own
+    rulebook — see coord.models.coordinator_owned_docs. The source list is
+    never actually empty any more, unlike pre-#2966."""
     from coord.dispatch import dispatch
 
     repo = Repo(name="api", github="acme/api")
@@ -315,4 +319,4 @@ def test_dispatch_with_no_coordinator_only_files_sends_empty_forbidden() -> None
         dispatch(proposal, cfg)
 
         payload = mock_post.call_args.kwargs["json"]
-        assert payload["files_forbidden"] == []
+        assert payload["files_forbidden"] == ["CLAUDE.md"]

{code_coordinator-0.5.305 → code_coordinator-0.5.307}/tests/test_review.py

@@ -652,6 +652,88 @@ def test_diff_touched_sealed_paths_no_match() -> None:
     assert _diff_touched_sealed_paths(diff, ["tests/acceptance/"]) == []
 
 
+# ── #2966: coordinator-owned doc tamper check ───────────────────────────────
+#
+# "Only the coordinator writes docs" was prose-only — repo.coordinator_only_
+# files was set by zero repos fleet-wide, so nothing structurally backstopped
+# a worker rewriting the repo's own CLAUDE.md. Mirrors the #944 sealed-paths
+# tamper checks above, but the rule never inverts by assignment_type: no
+# dispatched type's job is ever editing the rulebook.
+
+def test_briefing_no_coordinator_doc_paths_by_default() -> None:
+    briefing = build_review_briefing(
+        pr_number=42, pr_url=None, repo_github="acme/api", repo_name="api",
+        issue_number=7, issue_title="X", issue_body="",
+        branch="my-branch", worker_machine="laptop", same_as_worker=False,
+        reviews_cfg=ReviewsConfig(enabled=True), repo_claude_md=None,
+    )
+    assert "COORDINATOR-OWNED" not in briefing
+    assert "Coordinator-owned docs" not in briefing
+
+
+def test_briefing_coordinator_doc_reminder_when_diff_untouched() -> None:
+    diff = (
+        "diff --git a/src/foo.py b/src/foo.py\n"
+        "@@ -1,2 +1,3 @@\n"
+        "+added_line = 1\n"
+    )
+    briefing = build_review_briefing(
+        pr_number=42, pr_url=None, repo_github="acme/api", repo_name="api",
+        issue_number=2966, issue_title="X", issue_body="",
+        branch="my-branch", worker_machine="laptop", same_as_worker=False,
+        reviews_cfg=ReviewsConfig(enabled=True), repo_claude_md=None,
+        diff_text=diff,
+        coordinator_doc_paths=["CLAUDE.md"],
+    )
+    assert "## Coordinator-owned docs (do not touch)" in briefing
+    assert "CLAUDE.md" in briefing
+    assert "COORDINATOR-OWNED DOC EDITED" not in briefing
+
+
+def test_briefing_flags_tamper_when_diff_touches_coordinator_doc() -> None:
+    diff = (
+        "diff --git a/CLAUDE.md b/CLAUDE.md\n"
+        "--- a/CLAUDE.md\n"
+        "+++ b/CLAUDE.md\n"
+        "@@ -1,2 +1,3 @@\n"
+        "+some rewritten rule\n"
+    )
+    briefing = build_review_briefing(
+        pr_number=42, pr_url=None, repo_github="acme/api", repo_name="api",
+        issue_number=2966, issue_title="X", issue_body="",
+        branch="my-branch", worker_machine="laptop", same_as_worker=False,
+        reviews_cfg=ReviewsConfig(enabled=True), repo_claude_md=None,
+        diff_text=diff,
+        coordinator_doc_paths=["CLAUDE.md"],
+    )
+    assert "COORDINATOR-OWNED DOC EDITED" in briefing
+    assert "CLAUDE.md" in briefing
+    assert "request-changes is mandatory" in briefing
+
+
+def test_briefing_coordinator_doc_tamper_does_not_invert_for_test_author() -> None:
+    """Unlike sealed_paths, this rule never flips for test-author/mock-author
+    — no dispatched type's job is ever editing the repo's own rulebook."""
+    diff = (
+        "diff --git a/CLAUDE.md b/CLAUDE.md\n"
+        "--- a/CLAUDE.md\n"
+        "+++ b/CLAUDE.md\n"
+        "@@ -1,2 +1,3 @@\n"
+        "+some rewritten rule\n"
+    )
+    briefing = build_review_briefing(
+        pr_number=42, pr_url=None, repo_github="acme/api", repo_name="api",
+        issue_number=2966, issue_title="X", issue_body="",
+        branch="my-branch", worker_machine="laptop", same_as_worker=False,
+        reviews_cfg=ReviewsConfig(enabled=True), repo_claude_md=None,
+        diff_text=diff,
+        coordinator_doc_paths=["CLAUDE.md"],
+        assignment_type="test-author",
+    )
+    assert "COORDINATOR-OWNED DOC EDITED" in briefing
+    assert "request-changes is mandatory" in briefing
+
+
 # ── #1175: test-author/mock-author inverse tamper check ────────────────────
 
 
@@ -1833,6 +1915,34 @@ def test_dispatch_review_flags_sealed_acceptance_dir_when_driver_configured(
     assert "tests/acceptance/" in payload["briefing"]
 
 
+def test_dispatch_review_flags_coordinator_owned_docs_without_config(
+    two_machine_config: Config,
+) -> None:
+    """#2966: dispatch_review must thread coordinator_doc_paths through to
+    the briefing for EVERY repo, not just ones that configure
+    coordinator_only_files — two_machine_config's "api" repo sets neither."""
+    board = Board()
+    completed = _completed_assignment(machine="laptop")
+    client = _FakeHTTPClient({"id": "review-id-1"})
+
+    dispatch_review(
+        completed, board, two_machine_config,
+        http_client=client,
+        pr_lookup=lambda repo_github, **kw: {
+            "number": 42, "url": "https://github.com/acme/api/pull/42", "existed": True,
+        },
+        claude_md_reader=lambda p: None,
+        issue_body_fetcher=lambda repo, num: "",
+        now=123.0,
+        remote_branch_checker=lambda repo, branch: True,
+    )
+
+    assert len(client.calls) == 1
+    _, payload = client.calls[0]
+    assert "Coordinator-owned docs (do not touch)" in payload["briefing"]
+    assert "CLAUDE.md" in payload["briefing"]
+
+
 def test_dispatch_review_threads_assignment_type_for_test_author_exemption(
     two_machine_config: Config,
 ) -> None: