ctrlrelay 0.11.0__tar.gz → 0.11.2__tar.gz

{ctrlrelay-0.11.0 → ctrlrelay-0.11.2}/CHANGELOG.md

@@ -7,6 +7,59 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.11.2] - 2026-09-10
+
+### Fixed
+
+- **A rebased Dependabot branch no longer fails the whole sweep.** The
+  bare-repo fetch uses a non-force refspec so it cannot discard a prior
+  session's unpushed commits. Dependabot rebases its branches onto a
+  moved base, which rewrites their tips — so every rebase became a
+  `non-fast-forward` rejection, and `git fetch` exits 1 on a declined
+  rewind even when every other ref applied. `ensure_bare_repo` read that
+  exit code as failure and aborted the session.
+
+  Observed on `AInvirion/zzsites`, whose sweep died reporting
+  `WorktreeError: git failed: ... ! [rejected] ... (non-fast-forward)`
+  in the same fetch that had just advanced `main`. Twelve bare repos
+  were holding a `dependabot/*` ref at the time, each one primed to fail
+  the moment Dependabot rebased it.
+
+  `dependabot/*` is now fetched with a force refspec first — those
+  branches are bot-authored and never carry local work, so rewinding one
+  destroys nothing. Any rejection that survives is logged as
+  `worktree.fetch.non_fast_forward` and tolerated rather than raised,
+  because a declined rewind is the refspec doing its job. Real failures
+  still raise: a `fatal:`/`error:` line, a rejection for any other
+  reason, or an unexplained non-zero exit. Failing open there would turn
+  an unreachable remote into a silent no-op and run pipelines against a
+  stale tree.
+
+## [0.11.1] - 2026-09-09
+
+### Fixed
+
+- **Answering a secops question inline now gets a confirmation.** Two
+  paths reach a resumed session and only one of them reported. A reply
+  that arrived after the session had torn down landed in
+  `pending_resumes` and the sweeper sent `✅ Resume succeeded on <repo>`;
+  a reply that arrived while the session was still parked in
+  `transport.ask` resumed in-process and sent nothing at all.
+
+  The only completion message on that second path was the sweep-wide
+  `✅ Scheduled secops sweep done: N/M ok`, which fires once every repo
+  has been swept. On the 2026-09-09 sweep that was hours after the reply
+  and named no repo: four answers merged 20 Dependabot PRs across
+  `ai-miner`, `kenos-orchestrator`, `prompt-injection-benchmark` and
+  `aiproxyguard-promptest`, and not one outbound message went back to
+  the operator. Answering looked indistinguishable from being ignored.
+
+  The inline path now reports the same three outcomes the sweeper
+  already did — summary, re-blocked question, or error. Repos that never
+  asked anything stay silent; acking all ~90 daily is how an operator
+  learns to ignore the channel. The send is best-effort, so a dead bridge
+  socket cannot discard completed work or abort the rest of the sweep.
+
 ## [0.11.0] - 2026-09-08
 
 ### Added
@@ -1591,7 +1644,9 @@ pipeline).
   per-phase implementation plans (Phase 0 through Phase 4).
 - `docs/Claude_Code_Project_Guide.md` — project development guide.
 
-[Unreleased]: https://github.com/AInvirion/ctrlrelay/compare/v0.11.0...HEAD
+[Unreleased]: https://github.com/AInvirion/ctrlrelay/compare/v0.11.2...HEAD
+[0.11.2]: https://github.com/AInvirion/ctrlrelay/compare/v0.11.1...v0.11.2
+[0.11.1]: https://github.com/AInvirion/ctrlrelay/compare/v0.11.0...v0.11.1
 [0.11.0]: https://github.com/AInvirion/ctrlrelay/compare/v0.10.0...v0.11.0
 [0.10.0]: https://github.com/AInvirion/ctrlrelay/compare/v0.9.0...v0.10.0
 [0.9.0]: https://github.com/AInvirion/ctrlrelay/compare/v0.8.1...v0.9.0

{ctrlrelay-0.11.0 → ctrlrelay-0.11.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: ctrlrelay
-Version: 0.11.0
+Version: 0.11.2
 Summary: Local-first orchestrator for headless coding agents across multiple GitHub repos
 Project-URL: Homepage, https://github.com/AInvirion/ctrlrelay
 Project-URL: Documentation, https://ainvirion.github.io/ctrlrelay/

{ctrlrelay-0.11.0 → ctrlrelay-0.11.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "ctrlrelay"
-version = "0.11.0"
+version = "0.11.2"
 description = "Local-first orchestrator for headless coding agents across multiple GitHub repos"
 readme = "README.md"
 requires-python = ">=3.12"

{ctrlrelay-0.11.0 → ctrlrelay-0.11.2}/src/ctrlrelay/core/worktree.py

@@ -8,9 +8,13 @@ from dataclasses import dataclass
 from pathlib import Path
 from typing import TYPE_CHECKING
 
+from ctrlrelay.core.obs import get_logger, log_event
+
 if TYPE_CHECKING:
     from ctrlrelay.core.github import GitHubCLI
 
+_logger = get_logger("core.worktree")
+
 
 # Open-PR probe (issue #52) retries a handful of times before failing
 # closed. Transient gh/network errors are common enough that one-shot
@@ -36,6 +40,49 @@ _PR_PROBE_TIMEOUT_SECONDS = 10
 # genuinely stuck, not merely large.
 _GIT_TRANSFER_TIMEOUT_SECONDS = 1800
 
+# Branches ctrlrelay never authors, so rewinding one can never destroy
+# local work. Dependabot rebases its branches onto a moved base, which
+# rewrites their tips — under a non-force refspec every such rebase is
+# a non-fast-forward rejection.
+_BOT_BRANCH_REFSPEC = "+refs/heads/dependabot/*:refs/heads/dependabot/*"
+
+
+def _rejections_are_only_non_fast_forward(stderr: str) -> list[str]:
+    """Return the refs a fetch declined to rewind, or ``[]`` if the
+    failure was anything else.
+
+    A non-fast-forward rejection is the non-force refspec doing its job:
+    it refused to discard local commits. Git still exits 1, which the
+    caller must not read as "the fetch failed" — the rest of the fetch
+    (the default branch, prunes, new branches) applied normally.
+
+    Anything git considers a real error — ``fatal:`` on a dead remote,
+    ``error:`` on a bad object, or a rejection for some other reason —
+    returns ``[]`` so the caller raises as before. Failing open here
+    would turn an unreachable remote into a silent no-op and let
+    pipelines run against a stale tree, which is the bug this module's
+    explicit refspec was added to prevent in the first place.
+    """
+    refs: list[str] = []
+    for raw in stderr.splitlines():
+        line = raw.strip()
+        if not line:
+            continue
+        low = line.lower()
+        if low.startswith(("fatal:", "error:")):
+            return []
+        if not line.startswith("!"):
+            continue  # progress line: "From ...", " * [new branch]", " abc..def"
+        if "non-fast-forward" not in low and "non-fast forward" not in low:
+            return []  # rejected for some other reason — not ours to swallow
+        # " ! [rejected]  <src> -> <dst>  (non-fast-forward)"
+        body = line.lstrip("! ")
+        if "]" in body:
+            body = body.split("]", 1)[1]
+        target = body.split("->")[-1].split("(")[0].strip()
+        refs.append(target or body.strip())
+    return refs
+
 
 class WorktreeError(Exception):
     """Raised when worktree operations fail."""
@@ -74,10 +121,17 @@ class WorktreeManager:
         *args: str,
         cwd: Path | None = None,
         timeout: int | None = None,
+        tolerate_non_fast_forward: bool = False,
     ) -> str:
         """Run git command and return stdout. `timeout` overrides self.timeout
         for one call — useful for cheap probes that shouldn't inherit the full
-        120s default when network is flaky."""
+        120s default when network is flaky.
+
+        ``tolerate_non_fast_forward`` is for fetches under a non-force
+        refspec: git exits 1 when it declines to rewind a diverged local
+        branch, even though every other ref updated. See
+        :func:`_rejections_are_only_non_fast_forward`.
+        """
         cmd = ["git", *args]
         effective_timeout = timeout if timeout is not None else self.timeout
         proc = await asyncio.create_subprocess_exec(
@@ -124,7 +178,21 @@ class WorktreeManager:
             raise
 
         if proc.returncode != 0:
-            raise WorktreeError(f"git failed: {stderr.decode().strip()}")
+            err = stderr.decode().strip()
+            declined = (
+                _rejections_are_only_non_fast_forward(err)
+                if tolerate_non_fast_forward
+                else []
+            )
+            if not declined:
+                raise WorktreeError(f"git failed: {err}")
+            log_event(
+                _logger,
+                "worktree.fetch.non_fast_forward",
+                cwd=str(cwd) if cwd is not None else None,
+                refs=declined,
+                ref_count=len(declined),
+            )
 
         return stdout.decode()
 
@@ -766,12 +834,11 @@ class WorktreeManager:
         test counts from a commit that was two weeks old.
 
         Refspec: ``refs/heads/*:refs/heads/*`` (no leading ``+``).
-        Fast-forward-only on purpose — codex caught this on the
-        first pass: a force update would clobber the dev pipeline's
-        ``create_worktree_with_new_branch`` reuse path, which keeps
-        local-ahead-of-origin commits when a prior session pushed
-        partial work. Non-force semantics give us the right
-        behavior in all three cases:
+        Fast-forward-only on purpose: a force update would clobber
+        the dev pipeline's ``create_worktree_with_new_branch`` reuse
+        path, which keeps local-ahead-of-origin commits when a prior
+        session pushed partial work. Non-force semantics give us the
+        right behavior in all three cases:
 
         - Local branch BEHIND origin (default-branch case, the bug
           we're fixing): fast-forward applies, local catches up.
@@ -782,15 +849,32 @@ class WorktreeManager:
 
         ``--prune`` drops refs that no longer exist on origin so
         deleted branches don't linger forever.
+
+        Two things keep that non-force refspec from failing the
+        caller, both learned from a secops sweep that died on
+        ``AInvirion/zzsites`` with ``main`` already updated:
+
+        - ``dependabot/*`` is fetched with a force refspec first.
+          Dependabot rebases its branches, which rewrites their tips,
+          so under a plain refspec every rebase is a rejection. These
+          branches are bot-authored and never carry local work, so
+          rewinding one destroys nothing. Twelve bare repos were
+          holding such a ref when this was found.
+        - Any rejection that survives is tolerated rather than raised.
+          Git exits 1 on a declined rewind even when every other ref
+          applied, and that exit code was aborting the whole session
+          for a branch it had correctly protected.
         """
         bare_path = self._get_bare_repo_path(repo)
 
         if bare_path.exists():
             await self._run_git(
                 "fetch", "--prune", "origin",
+                _BOT_BRANCH_REFSPEC,
                 "refs/heads/*:refs/heads/*",
                 cwd=bare_path,
                 timeout=_GIT_TRANSFER_TIMEOUT_SECONDS,
+                tolerate_non_fast_forward=True,
             )
         else:
             await self._run_git(

{ctrlrelay-0.11.0 → ctrlrelay-0.11.2}/src/ctrlrelay/pipelines/secops.py

@@ -657,6 +657,49 @@ async def run_secops_all(
                 rounds += 1
                 result = await pipeline.resume(ctx, answer)
 
+            # Close the loop on an answer the operator gave inline.
+            # The sweep-wide summary only lands when every repo has
+            # been swept — on a 90-repo sweep that's hours after the
+            # reply, so answering felt like shouting into a void. The
+            # late-answer path (pending_resumes) already reports per
+            # session; this is the same courtesy for the case where
+            # the session was still alive to receive the answer.
+            # Guarded on rounds > 0 so the ~90 repos that never asked
+            # anything stay silent.
+            if rounds > 0 and transport is not None:
+                try:
+                    if result.success:
+                        await transport.send(
+                            f"✅ Answer applied on {repo}\n"
+                            f"Session: `{session_id}`\n"
+                            f"\n{result.summary}"
+                        )
+                    elif result.blocked:
+                        q = result.question or "(no question text)"
+                        await transport.send(
+                            f"⏸️ Re-blocked after your answer on {repo}\n"
+                            f"Session: `{session_id}`\n"
+                            f"\n{q}"
+                        )
+                    else:
+                        err = result.error or result.summary
+                        await transport.send(
+                            f"❌ Failed after your answer on {repo}\n"
+                            f"Session: `{session_id}`\n"
+                            f"\n{err}"
+                        )
+                except Exception as e:
+                    # Best-effort: a dead socket must not lose the
+                    # completed work or abort the rest of the sweep.
+                    log_event(
+                        _logger,
+                        "secops.answer_ack.send_failed",
+                        session_id=session_id,
+                        repo=repo,
+                        error_type=type(e).__name__,
+                        error=str(e)[:200],
+                    )
+
             results.append(result)
 
             status = "done" if result.success else ("blocked" if result.blocked else "failed")

{ctrlrelay-0.11.0 → ctrlrelay-0.11.2}/tests/test_secops_pipeline.py

@@ -432,6 +432,203 @@ class TestSecopsBlockedDispatch:
         assert "Need decision" in mock_db.add_pending_resume.call_args.kwargs["question"]
 
 
+class TestSecopsInlineAnswerAck:
+    """An answer the operator gives while the session is still alive must
+    get its own result message. The sweep-wide summary only lands once
+    every repo is done — hours later on a large sweep — so without this
+    the operator answers and hears nothing back. The late-answer path
+    (pending_resumes sweeper) already reports per session; this covers
+    the inline case.
+    """
+
+    @staticmethod
+    def _states(final_status, *, summary=None, question=None, error=None):
+        from ctrlrelay.core.checkpoint import CheckpointStatus
+
+        blocked = MagicMock()
+        blocked.status = CheckpointStatus.BLOCKED_NEEDS_INPUT
+        blocked.question = "Merge PR #42 (minor bump)?"
+        blocked.summary = None
+        blocked.outputs = {}
+        blocked.error = None
+
+        final = MagicMock()
+        final.status = final_status
+        final.summary = summary
+        final.question = question
+        final.outputs = {}
+        final.error = error
+        return blocked, final
+
+    @staticmethod
+    async def _run(tmp_path, blocked, final, transport):
+        from ctrlrelay.core.dispatcher import SessionResult
+        from ctrlrelay.pipelines.secops import run_secops_all
+
+        mock_dispatcher = AsyncMock()
+        mock_dispatcher.spawn_session.side_effect = [
+            SessionResult(session_id="sess", exit_code=0, state=blocked),
+            SessionResult(session_id="sess", exit_code=0, state=final),
+        ]
+
+        mock_worktree = AsyncMock()
+        mock_worktree.create_worktree.return_value = tmp_path / "worktree"
+        mock_worktree.ensure_bare_repo.return_value = tmp_path / "bare"
+
+        mock_db = MagicMock()
+        mock_db.acquire_lock.return_value = True
+        mock_db.get_agent_session_id.return_value = "sess"
+
+        repo = MagicMock()
+        repo.name = "owner/repo"
+
+        return await run_secops_all(
+            repos=[repo],
+            dispatcher=mock_dispatcher,
+            github=MagicMock(),
+            worktree=mock_worktree,
+            dashboard=None,
+            state_db=mock_db,
+            transport=transport,
+            contexts_dir=tmp_path / "contexts",
+        )
+
+    @pytest.mark.asyncio
+    async def test_successful_resume_sends_summary_to_operator(
+        self, tmp_path: Path
+    ) -> None:
+        from ctrlrelay.core.checkpoint import CheckpointStatus
+
+        blocked, final = self._states(
+            CheckpointStatus.DONE, summary="Merged 7 minor Dependabot PRs"
+        )
+        transport = AsyncMock()
+        transport.ask.return_value = "yes, merge"
+
+        results = await self._run(tmp_path, blocked, final, transport)
+
+        assert results[0].success
+        transport.send.assert_called_once()
+        text = transport.send.call_args.args[0]
+        assert "owner/repo" in text
+        assert "Merged 7 minor Dependabot PRs" in text
+        assert text.startswith("✅")
+
+    @pytest.mark.asyncio
+    async def test_reblocked_resume_reports_the_new_question(
+        self, tmp_path: Path
+    ) -> None:
+        """Hitting max_blocked_rounds (or a second BLOCKED the operator
+        never sees) must not go silent either — report the open question
+        so the operator knows the session is still stuck."""
+        from ctrlrelay.core.checkpoint import CheckpointStatus
+        from ctrlrelay.core.dispatcher import SessionResult
+        from ctrlrelay.pipelines.secops import run_secops_all
+
+        blocked, _ = self._states(CheckpointStatus.DONE)
+
+        mock_dispatcher = AsyncMock()
+        mock_dispatcher.spawn_session.return_value = SessionResult(
+            session_id="sess", exit_code=0, state=blocked,
+        )
+        mock_worktree = AsyncMock()
+        mock_worktree.create_worktree.return_value = tmp_path / "worktree"
+        mock_worktree.ensure_bare_repo.return_value = tmp_path / "bare"
+        mock_db = MagicMock()
+        mock_db.acquire_lock.return_value = True
+        mock_db.get_agent_session_id.return_value = "sess"
+
+        transport = AsyncMock()
+        transport.ask.return_value = "yes"
+        repo = MagicMock()
+        repo.name = "owner/repo"
+
+        results = await run_secops_all(
+            repos=[repo],
+            dispatcher=mock_dispatcher,
+            github=MagicMock(),
+            worktree=mock_worktree,
+            dashboard=None,
+            state_db=mock_db,
+            transport=transport,
+            contexts_dir=tmp_path / "contexts",
+            max_blocked_rounds=2,
+        )
+
+        assert results[0].blocked
+        transport.send.assert_called_once()
+        text = transport.send.call_args.args[0]
+        assert text.startswith("⏸️")
+        assert "Merge PR #42" in text
+
+    @pytest.mark.asyncio
+    async def test_repo_that_never_asked_stays_silent(
+        self, tmp_path: Path
+    ) -> None:
+        """The overwhelming majority of a 90-repo sweep finds nothing to
+        decide. Those must send nothing — otherwise the ack turns into
+        90 notifications a day and the operator stops reading them."""
+        from ctrlrelay.core.checkpoint import CheckpointStatus
+        from ctrlrelay.core.dispatcher import SessionResult
+        from ctrlrelay.pipelines.secops import run_secops_all
+
+        done = MagicMock()
+        done.status = CheckpointStatus.DONE
+        done.summary = "No open Dependabot alerts, nothing to do"
+        done.outputs = {}
+        done.error = None
+
+        mock_dispatcher = AsyncMock()
+        mock_dispatcher.spawn_session.return_value = SessionResult(
+            session_id="sess", exit_code=0, state=done,
+        )
+        mock_worktree = AsyncMock()
+        mock_worktree.create_worktree.return_value = tmp_path / "worktree"
+        mock_worktree.ensure_bare_repo.return_value = tmp_path / "bare"
+        mock_db = MagicMock()
+        mock_db.acquire_lock.return_value = True
+
+        transport = AsyncMock()
+        repo = MagicMock()
+        repo.name = "owner/repo"
+
+        results = await run_secops_all(
+            repos=[repo],
+            dispatcher=mock_dispatcher,
+            github=MagicMock(),
+            worktree=mock_worktree,
+            dashboard=None,
+            state_db=mock_db,
+            transport=transport,
+            contexts_dir=tmp_path / "contexts",
+        )
+
+        assert results[0].success
+        transport.ask.assert_not_called()
+        transport.send.assert_not_called()
+
+    @pytest.mark.asyncio
+    async def test_send_failure_does_not_lose_the_completed_result(
+        self, tmp_path: Path
+    ) -> None:
+        """A dead bridge socket at ack time must not discard work the
+        agent already did, nor abort the rest of the sweep."""
+        from ctrlrelay.core.checkpoint import CheckpointStatus
+
+        blocked, final = self._states(
+            CheckpointStatus.DONE, summary="Merged PR #42"
+        )
+        transport = AsyncMock()
+        transport.ask.return_value = "yes"
+        transport.send.side_effect = RuntimeError("socket closed")
+
+        results = await self._run(tmp_path, blocked, final, transport)
+
+        assert len(results) == 1
+        assert results[0].success
+        assert results[0].summary == "Merged PR #42"
+
+
 class TestSecopsPromptRespectsAutomationConfig:
     """The per-repo `automation:` block in orchestrator.yaml defines the
     Dependabot policy per severity tier (patch/minor/major × auto/ask/never).

