code-coordinator 0.5.551__tar.gz → 0.5.553__tar.gz

{code_coordinator-0.5.551 → code_coordinator-0.5.553}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.551
+Version: 0.5.553
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.551 → code_coordinator-0.5.553}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.551
+Version: 0.5.553
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.551 → code_coordinator-0.5.553}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.551",
+  "tag": "0.5.553",
   "distance": 0,
-  "node": "g4a9a986d2a2bc934495d202b1197b82782c1d73f",
+  "node": "g08b8bc7ce4b5def5fdf426d91f30704832a6c88b",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-10-01"

{code_coordinator-0.5.551 → code_coordinator-0.5.553}/coord/config.py

@@ -427,6 +427,20 @@ class AcceptanceDriverConfig:
     ``pytest tests/acceptance/{ms}`` legitimately has no entry point, which
     is exactly why #1175's blanket refusal only ever broke the Rust route.
 
+    #3509: the four Tier-2 lane kinds (:data:`TIER2_LANE_KINDS` —
+    ``tui-pty``/``win-native``/``mac-native``/``gtk-native``) are the one
+    exception to "folded into the sealed set" above. Their ``entrypoint:``
+    is a smoke spec that ``coord bugbash`` (#3487) expects every fix to
+    GROW, with no independent ``test-author`` the way ``tests/acceptance/``
+    has one — full sealing made it impossible for a ``type="work"`` worker
+    to add the smoke-spec step its own fix is required to ship. See
+    :meth:`AcceptanceConfig.sealed_paths` and
+    :meth:`AcceptanceConfig.additive_only_entrypoints` for the derived sets,
+    and :func:`coord.review._lane_entrypoint_violation_lines` for the
+    mandatory (but narrower) rule that still applies: additions are
+    unrestricted, but removing or rewriting a pre-existing line is still a
+    mandatory ``request-changes``.
+
     ``match`` and ``routes`` implement #1125's in-repo path routing: a repo
     entry with a non-empty ``routes`` list is a *router* — its own
     ``kind``/``run``/``mock``/``capability``/``setup``/``entrypoint`` are
@@ -469,6 +483,20 @@ class AcceptanceDriverConfig:
 # directory without the trailing slash.
 SEALED_ACCEPTANCE_DIR = "tests/acceptance/"
 
+# #3509: the four Tier-2 (epic #3482) platform-lane acceptance driver kinds
+# whose `entrypoint:` is a smoke spec `coord bugbash` (#3487) grows one step
+# at a time, not an oracle a `test-author` writes once and a worker is
+# graded against — see `AcceptanceConfig.sealed_paths`'s docstring for why
+# that makes full sealing wrong for exactly these four kinds. Kept in sync
+# with `coord.bugbash.LANE_DRIVER_KINDS` by hand rather than imported — the
+# same hand-sync discipline `coord.acceptance_drivers.SUPPORTED_KINDS` and
+# `coord.bugbash.LANE_DRIVER_KINDS` already use for each other, for the same
+# reason: `coord.bugbash` deliberately takes a duck-typed `config: Any`
+# rather than importing this (foundational, widely-imported) module, so
+# this module returns the favor instead of introducing a config->feature
+# dependency from the other side.
+TIER2_LANE_KINDS = frozenset({"tui-pty", "win-native", "mac-native", "gtk-native"})
+
 
 def entrypoint_sibling_acceptance_dir(entrypoint: str) -> str:
     """The ``acceptance/`` directory an entrypoint-linked driver ``include!``s
@@ -496,6 +524,27 @@ class AcceptanceConfig:
 
     drivers: dict[str, AcceptanceDriverConfig] = field(default_factory=dict)
 
+    def _entrypoint_kind_pairs(self, repo_name: str) -> list[tuple[str, str]]:
+        """``(entrypoint, kind)`` for every declared entrypoint of
+        *repo_name*, deduped on the entrypoint, declaration order preserved
+        — the one traversal :meth:`entrypoints`, :meth:`sealed_paths` and
+        (#3509) :meth:`additive_only_entrypoints` all build on, so "which
+        driver kind owns this entrypoint" is answered in exactly one place
+        rather than three copies of the same ``for cfg in [entry,
+        *entry.routes]`` walk silently drifting apart.
+        """
+        entry = self.drivers.get(repo_name)
+        if entry is None:
+            return []
+        out: list[tuple[str, str]] = []
+        seen: set[str] = set()
+        for cfg in [entry, *entry.routes]:
+            ep = cfg.entrypoint.strip()
+            if ep and ep not in seen:
+                seen.add(ep)
+                out.append((ep, cfg.kind))
+        return out
+
     def entrypoints(self, repo_name: str) -> list[str]:
         """Every ``entrypoint:`` declared by *repo_name*'s acceptance driver
         (#1552), deduped, declaration order preserved.
@@ -508,16 +557,31 @@ class AcceptanceConfig:
         flat repo contributes at most its own. Repos with no driver — and
         drivers whose suite is directory-discovered (``cli-pytest``) —
         return ``[]``.
+
+        Includes Tier-2 lane-kind entrypoints (:data:`TIER2_LANE_KINDS`) —
+        this is "every entrypoint the repo declares", not "every SEALED
+        entrypoint"; use :meth:`sealed_paths` for the sealed subset and
+        :meth:`additive_only_entrypoints` for the lane-kind one (#3509).
         """
-        entry = self.drivers.get(repo_name)
-        if entry is None:
-            return []
-        out: list[str] = []
-        for cfg in [entry, *entry.routes]:
-            ep = cfg.entrypoint.strip()
-            if ep and ep not in out:
-                out.append(ep)
-        return out
+        return [ep for ep, _kind in self._entrypoint_kind_pairs(repo_name)]
+
+    def additive_only_entrypoints(self, repo_name: str) -> list[str]:
+        """(#3509) The subset of :meth:`entrypoints` declared by a Tier-2
+        lane-kind driver (``tui-pty``/``win-native``/``mac-native``/
+        ``gtk-native``, :data:`TIER2_LANE_KINDS`) — deliberately excluded
+        from :meth:`sealed_paths`, see that method's docstring for why.
+
+        These paths are not a free-for-all: :func:`coord.review
+        ._lane_entrypoint_violation_lines` still mandatorily rejects a
+        ``type="work"`` diff that removes or rewrites a pre-existing line in
+        one of them (a deleted step, a loosened ``expect_*`` field, a raised
+        latency budget, a shortened idle window) — only ADDING to them (a
+        new step, or a wholly new spec file beside them) is unrestricted.
+        """
+        return [
+            ep for ep, kind in self._entrypoint_kind_pairs(repo_name)
+            if kind in TIER2_LANE_KINDS
+        ]
 
     def sealed_paths(self, repo_name: str) -> list[str]:
         """The full sealed-oracle path set for *repo_name* (#944 sealing v1,
@@ -554,11 +618,33 @@ class AcceptanceConfig:
         standalone ``coord-tui`` repo's flat ``tests/acceptance.rs``) has
         that sibling collapse onto ``SEALED_ACCEPTANCE_DIR`` itself — see the
         dedup below.
+
+        #3509: a Tier-2 lane-kind entrypoint (:data:`TIER2_LANE_KINDS` —
+        ``tui-pty``/``win-native``/``mac-native``/``gtk-native``) is
+        deliberately excluded from this set, entrypoint AND sibling dir
+        both. Those four kinds' ``entrypoint:`` is a smoke spec
+        ``coord bugbash`` (#3487) files findings against on the acceptance
+        line "the fix must add a Tier-1 shared conformance scenario or a
+        Tier-2 smoke-spec step that fails first" — a regression ratchet
+        every fix is expected to GROW, with no independent author the way
+        ``tests/acceptance/`` has one. Full sealing made that structurally
+        impossible: a ``type="work"`` diff adding the very step its own fix
+        requires tripped the same mandatory tamper banner as rewriting the
+        oracle it's graded against. Excluded here does not mean
+        unrestricted — :func:`coord.review._lane_entrypoint_violation_lines`
+        (fed by :meth:`additive_only_entrypoints`) still mandatorily rejects
+        a diff that removes or weakens a pre-existing line in one of these
+        files; only growing them is unconstrained. ``tui-tuidriver`` and
+        ``cli-pytest`` are unaffected — neither kind is in
+        :data:`TIER2_LANE_KINDS`, so their entrypoints stay fully sealed
+        exactly as before.
         """
         if not self.has_driver(repo_name):
             return []
         out = [SEALED_ACCEPTANCE_DIR]
-        for ep in self.entrypoints(repo_name):
+        for ep, kind in self._entrypoint_kind_pairs(repo_name):
+            if kind in TIER2_LANE_KINDS:
+                continue
             if ep not in out:
                 out.append(ep)
             sibling = entrypoint_sibling_acceptance_dir(ep)
@@ -3908,10 +3994,15 @@ def _parse_acceptance_routes(
 def _acceptance_entrypoint(entry: dict, label: str) -> str:
     """Validate an acceptance driver's optional ``entrypoint:`` (#1552).
 
-    Must be a repo-root-relative *file* path — it is folded into the sealed
-    set as an exact-match entry (:meth:`AcceptanceConfig.sealed_paths`), so
-    an absolute path or a trailing-slash directory would silently seal
-    nothing at all. Reject both here rather than at review time, where the
+    Must be a repo-root-relative *file* path — for most ``kind`` values it
+    is folded into the sealed set as an exact-match entry
+    (:meth:`AcceptanceConfig.sealed_paths`), so an absolute path or a
+    trailing-slash directory would silently seal nothing at all. (#3509:
+    the four Tier-2 lane kinds in :data:`TIER2_LANE_KINDS` are the one
+    exception — their entrypoint is additive-only, not sealed — but the
+    same validation still applies: a malformed path there would just as
+    silently defeat :meth:`AcceptanceConfig.additive_only_entrypoints`.)
+    Reject both malformations here rather than at review time, where the
     only symptom would be a `test-author` bounced for a scope violation it
     cannot fix.
     """

{code_coordinator-0.5.551 → code_coordinator-0.5.553}/coord/reports.py

@@ -69,6 +69,7 @@ import io
 import json
 import re
 import time
+import zipfile
 from collections.abc import Callable, Iterable, Mapping, Sequence
 from dataclasses import dataclass, field
 from datetime import datetime, timezone
@@ -4995,6 +4996,39 @@ def _xlsx_cell(value: Any, meta: Mapping[str, Any] | None = None) -> Any:
     return str(value)
 
 
+#: Fixed stamp used in place of "now" everywhere `result_to_xlsx` would
+#: otherwise embed a save-time timestamp: `openpyxl` stamps
+#: `docProps/core.xml` (`created`/`modified`) and every zip entry's
+#: `date_time` with the wall-clock time *at save*, at one-second
+#: resolution — so two saves of the identical report that straddle a
+#: second boundary produce different bytes (#3500). Pinning both to this
+#: constant (the oldest timestamp the zip format can represent) makes
+#: `result_to_xlsx` a pure function of its input: identical reports produce
+#: byte-identical files, so they can be diffed.
+_XLSX_FIXED_STAMP = datetime(1980, 1, 1, 0, 0, 0)
+
+
+def _zero_xlsx_zip_timestamps(data: bytes) -> bytes:
+    """Rewrite every zip entry's `date_time` in a saved `.xlsx` to the fixed
+    stamp, leaving contents untouched. `openpyxl` has no option to pin this
+    itself, so it has to be done as a post-processing pass over the bytes
+    it produced (#3500)."""
+    stamp = _XLSX_FIXED_STAMP.timetuple()[:6]
+    src = io.BytesIO(data)
+    dst = io.BytesIO()
+    with (
+        zipfile.ZipFile(src, "r") as zin,
+        zipfile.ZipFile(dst, "w", zipfile.ZIP_DEFLATED) as zout,
+    ):
+        for item in zin.infolist():
+            payload = zin.read(item.filename)
+            info = zipfile.ZipInfo(item.filename, date_time=stamp)
+            info.compress_type = item.compress_type
+            info.external_attr = item.external_attr
+            zout.writestr(info, payload)
+    return dst.getvalue()
+
+
 def result_to_xlsx(result: "ReportResult | Mapping[str, Any]") -> bytes:
     """Serialise a :class:`ReportResult` as an ``.xlsx`` workbook.
 
@@ -5033,6 +5067,12 @@ def result_to_xlsx(result: "ReportResult | Mapping[str, Any]") -> bytes:
     totals = data.get("totals")
 
     wb = Workbook()
+    # openpyxl otherwise stamps docProps/core.xml with wall-clock "now" at
+    # save, which makes two saves of the same report byte-unequal whenever
+    # they straddle a second boundary (#3500). Pin both to a fixed stamp so
+    # `result_to_xlsx` is a pure function of `result`.
+    wb.properties.created = _XLSX_FIXED_STAMP
+    wb.properties.modified = _XLSX_FIXED_STAMP
     sheet = wb.active
     sheet.title = "Report"
     if columns:
@@ -5064,7 +5104,7 @@ def result_to_xlsx(result: "ReportResult | Mapping[str, Any]") -> bytes:
 
     buf = io.BytesIO()
     wb.save(buf)
-    return buf.getvalue()
+    return _zero_xlsx_zip_timestamps(buf.getvalue())
 
 
 def xlsx_filename(result: "ReportResult | Mapping[str, Any]") -> str:

{code_coordinator-0.5.551 → code_coordinator-0.5.553}/coord/review.py

@@ -1475,6 +1475,108 @@ def _diff_paths_outside_sealed(diff_text: str, sealed_paths: list[str]) -> list[
     )
 
 
+_DIFF_GIT_HEADER_RE = re.compile(r"^diff --git a/(.*) b/(.*)$")
+
+
+def _diff_removed_content_lines(diff_text: str, path: str) -> list[str]:
+    """Removed (``-``) content lines touching *path* in *diff_text* (#3509).
+
+    Scoped to the ``diff --git`` block(s) whose ``a/``/``b/`` side names
+    *path* exactly, so an unrelated file's deletions elsewhere in a
+    multi-file diff never leak in — mirrors
+    :func:`_sealed_to_sealed_rename_exemptions`'s per-block scoping, just
+    walking line-by-line instead of regex-splitting the whole diff, since
+    callers here want ordered content, not just a yes/no per sealed prefix.
+    Excludes diff/hunk header noise (``--- a/X``, ``+++ b/X``, ``@@ ... @@``)
+    — only a line starting with a single ``-`` is a real removed line.
+
+    A wholly new file has no removed lines by construction: a ``+++
+    b/path`` hunk against ``/dev/null`` is 100% ``+`` lines. A pure rename
+    with no content change has none either (nothing in the renamed block is
+    a ``-``/``+`` content line at all). So this returns ``[]`` for both —
+    exactly the cases #3509 calls "unrestricted growth", never flagged.
+    """
+    removed: list[str] = []
+    in_block = False
+    for line in diff_text.splitlines():
+        header = _DIFF_GIT_HEADER_RE.match(line)
+        if header is not None:
+            in_block = path in (header.group(1), header.group(2))
+            continue
+        if not in_block:
+            continue
+        if line.startswith("-") and not line.startswith("---"):
+            removed.append(line[1:])
+    return removed
+
+
+def _lane_entrypoint_violation_lines(
+    diff_text: str | None,
+    additive_only_entrypoints: list[str] | None,
+) -> tuple[list[str] | None, list[str]]:
+    """(#3509) Detect a MANDATORY violation of a Tier-2 lane-kind
+    (``tui-pty``/``win-native``/``mac-native``/``gtk-native``) smoke-spec
+    entry point's additive-only rule.
+
+    Unlike ``tests/acceptance/`` and the ``tui-tuidriver``/``cli-pytest``
+    entry points, *additive_only_entrypoints*
+    (:meth:`coord.config.AcceptanceConfig.additive_only_entrypoints` —
+    deliberately excluded from :meth:`coord.config.AcceptanceConfig.
+    sealed_paths` by #3509) is not sealed: a diff may add new steps, or
+    whole new spec files beside it, freely. What it must never do is remove
+    or rewrite a line that already existed — ``coord bugbash``'s whole
+    ratchet (#3487) depends on every fix GROWING the smoke spec, never
+    shrinking it, so a fix that "passes" by deleting the step it should
+    have made pass instead (or loosening an ``expect_*`` field, raising a
+    latency budget, shortening an idle window — all of which read,
+    textually, as a removed line) must be rejected exactly as hard as an
+    outright deletion.
+
+    Detection is deliberately conservative and line-based, not
+    YAML-semantic: ANY removed content line inside one of these files
+    (:func:`_diff_removed_content_lines`) is treated as a violation — the
+    same "anything beyond pure addition is suspect" shape the existing
+    test-author entry-point "additive registration only" guidance already
+    uses (see ``build_review_briefing``'s ``sealed_entrypoints`` branch).
+    The difference here is this one is MANDATORY and applies to every
+    assignment type, not just advisory text for a browsing reviewer: there
+    is no independent author ever expected to revisit this file, so a
+    false negative here is permanent, not caught at a later authoring step.
+
+    Returns ``(touched_paths, banner_lines)`` the moment a removal is found
+    in any entry, else ``(None, [])`` — including when
+    *additive_only_entrypoints* is empty, *diff_text* is empty, or every
+    touch is purely additive (a brand-new file, or only ``+`` lines
+    appended to an existing one).
+    """
+    if not additive_only_entrypoints or not diff_text:
+        return None, []
+    touched = [
+        p for p in additive_only_entrypoints
+        if _diff_removed_content_lines(diff_text, p)
+    ]
+    if not touched:
+        return None, []
+    lines = [
+        "## \U0001f6a8 SMOKE-SPEC ENTRY POINT WEAKENED",
+        "",
+        (
+            "The diff removes or rewrites existing line(s) in this repo's "
+            "Tier-2 lane smoke-spec entry point: "
+            + ", ".join(f"`{p}`" for p in touched)
+            + " (#3509). This file is additive-only: new steps and new spec "
+            "files beside it are expected and welcome, but deleting or "
+            "weakening an existing step — a removed step, a removed or "
+            "loosened `expect_*` field, a raised latency budget, a "
+            "shortened idle window — defeats the whole point of `coord "
+            "bugbash`'s regression ratchet (#3487): every fix is expected "
+            "to grow this spec, never shrink it. **request-changes is "
+            "mandatory here**, regardless of anything else in this diff."
+        ),
+    ]
+    return touched, lines
+
+
 # ── #3180: mandatory-verdict detection, shared by the briefing text AND the
 # dispatch-time mechanical short-circuit ────────────────────────────────────
 #
@@ -1597,17 +1699,24 @@ def _mechanical_mandatory_verdict(
     sealed_paths: list[str] | None,
     sealed_entrypoints: list[str] | None,
     coordinator_doc_paths: list[str] | None,
+    additive_only_entrypoints: list[str] | None = None,
 ) -> tuple[str, list[str], list[str]] | None:
     """(#3180) The single check `dispatch_review` runs BEFORE spending a
     review leg: does this diff already, mechanically, trip a MANDATORY
     request-changes rule?
 
     Checks the coordinator-doc rule first (it never inverts by assignment
-    type, per `build_review_briefing`'s docstring) and only then the sealed-
-    path rule (which does invert for `SEALED_PATH_AUTHOR_TYPES`). Returns
-    ``(kind, touched_paths, banner_lines)`` — *kind* is ``"coordinator_doc"``
-    or ``"sealed_path"``, used only to label the mechanical verdict's own
-    ``verdict_source_reason`` — the instant either fires, else ``None``.
+    type, per `build_review_briefing`'s docstring), then the sealed-path
+    rule (which does invert for `SEALED_PATH_AUTHOR_TYPES`), then (#3509)
+    the Tier-2 lane-kind additive-only rule — a `*additive_only_entrypoints*`
+    path is never in `sealed_paths`, so a diff confined to one never trips
+    the sealed-path check above; this is the only check standing between it
+    and a worker silently deleting the smoke-spec step its own fix should
+    have made pass. Returns ``(kind, touched_paths, banner_lines)`` — *kind*
+    is ``"coordinator_doc"``, ``"sealed_path"``, or
+    ``"lane_entrypoint_weakened"``, used only to label the mechanical
+    verdict's own ``verdict_source_reason`` — the instant any of the three
+    fires, else ``None``.
     """
     touched_docs, doc_lines = _coordinator_doc_violation_lines(
         diff_text, coordinator_doc_paths
@@ -1619,6 +1728,11 @@ def _mechanical_mandatory_verdict(
     )
     if touched_sealed:
         return "sealed_path", touched_sealed, sealed_lines
+    touched_lane, lane_lines = _lane_entrypoint_violation_lines(
+        diff_text, additive_only_entrypoints
+    )
+    if touched_lane:
+        return "lane_entrypoint_weakened", touched_lane, lane_lines
     return None
 
