code-coordinator 0.5.71__tar.gz → 0.5.73__tar.gz

{code_coordinator-0.5.71 → code_coordinator-0.5.73}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.71
+Version: 0.5.73
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.71 → code_coordinator-0.5.73}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.71
+Version: 0.5.73
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.71 → code_coordinator-0.5.73}/code_coordinator.egg-info/SOURCES.txt

@@ -459,6 +459,7 @@ tests/test_cli_assign.py
 tests/test_cli_assign_interactive_oracle_gate.py
 tests/test_cli_assign_interactive_remote.py
 tests/test_cli_assign_provider.py
+tests/test_cli_assign_repo_drift_2219.py
 tests/test_cli_audit.py
 tests/test_cli_chat_continue.py
 tests/test_cli_diagnose_config_provenance.py

{code_coordinator-0.5.71 → code_coordinator-0.5.73}/code_coordinator.egg-info/scm_file_list.json

@@ -489,6 +489,7 @@
     "tests/test_cli_assign_interactive_oracle_gate.py",
     "tests/test_cli_assign_interactive_remote.py",
     "tests/test_cli_assign_provider.py",
+    "tests/test_cli_assign_repo_drift_2219.py",
     "tests/test_cli_audit.py",
     "tests/test_cli_chat_continue.py",
     "tests/test_cli_diagnose_config_provenance.py",

{code_coordinator-0.5.71 → code_coordinator-0.5.73}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.71",
+  "tag": "0.5.73",
   "distance": 0,
-  "node": "g61fe32cffef6c91f2bf3f8b2535b211f0c81996c",
+  "node": "g14e77699382902c886b02c14ee83a233c166d4cb",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-08-14"

{code_coordinator-0.5.71 → code_coordinator-0.5.73}/coord/commands/dispatch.py

@@ -9,6 +9,7 @@ import dataclasses
 import socket
 import sys
 from pathlib import Path
+from typing import TYPE_CHECKING
 
 import click
 import httpx
@@ -31,6 +32,9 @@ from coord.commands.dispatch_workers import (
     _dispatch_troubleshoot,
 )
 
+if TYPE_CHECKING:
+    from coord.models import Machine
+
 
 def _stdin_is_tty() -> bool:
     """Seam over ``sys.stdin.isatty()`` — see ``_require_interactive_tty``
@@ -89,6 +93,88 @@ def _require_interactive_tty(dry_run: bool) -> None:
     )
 
 
+def _repo_capability_refusal(
+    machine_obj: Machine, repo: str, *, timeout: float = 3.0
+) -> str | None:
+    """Cross-check *repo* against the target agent's LIVE ``/health`` repo
+    list, returning a refusal message when the two disagree — or ``None``
+    when they agree, the agent is unreachable, or the agent is config-free
+    (#2219).
+
+    ``assign()``'s ``machine_obj.can_work_on(repo)`` check (just above this
+    call site) only ever reads ``coordinator.yml`` — which the operator can
+    edit any time — never the agent process actually running on that
+    machine. A repo added to config after the agent started stays invisible
+    to it until a full ``systemctl --user restart coord-agent`` (there is no
+    partial re-read today). Every pre-flight surface an operator would
+    check before spending a dispatch reads config too: ``coord config``,
+    ``coord status``, and — worst of all — ``coord assign ... --dry-run``,
+    which is the documented way to sanity-check a dispatch before paying
+    for it. All three said this was fine while the live agent rejected it
+    outright, and a drive queue burned both retry attempts discovering that
+    by trial before landing terminally ``blocked`` (#2219). This is the
+    same ``/health`` read ``coord status``/``coord doctor`` already make
+    (``coord.network.check_machine``) — reused, not duplicated.
+
+    ``/health``'s ``repos`` field is NOT what ``AgentServer.assign()``
+    itself gates on, though — it's ``AgentServer._servable_repos()``'s
+    FILTERED list (``coord/agent.py``, #1527), which drops any repo with no
+    ``repo_paths`` entry or whose configured path is missing on disk.
+    ``assign()``'s own gate (``coord/agent.py``: ``if self.repos and
+    spec.repo_name not in self.repos``) checks the UNFILTERED
+    ``self.repos``. The two disagree exactly when a repo is configured on
+    that machine but degraded (``/health``'s ``degraded`` dict, #1527): in
+    that case ``assign()`` would NOT reject with "does not handle repo" —
+    it proceeds and fails later with the distinct "repo path does not
+    exist" — so this helper checks ``degraded`` FIRST and reports that
+    reason (with no restart advice, since restarting coord-agent cannot
+    repair a missing/misconfigured ``repo_paths`` entry) before ever
+    falling back to the "hasn't re-read config since *repo* was added"
+    story, which is only accurate when *repo* is absent from ``/health``
+    entirely — not merely degraded.
+
+    Deliberately narrow otherwise: only refuses when the agent is
+    reachable, ANSWERED with a real ``/health`` body, is not running
+    config-free (#1801 — a config-free agent's repos come from the dispatch
+    payload, not its own config, so an empty/mismatched list there is not a
+    capability gap), and either lists *repo* as degraded or published a
+    NON-empty repo list that plainly excludes it. Every other case
+    (offline, timeout, old agent with no ``repos`` key, empty list) falls
+    through to ``None`` — today's behavior, where the POST itself is left
+    to surface a real problem — so this never turns a transient network
+    hiccup into a new dispatch failure mode.
+    """
+    from coord.network import check_machine
+
+    status = check_machine(machine_obj, timeout=timeout)
+    if not status.is_online or status.health is None:
+        return None
+    health = status.health
+    if health.get("config_free"):
+        return None
+    degraded = health.get("degraded") or {}
+    if repo in degraded:
+        return (
+            f"{machine_obj.name!r} lists {repo!r} in coordinator.yml, and "
+            f"the live agent agrees it's configured, but the repo is "
+            f"DEGRADED there, not just unrefreshed: {degraded[repo]} "
+            f"(#1527). This is not the #2219 stale-config case — "
+            f"restarting coord-agent will not fix a missing or "
+            f"misconfigured repo_paths entry. Repair repo_paths[{repo!r}] "
+            f"on {machine_obj.name!r} instead, then retry."
+        )
+    live_repos = health.get("repos")
+    if not live_repos or repo in live_repos:
+        return None
+    return (
+        f"{machine_obj.name!r} rejected the assignment: this agent does "
+        f"not handle repo {repo!r} (supported: {live_repos}) — "
+        f"coordinator.yml lists it, but the live agent process hasn't "
+        f"re-read its config since {repo!r} was added (#2219). Restart "
+        f"coord-agent on {machine_obj.name!r} to pick it up, then retry."
+    )
+
+
 @click.command(help="Brain proposes assignments for idle machines.")
 @_CONFIG_OPTION
 @click.option("--dry-run", is_flag=True, help="Plan without saving proposals.")
@@ -951,6 +1037,18 @@ def assign(
         )
         sys.exit(2)
 
+    # #2219: config says this machine handles `repo` — but the LIVE agent
+    # process may not (yet) agree, if `repo` was added to coordinator.yml
+    # after that agent started. Refuse with the agent's real reason here,
+    # before any claim/worktree/network work — including under --dry-run,
+    # which is exactly the surface that used to green-light this. See
+    # _repo_capability_refusal's docstring for the full rationale and what
+    # it deliberately does NOT block on (offline/unreachable/config-free).
+    capability_refusal = _repo_capability_refusal(machine_obj, repo)
+    if capability_refusal is not None:
+        click.echo(f"error: {capability_refusal}", err=True)
+        sys.exit(2)
+
     # Refuse direct assignment to a paused machine — `coord pause` exists
     # so the user can explicitly steer work away.  If they meant to dispatch
     # anyway they should `coord unpause` first.  #1862: also refuses inside