{ctrlrelay-0.11.0 → ctrlrelay-0.11.2}/tests/test_worktree.py

@@ -1599,3 +1599,182 @@ class TestGitTimeoutIsDiagnosable:
         await wt.ensure_bare_repo("owner/repo")
         fetch_kwargs = wt._run_git.await_args_list[0].kwargs
         assert fetch_kwargs["timeout"] == _GIT_TRANSFER_TIMEOUT_SECONDS
+
+
+class TestFetchSurvivesRewrittenBranches:
+    """A secops sweep died on `AInvirion/zzsites` with the message
+    `WorktreeError: git failed: ... ! [rejected] ... (non-fast-forward)`
+    — while the same fetch had already advanced `main`. Dependabot
+    rebases its branches, which rewrites their tips, so under the
+    non-force refspec every rebase is a rejection and `git fetch`
+    exits 1. Twelve bare repos held such a ref when this was found.
+    """
+
+    @staticmethod
+    def _git(*args: str, cwd: Path) -> str:
+        import subprocess
+
+        env = {
+            "GIT_AUTHOR_NAME": "t", "GIT_AUTHOR_EMAIL": "t@t",
+            "GIT_COMMITTER_NAME": "t", "GIT_COMMITTER_EMAIL": "t@t",
+            "PATH": __import__("os").environ.get("PATH", ""),
+            "HOME": str(cwd),
+        }
+        return subprocess.run(
+            ["git", *args], cwd=cwd, env=env,
+            capture_output=True, text=True, check=True,
+        ).stdout
+
+    @classmethod
+    def _build_repos(cls, tmp_path: Path) -> tuple[Path, Path]:
+        """origin with a rewritten dependabot branch and a rewritten
+        `fix/` branch; a bare clone holding its own commit on each."""
+        import subprocess
+
+        origin = tmp_path / "origin"
+        origin.mkdir()
+        cls._git("init", "-q", "-b", "main", ".", cwd=origin)
+        (origin / "f").write_text("base\n")
+        cls._git("add", ".", cwd=origin)
+        cls._git("commit", "-qm", "base", cwd=origin)
+        cls._git("branch", "dependabot/uv/pkg-1.0", cwd=origin)
+        cls._git("branch", "fix/issue-1", cwd=origin)
+
+        bare = tmp_path / "bare.git"
+        subprocess.run(
+            ["git", "clone", "-q", "--bare", str(origin), str(bare)],
+            check=True, capture_output=True,
+        )
+
+        # Rewrite both branches on origin so neither is a descendant of
+        # what the bare clone now holds.
+        for br, text in (
+            ("dependabot/uv/pkg-1.0", "rebased"), ("fix/issue-1", "forced"),
+        ):
+            cls._git("checkout", "-q", br, cwd=origin)
+            (origin / "f").write_text(text + "\n")
+            cls._git("commit", "-qam", "v1", cwd=origin)
+            cls._git("commit", "-q", "--amend", "-m", br, cwd=origin)
+
+        # Give the bare repo a local-only commit on each branch.
+        main_tree = cls._git(
+            "rev-parse", "refs/heads/main^{tree}", cwd=bare
+        ).strip()
+        for br in ("dependabot/uv/pkg-1.0", "fix/issue-1"):
+            sha = cls._git(
+                "commit-tree", main_tree, "-p", "refs/heads/main",
+                "-m", f"local work on {br}", cwd=bare,
+            ).strip()
+            cls._git("update-ref", f"refs/heads/{br}", sha, cwd=bare)
+        return origin, bare
+
+    @staticmethod
+    def _sha(bare: Path, ref: str) -> str:
+        import subprocess
+
+        return subprocess.run(
+            ["git", "rev-parse", ref], cwd=bare,
+            capture_output=True, text=True, check=True,
+        ).stdout.strip()
+
+    @pytest.mark.asyncio
+    async def test_rebased_dependabot_branch_no_longer_fails_the_sweep(
+        self, tmp_path: Path
+    ) -> None:
+        from ctrlrelay.core.worktree import WorktreeManager
+
+        origin, bare = self._build_repos(tmp_path)
+        before_fix = self._sha(bare, "refs/heads/fix/issue-1")
+
+        wt = WorktreeManager(
+            worktrees_dir=tmp_path / "wt", bare_repos_dir=tmp_path / "repos",
+        )