 
@@ -1920,6 +2034,7 @@ def build_review_briefing(
     diff_text: str | None = None,
     sealed_paths: list[str] | None = None,
     sealed_entrypoints: list[str] | None = None,
+    additive_only_entrypoints: list[str] | None = None,
     coordinator_doc_paths: list[str] | None = None,
     assignment_type: str = "work",
     provider_same_as_worker: bool = False,
@@ -2001,6 +2116,19 @@ def build_review_briefing(
     the original rule unchanged: any touch to *sealed_paths* is mandatory
     ``request-changes``.
 
+    *additive_only_entrypoints* (#3509) is the Tier-2 lane-kind subset
+    (``tui-pty``/``win-native``/``mac-native``/``gtk-native``,
+    :meth:`coord.config.AcceptanceConfig.additive_only_entrypoints`) that is
+    deliberately NOT part of *sealed_paths* at all — a work diff may add new
+    steps, or whole new spec files beside one, freely. Unlike
+    *sealed_entrypoints*'s advisory-only guidance above, this one IS
+    mechanically enforced (:func:`_lane_entrypoint_violation_lines`, applied
+    for every assignment type, not just non-authors): a diff that removes or
+    rewrites a pre-existing line in one of these files gets the same
+    mandatory ``request-changes`` banner a sealed-path tamper would,
+    regardless of *assignment_type* — see that function's docstring for why
+    there is no "the author's job is to write here" inversion for this one.
+
     *coordinator_doc_paths* (#2966) is the repo's coordinator-owned doc set —
     :func:`coord.models.coordinator_owned_docs`, the repo's own CLAUDE.md plus
     anything it additionally lists under ``coordinator_only_files``. CLAUDE.md
@@ -2319,6 +2447,43 @@ def build_review_briefing(
                     "this is a hard rule, not a suggestion (docs/ORACLE_LOOP.md)."
                 )
 