{code_coordinator-0.5.71 → code_coordinator-0.5.73}/coord/commands/status.py

@@ -765,6 +765,53 @@ def _health_vs_config_lines(machine, health: dict) -> list[tuple[bool, str]]:
             ))
             for repo, reason in sorted(degraded.items()):
                 out.append((True, f"        {repo}: {reason}"))
+    elif declared_repos and published_repos and not config_free:
+        # #2219: the ABOVE branch only fires when /health publishes NOTHING
+        # — it silently missed the partial-drift shape that actually bit
+        # stick-demo#1: a repo added to coordinator.yml after the agent
+        # process started stays off /health's list while everything ELSE
+        # the agent publishes (including all its OTHER repos) looks
+        # perfectly healthy. `coord config`/`coord status` both read
+        # config, so both still advertised it; only the live agent —
+        # and, at dispatch cost, the drive queue that burned both retry
+        # attempts on it — knew better.
+        #
+        # `published_repos` (``/health``'s ``repos``) is
+        # ``AgentServer._servable_repos()``'s FILTERED list (#1527) — it
+        # also drops any repo that IS configured on that machine but is
+        # DEGRADED (no ``repo_paths`` entry, or the configured path is
+        # missing on disk). A drifted repo that's actually degraded is not
+        # the #2219 stale-config story: `AgentServer.assign()` gates on the
+        # UNFILTERED `self.repos`, so it would still accept that repo and
+        # fail later with a distinct "repo path does not exist" error —
+        # restarting coord-agent cannot repair a missing/misconfigured
+        # `repo_paths` entry. Split on `degraded` so each drifted repo gets
+        # the accurate story and remedy.
+        drifted = [r for r in declared_repos if r not in published_repos]
+        stale = [r for r in drifted if r not in degraded]
+        if stale:
+            out.append((
+                True,
+                f"  ✗ CRIT repos: coordinator.yml declares {declared_repos} "
+                f"but /health only advertises {published_repos} — {stale} "
+                "were added to config after this agent process started and "
+                "it hasn't re-read them; a dispatch to any of "
+                f"{stale} on this machine will be refused despite `coord "
+                "config`/`coord status` showing it as supported (#2219). "
+                "Restart coord-agent on this machine to pick it up.",
+            ))
+        for repo in drifted:
+            if repo in degraded:
+                out.append((
+                    True,
+                    f"  ✗ CRIT repos: coordinator.yml declares {repo!r} for "
+                    "this machine and the live agent agrees it's "
+                    f"configured, but it's DEGRADED there, not just "
+                    f"unrefreshed: {degraded[repo]} (#1527). This is not "
+                    "the #2219 stale-config case — restarting coord-agent "
+                    f"will not fix it; repair repo_paths[{repo!r}] on this "
+                    "machine instead.",
+                ))
 
     return out
 
@@ -1464,6 +1511,15 @@ def _diagnose_graph_health(config_path: Path) -> None:
     checks ``core.hooksPath``, the one-time per-machine setting that decides
     whether worktrees on this box get a linked graph at all.
 
+    #2211: also reports HEAD vs ``origin/<default_branch>``, alongside the
+    existing graph-vs-HEAD comparison.  The base checkout is fetched but
+    never pulled by design (worktrees always branch from a fresh
+    ``origin/<default>``, so a stale base never breaks dispatch) — which
+    means a graph can match HEAD exactly while HEAD itself sits arbitrarily
+    far behind the remote, and the graph-vs-HEAD check alone reports a clean
+    ``✓ in sync`` for it. This never fetches or pulls; it only reads whatever
+    ``origin/<default_branch>`` the last fetch left behind.
+
     Local-machine only, same scope as ``--orphan-worktrees``: it inspects the
     checkouts named in ``coordinator.yml`` that actually exist here.
     """
@@ -1476,7 +1532,7 @@ def _diagnose_graph_health(config_path: Path) -> None:
     cfg = _load_config(config_path)
 
     seen: set[Path] = set()
-    checkouts: list[tuple[str, Path]] = []
+    checkouts: list[tuple[str, Path, str]] = []
     for machine in cfg.machines:
         for repo_cfg in cfg.repos:
             rp = machine.repo_path(repo_cfg.name)
@@ -1486,16 +1542,20 @@ def _diagnose_graph_health(config_path: Path) -> None:
             if path in seen or not (path / ".git").exists():
                 continue
             seen.add(path)
-            checkouts.append((repo_cfg.name, path))
+            checkouts.append((repo_cfg.name, path, repo_cfg.default_branch or "main"))
 
     if not checkouts:
         click.echo("no local checkouts from coordinator.yml exist on this machine.")
         return
 
     stale_count = 0
-    for repo_name, path in checkouts:
+    origin_behind_count = 0
+    for repo_name, path, default_branch in checkouts:
         click.echo(f"── {repo_name}")
-        st = graph_status(path)
+        # #2211: default_branch drives the HEAD-vs-origin comparison
+        # alongside the existing graph-vs-HEAD one — never fetches, only
+        # reads whatever `origin/<default_branch>` the last fetch left.
+        st = graph_status(path, default_branch)
         for line in format_status_lines(st):
             click.echo(f"  {line}")
         if st.stale:
@@ -1504,11 +1564,20 @@ def _diagnose_graph_health(config_path: Path) -> None:
                 "    fix: run `graphify update .` in the checkout "
                 "(the hooks skip rebase/merge/cherry-pick and reset --hard)"
             )
+        if st.origin_behind:
+            origin_behind_count += 1
+            click.echo(
+                f"    fix: HEAD is behind origin/{default_branch} — the base "
+                "checkout is fetched but never auto-pulled (by design; "
+                "checkouts are sometimes deliberately parked). Review and "
+                "pull by hand if it isn't."
+            )
         ok, detail = hooks_path_status(path)
         click.echo(f"  {'✓' if ok else '⚠'} {detail}")
 
     click.echo(
-        f"GRAPH_HEALTH: checkouts={len(checkouts)} stale={stale_count}"
+        f"GRAPH_HEALTH: checkouts={len(checkouts)} stale={stale_count} "
+        f"origin_behind={origin_behind_count}"
     )
 
 

{code_coordinator-0.5.71 → code_coordinator-0.5.73}/coord/graph_health.py

@@ -81,6 +81,16 @@ class GraphStatus:
     built_sha: str | None = None
     head_sha: str | None = None
     in_sync: bool = False
+    # HEAD vs origin/<default_branch> — the axis graph<->HEAD alone cannot see
+    # (#2211).  The base checkout is fetched but never pulled by design (see
+    # module docstring), so HEAD can sit arbitrarily far behind origin while
+    # graph == HEAD reports a clean bill of health.  ``default_branch`` is the
+    # branch name the comparison used; ``origin_sha`` / ``commits_behind_origin``
+    # are ``None`` when it could not be determined (no remote, ref never
+    # fetched, or the git call failed) rather than treated as "0 behind".
+    default_branch: str | None = None
+    origin_sha: str | None = None
+    commits_behind_origin: int | None = None
     age_seconds: float | None = None
     # mtime of graphify-out/manifest.json — the last time graphify *checked* the
     # graph against the working tree, whether or not it rewrote anything.
@@ -122,6 +132,19 @@ class GraphStatus:
         *unknown* — an unknown is reported separately, not counted as drift."""
         return self.stamp_behind and not self.verified_current
 
+    @property
+    def origin_behind(self) -> bool:
+        """HEAD (of the checkout that owns the graph) is behind
+        ``origin/<default_branch>`` by at least one commit — i.e. the graph
+        may match HEAD exactly and still describe stale code, because HEAD
+        itself is stale relative to the remote (#2211).
+
+        False — not True — when this could not be proven (no remote, the ref
+        was never fetched, or the git call failed): mirrors ``stale``'s rule
+        that an unknown must never be counted as drift.
+        """
+        return bool(self.commits_behind_origin)
+
 
 def read_built_sha(report_path: Path) -> str | None:
     """The commit ``GRAPH_REPORT.md`` says the graph was built from."""
@@ -161,6 +184,22 @@ def _head_committed_at(repo_path: Path) -> float | None:
         return None
 
 
+def _commits_ahead(repo_path: Path, base: str, ahead_of: str) -> int | None:
+    """Count of commits reachable from *ahead_of* that are not in *base*
+    (``git rev-list --count base..ahead_of``).
+
+    Best-effort like the rest of this module: ``None`` (never raised) when
+    git can't answer — an unproven comparison must not be reported as drift.
+    """
+    out = _git_out(repo_path, "rev-list", "--count", f"{base}..{ahead_of}")
+    if out is None:
+        return None
+    try:
+        return int(out)
+    except ValueError:
+        return None
+
+
 def _shas_agree(built: str, head: str) -> bool:
     """Compare on the shorter of the two — the report abbreviates (8 chars by
     default) while ``git rev-parse HEAD`` is full-length."""
@@ -170,12 +209,20 @@ def _shas_agree(built: str, head: str) -> bool:
     return built[:n].lower() == head[:n].lower()
 
 
-def graph_status(repo_path: Path) -> GraphStatus:
+def graph_status(repo_path: Path, default_branch: str = "main") -> GraphStatus:
     """Freshness of the graphify graph for the checkout at *repo_path*.
 
     Read-only and best-effort: a missing graph, a missing report, or a repo
     git can't read all return a populated :class:`GraphStatus` with
     ``unknown_reason`` set rather than raising.
+
+    *default_branch* names the branch to compare HEAD against on
+    ``origin`` (#2211) — pass the repo's configured default branch
+    (``coordinator.yml``'s ``default_branch``, "main" if unset).  Never
+    fetches: it only reads whatever ``origin/<default_branch>`` the last
+    ``git fetch`` left behind, so a checkout that was never fetched or has
+    no ``origin`` remote simply leaves ``origin_sha``/``commits_behind_origin``
+    unset rather than reporting drift it can't prove.
     """
     st = GraphStatus(repo_path=repo_path)
     out_dir = repo_path / "graphify-out"
@@ -213,6 +260,7 @@ def graph_status(repo_path: Path) -> GraphStatus:
     owner = st.link_target.parent if (st.is_symlink and st.link_target) else repo_path
     st.head_sha = _head_sha(owner)
     st.head_committed_at = _head_committed_at(owner)
+    st.default_branch = default_branch
 
     if not st.built_sha:
         st.unknown_reason = "GRAPH_REPORT.md has no 'Built from commit' line"
@@ -220,6 +268,15 @@ def graph_status(repo_path: Path) -> GraphStatus:
         st.unknown_reason = f"could not read HEAD of {owner}"
     else:
         st.in_sync = _shas_agree(st.built_sha, st.head_sha)
+
+    # HEAD vs origin/<default_branch> — independent of the graph<->HEAD
+    # comparison above.  Best-effort: no remote, or the ref not fetched yet,
+    # just leaves this unset (see docstring).
+    if st.head_sha:
+        origin_sha = _git_out(owner, "rev-parse", f"origin/{default_branch}")
+        if origin_sha:
+            st.origin_sha = origin_sha
+            st.commits_behind_origin = _commits_ahead(owner, st.head_sha, origin_sha)
     return st
 
 
@@ -326,17 +383,39 @@ def format_status_lines(st: GraphStatus) -> list[str]:
     if st.is_symlink:
         lines.append(f"↳ {where}/graphify-out → {st.link_target} (linked worktree)")
 
+    # #2211: graph == HEAD only proves the graph matches the checkout's own
+    # HEAD — it says nothing about whether that HEAD itself is stale relative
+    # to origin (the base checkout is fetched but never pulled, by design;
+    # see module docstring).  Shared by both "graph matches HEAD" branches
+    # below so a genuinely-current-but-unpushed-tracking checkout doesn't
+    # report a false ✓.
+    origin_note = ""
+    if st.origin_behind:
+        n = st.commits_behind_origin or 0
+        origin_note = (
+            f" — HEAD is {n} commit{'' if n == 1 else 's'} behind "
+            f"origin/{st.default_branch}; the graph describes stale code "
+            f"(fix: review + pull — not automatic, see #2211)"
+        )
+
     if st.unknown_reason:
         lines.append(f"? {where}: freshness unknown — {st.unknown_reason}")
     elif st.in_sync:
-        lines.append(f"✓ {where}: graph in sync (built from {st.built_sha})")
+        if origin_note:
+            lines.append(
+                f"⚠ {where}: graph matches HEAD (built from {st.built_sha}){origin_note}"
+            )
+        else:
+            lines.append(f"✓ {where}: graph in sync (built from {st.built_sha})")
     elif st.verified_current:
         # Stamp behind, but graphify has re-checked the tree since HEAD landed
         # and found no topology change — the graph content is current.
+        mark = "⚠" if origin_note else "✓"
         lines.append(
-            f"✓ {where}: graph content current — stamp says {st.built_sha} "
+            f"{mark} {where}: graph content current — stamp says {st.built_sha} "
             f"(HEAD {(st.head_sha or '')[:8]}), but verified against the tree "
-            f"since; graphify leaves outputs untouched when topology is unchanged"
+            f"since; graphify leaves outputs untouched when topology is "
+            f"unchanged{origin_note}"
         )
     else:
         lines.append(

{code_coordinator-0.5.71 → code_coordinator-0.5.73}/coord/health/checks/graph.py

@@ -23,6 +23,14 @@ longer HEAD.  That is the 2026-07-30 vimcode incident: 128.8h stale, hooks
 disabled, and nothing in the fleet said so.  Age escalates a
 hooks-working checkout from WARN to CRIT at ``graph_stale_crit_hours``;
 hooks-disabled skips straight to CRIT because time cannot fix it.
+
+**graph == HEAD is not the whole story (#2211).** ``status.stale`` only
+compares the graph to this checkout's OWN HEAD. The base checkout is fetched
+but never pulled (see ``coord.graph_health``'s module docstring), so HEAD can
+sit arbitrarily far behind ``origin/<default_branch>`` while the graph
+matches it exactly — a confidently-correct-looking graph of stale code. This
+module reports that as its own WARN (``status.origin_behind``), independent
+of and never overriding ``status.stale``'s verdict.
 """
 
 from __future__ import annotations
@@ -79,7 +87,10 @@ def probe_graph(ctx: HealthContext) -> list[CheckResult]:
     results: list[CheckResult] = []
 
     for checkout in ctx.checkouts:
-        status = graph_status(checkout.path)
+        # #2211: default_branch drives the HEAD-vs-origin comparison
+        # alongside the existing graph-vs-HEAD one. Never fetches — only
+        # reads whatever origin/<default_branch> the last `git fetch` left.
+        status = graph_status(checkout.path, checkout.default_branch)
         hooks_ok, hooks_detail = hooks_path_status(checkout.path)
 
         values = {
@@ -91,6 +102,10 @@ def probe_graph(ctx: HealthContext) -> list[CheckResult]:
             "verified_current": status.verified_current,
             "built_sha": status.built_sha,
             "head_sha": status.head_sha,
+            "default_branch": status.default_branch,
+            "origin_sha": status.origin_sha,
+            "commits_behind_origin": status.commits_behind_origin,
+            "origin_behind": status.origin_behind,
             "age_seconds": status.age_seconds,
             "age_hours": (
                 round(status.age_seconds / 3600.0, 1) if status.age_seconds is not None else None
@@ -153,11 +168,35 @@ def probe_graph(ctx: HealthContext) -> list[CheckResult]:
             else f", {commits_behind} commit{'' if commits_behind == 1 else 's'} behind"
         )
 
+        # #2211: graph == HEAD only proves the graph matches this checkout's
+        # OWN HEAD — it says nothing about whether HEAD itself is behind
+        # origin. The base checkout is fetched but never pulled by design
+        # (see coord.graph_health module docstring), so this must be judged
+        # independently of `status.stale`, not folded into it.
+        origin_suffix = (
+            ""
+            if not status.origin_behind
+            else (
+                f", {status.commits_behind_origin} commit"
+                f"{'' if status.commits_behind_origin == 1 else 's'} behind "
+                f"origin/{status.default_branch}"
+            )
+        )
+
         if not status.stale:
-            severity = Severity.OK
-            headroom = f"in sync ({(status.built_sha or '')[:8]}), {age_text} old"
-            if status.verified_current and status.stamp_behind:
-                headroom = f"content current (stamp {(status.built_sha or '')[:8]}), {age_text} old"
+            if status.origin_behind:
+                severity = Severity.WARN
+                headroom = (
+                    f"graph matches HEAD ({(status.built_sha or '')[:8]}){origin_suffix} "
+                    "— describes stale code"
+                )
+            else:
+                severity = Severity.OK
+                headroom = f"in sync ({(status.built_sha or '')[:8]}), {age_text} old"
+                if status.verified_current and status.stamp_behind:
+                    headroom = (
+                        f"content current (stamp {(status.built_sha or '')[:8]}), {age_text} old"
+                    )
         elif not hooks_ok:
             severity = Severity.CRIT
             headroom = f"{age_text} stale{commits_suffix}, hooks disabled -> will not self-heal"
@@ -172,7 +211,17 @@ def probe_graph(ctx: HealthContext) -> list[CheckResult]:
             headroom = f"stale, {age_text} old{commits_suffix} (HEAD {(status.head_sha or '')[:8]})"
 
         detail = ""
-        if severity is not Severity.OK:
+        if not status.stale and status.origin_behind:
+            # Not a graph problem — `graphify update` would rebuild from the
+            # same stale HEAD. Naming a `git pull` here deliberately, but not
+            # running one: automatic pulls are unsafe for a base checkout
+            # (see coord.graph_health module docstring — deliberately-parked
+            # branches, stale .git/index.lock, etc).
+            detail = (
+                f"fix: review, then pull {checkout.path} to catch it up to "
+                f"origin/{status.default_branch} (not automatic)"
+            )
+        elif severity is not Severity.OK:
             detail = f"fix: graphify update {checkout.path}"
             if not hooks_ok:
                 detail = f"{detail}  —  {hooks_detail}"

{code_coordinator-0.5.71 → code_coordinator-0.5.73}/tests/conftest.py

@@ -68,6 +68,24 @@ def _no_agent_health_probe(monkeypatch):
     )
 
 
+@pytest.fixture(autouse=True)
+def _no_assign_repo_drift_probe(monkeypatch):
+    """#2219: default `coord assign`'s live-agent repo-capability cross-check
+    (``coord.commands.dispatch._repo_capability_refusal``) to fail-open
+    (``None`` — never refuse) so tests that don't care about it don't make a
+    real ``httpx.get(".../health")`` call keyed off whatever bogus
+    ``host.tailnet`` hostnames the fixture configs use. Mirrors
+    ``_no_agent_health_probe`` (#904) for the same reason: the suite's
+    default behavior must not depend on network/DNS timing. Tests exercising
+    the drift check itself monkeypatch this function to return a message
+    (or call the real one against a stubbed ``coord.network.check_machine``),
+    which takes priority over this default and is unaffected by it.
+    """
+    monkeypatch.setattr(
+        "coord.commands.dispatch._repo_capability_refusal", lambda *a, **k: None
+    )
+
+
 @pytest.fixture(autouse=True)
 def _no_worktree_writable_deny_scan(monkeypatch):
     """#1445 review: keep `check_worktree_writable`'s deny-rule scan from