+        target = wt._get_bare_repo_path("owner/repo")
+        target.parent.mkdir(parents=True, exist_ok=True)
+        bare.rename(target)
+        self._git("remote", "set-url", "origin", str(origin), cwd=target)
+
+        # Must not raise — this is the reported failure.
+        await wt.ensure_bare_repo("owner/repo")
+
+        # Bot branch caught up to the rebase...
+        assert self._sha(target, "refs/heads/dependabot/uv/pkg-1.0") == \
+            self._sha(origin, "refs/heads/dependabot/uv/pkg-1.0")
+        # ...and the local commit on fix/ was NOT discarded. This is the
+        # protection the non-force refspec exists for; a blanket "+"
+        # would silently destroy a prior session's unpushed work.
+        assert self._sha(target, "refs/heads/fix/issue-1") == before_fix
+
+    @pytest.mark.asyncio
+    async def test_real_errors_still_raise(self, tmp_path: Path) -> None:
+        """Failing open would turn an unreachable remote into a silent
+        no-op and run pipelines against a stale tree."""
+        from ctrlrelay.core.worktree import WorktreeError, WorktreeManager
+
+        wt = WorktreeManager(
+            worktrees_dir=tmp_path / "wt", bare_repos_dir=tmp_path / "repos",
+        )
+        bare = wt._get_bare_repo_path("owner/repo")
+        bare.parent.mkdir(parents=True, exist_ok=True)
+        self._git("init", "-q", "--bare", str(bare), cwd=tmp_path)
+        self._git(
+            "remote", "add", "origin",
+            str(tmp_path / "does-not-exist"), cwd=bare,
+        )
+
+        with pytest.raises(WorktreeError):
+            await wt.ensure_bare_repo("owner/repo")
+
+
+class TestNonFastForwardClassifier:
+    """`_rejections_are_only_non_fast_forward` decides whether a
+    non-zero `git fetch` is the refspec doing its job or a real
+    failure. Getting it wrong in the permissive direction hides
+    outages; in the strict direction it re-breaks the sweep."""
+
+    def test_extracts_the_declined_refs(self) -> None:
+        from ctrlrelay.core.worktree import (
+            _rejections_are_only_non_fast_forward,
+        )
+
+        stderr = (
+            "From github.com:AInvirion/zzsites\n"
+            " - [deleted]         (none)     -> dependabot/uv/authlib-1.6.12\n"
+            " ! [rejected]        dependabot/uv/playwright-1.62.0 -> "
+            "dependabot/uv/playwright-1.62.0  (non-fast-forward)\n"
+            " * [new branch]      feat/import-navigation -> feat/import-navigation\n"
+            "   c6cfa84..f0a7911  main                   -> main\n"
+        )
+        assert _rejections_are_only_non_fast_forward(stderr) == [
+            "dependabot/uv/playwright-1.62.0"
+        ]
+
+    def test_fatal_is_not_tolerated(self) -> None:
+        from ctrlrelay.core.worktree import (
+            _rejections_are_only_non_fast_forward,
+        )
+
+        stderr = (
+            " ! [rejected]  a -> a  (non-fast-forward)\n"
+            "fatal: could not read from remote repository\n"
+        )
+        assert _rejections_are_only_non_fast_forward(stderr) == []
+
+    def test_other_rejection_reasons_are_not_tolerated(self) -> None:
+        from ctrlrelay.core.worktree import (
+            _rejections_are_only_non_fast_forward,
+        )
+
+        stderr = " ! [rejected]  v1 -> v1  (would clobber existing tag)\n"
+        assert _rejections_are_only_non_fast_forward(stderr) == []
+
+    def test_no_rejection_at_all_is_not_tolerated(self) -> None:
+        """Exit 1 with no rejection line is an unexplained failure."""
+        from ctrlrelay.core.worktree import (
+            _rejections_are_only_non_fast_forward,
+        )
+
+        assert _rejections_are_only_non_fast_forward("") == []
+        assert _rejections_are_only_non_fast_forward(
+            "From github.com:o/r\n   abc..def  main -> main\n"
+        ) == []