+    if additive_only_entrypoints:
+        # #3509: unlike sealed_paths above, this one applies to EVERY
+        # assignment type the same way — there is no "the author's job is
+        # to write here" inversion, since no assignment type's job is ever
+        # editing an existing step. Computed via the same helper
+        # `dispatch_review`'s mechanical short-circuit uses — see
+        # `_lane_entrypoint_violation_lines`'s docstring.
+        lines.append("")
+        _weakened_paths, _weakened_lines = _lane_entrypoint_violation_lines(
+            diff_text, additive_only_entrypoints
+        )
+        if _weakened_paths:
+            lines.extend(_weakened_lines)
+        else:
+            lines.append("## Smoke-spec entry point — additive only, not sealed")
+            lines.append("")
+            lines.append(
+                ", ".join(f"`{p}`" for p in additive_only_entrypoints)
+                + " is this repo's Tier-2 lane-kind acceptance driver entry "
+                "point (#3509) — a `coord bugbash` (#3487) smoke spec every "
+                "fix is expected to grow, not a sealed oracle. Do **not** "
+                "request-changes solely because this diff adds new steps or "
+                "new spec files beside it — that is expected and welcome."
+            )
+            lines.append("")
+            lines.append(
+                "- **Expected, do NOT flag:** new steps, or new spec files "
+                "beside this entry point."
+            )
+            lines.append(
+                "- **request-changes:** the diff removes or rewrites an "
+                "existing step, loosens an `expect_*` field, raises a "
+                "latency budget, or shortens an idle window — any of which "
+                "weakens a regression check `coord bugbash` already "
+                "depends on."
+            )
+
     if coordinator_doc_paths:
         # #2966: "only the coordinator writes docs" was prose-only — nothing
         # backstopped it structurally, and two workers independently
@@ -2949,6 +3114,7 @@ def _record_mechanical_review_verdict(
     kind_label = {
         "coordinator_doc": "coordinator-owned doc(s) edited",
         "sealed_path": "sealed path(s) violated",
+        "lane_entrypoint_weakened": "Tier-2 lane smoke-spec entry point weakened",
     }.get(kind, kind)
     touched_str = ", ".join(touched_paths)
     reason = f"{kind_label}: {touched_str}"
@@ -3642,7 +3808,16 @@ def dispatch_review(
         # bounced, or leave it unwired and ship dead code. Each route now
         # declares its own `entrypoint:`.
         sealed_paths = config.acceptance.sealed_paths(completed.repo_name)
-        sealed_entrypoints = config.acceptance.entrypoints(completed.repo_name)
+        sealed_entrypoints = [
+            ep for ep in config.acceptance.entrypoints(completed.repo_name)
+            if ep in sealed_paths
+        ]
+        # #3509: the Tier-2 lane-kind entrypoints EXCLUDED from sealed_paths
+        # above — additive-only, mechanically enforced by
+        # `_lane_entrypoint_violation_lines` instead of the sealed-path rule.
+        additive_only_entrypoints = config.acceptance.additive_only_entrypoints(
+            completed.repo_name
+        )
 
         # #2966: coordinator-owned docs (repo's own CLAUDE.md plus anything it
         # additionally lists under coordinator_only_files) — see
@@ -3713,6 +3888,7 @@ def dispatch_review(
             sealed_paths=sealed_paths,
             sealed_entrypoints=sealed_entrypoints,
             coordinator_doc_paths=coordinator_doc_paths,
+            additive_only_entrypoints=additive_only_entrypoints,
         )
         if _mechanical is not None:
             mech_kind, mech_touched, mech_lines = _mechanical
@@ -3814,6 +3990,7 @@ def dispatch_review(
                 diff_text=diff_text,
                 sealed_paths=sealed_paths,
                 sealed_entrypoints=sealed_entrypoints,
+                additive_only_entrypoints=additive_only_entrypoints,
                 coordinator_doc_paths=coordinator_doc_paths,
                 assignment_type=completed.type,
                 completion_summary=completed.completion_summary,

{code_coordinator-0.5.551 → code_coordinator-0.5.553}/tests/test_config.py

@@ -2952,3 +2952,23 @@ class TestTailscaleSelfDnsCache:
         resolved = resolve_local_machine(cfg)
         assert resolved is not None
         assert resolved.name == "macmini"
+
+
+# ── #3509: Tier-2 lane-kind entrypoints are additive-only, not sealed ───────
+#
+# Full behavioral coverage (sealed_paths/additive_only_entrypoints across
+# flat and routed drivers) lives in tests/test_config_acceptance.py, which is
+# where every existing sealed_paths/entrypoint test for AcceptanceConfig
+# already lives (that file's own docstring: "Tests for the `acceptance:`
+# block in coordinator.yml") — this is just the constant-level smoke test
+# for the file this issue names explicitly.
+
+
+def test_tier2_lane_kinds_constant_matches_bugbash_lane_driver_kinds() -> None:
+    """coord.config.TIER2_LANE_KINDS is hand-synced with
+    coord.bugbash.LANE_DRIVER_KINDS by design (coord.bugbash deliberately
+    avoids importing coord.config — see TIER2_LANE_KINDS's own comment) —
+    this test is the thing that notices if the two ever drift apart."""
+    from coord.bugbash import LANE_DRIVER_KINDS
+
+    assert coord_config.TIER2_LANE_KINDS == frozenset(LANE_DRIVER_KINDS)