Review round 4 (codex):
- R1: fence_registries reads an existing marker under the registry lock and
refuses the reset, changing nothing, when another live (or undecidable)
reset holds it - registries may be shared between workspaces; only a stale
marker is replaced, and the reset's exit removes only its own fences.
- R2: the registries to fence come from update.jobs_dirs, the enumeration
open_jobs now uses too, whether or not they exist; an absent row registry
is created and fenced (a registration would create it), and one that cannot
be created refuses the reset.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Review round 3 R1 (codex): the registration guard chose the workspace marker
from the path's spelling, so a symlink alias of .mam/jobs or a MAM_JOBS_DIR
registry was not refused. The reset now writes .reset-in-progress into each
registry its open-job check reads (.mam/jobs, MAM_JOBS_DIR, a row's other
control_plane.mam_jobs_dir - the latter only for this workspace's sessions),
each under that registry's lock and before the check, and removes it on exit;
register_job reads the marker inside the registry it writes to. The
precheck's separate lock barrier is subsumed by the fence.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Review round 2 (codex):
- R1: register_job reads .mam/reset-in-progress under the registry lock and
refuses while a reset of the workspace owning <ws>/.mam/jobs is live, so the
public registry.py register CLI and the API no longer bypass the gate. The
reset's precheck takes that lock once after publishing its marker, so a
registration is either seen by it or refused. The reset's own create passes
MAM_RESET_OWNER_PID; the remote runner refuses the dispatch.
- R2: before each purge the reset re-runs stop's revalidate check
(verify_session_uuid) for a post-discovered id against the row's folder and
skips the target (id not verified) when it does not verify.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A shared take also showed `pane_lock acquire --fd 7` for an instant, so the
test passed with the old shared admission; it now matches the exclusive
argv and checks the reset is still waiting a second later.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Review round 1 of PR #82:
- A running claude/grok row without a recorded id is refused by the
precheck (stop would fill it with a folder-wide guess the purge then
deletes); record-id never records a pre-assigned guess, and a target is
skipped (id_unverified) when the row's id after the normal stop is not
the one recorded before it.
- reset takes the update admission lock exclusively while it publishes
.mam/loop-guard-active and .mam/reset-in-progress; delegate submit
refuses on a live reset marker (mam_reset_admit). Before each target's
stop its open jobs are re-read (skipped as open_job, never cancelled),
and a row whose agent/server no longer matches the spec is skipped.
- read_spec validates every stored field (herdr_server required, never
defaulted) and rejects duplicate names.
- Signal tests wait 60 s for the kill-session gate (this Mac needs ~18 s).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
create_session.sh reads the new adapter fact as "${MAM_ID_POST_DISCOVERED:-0}"
and compares it with "= 1"; test_b5 requires every such default to be
classified.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
With MAM_DELEGATION_PY=0 the monitor was left in the caller's process group
(decision 2), on every restart the update makes. The legacy body now spawns
it under job control (`set -m`, macOS has no setsid(1)) and restores the
caller's option. The update tests assert the restarted monitor's PGID in both
modes, and their teardown kills helper groups and this test's exact monitors
instead of `pkill -f <ws>`, then reports anything left that names the
workspace.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
With MAM_DELEGATION_PY=0 the legacy helper still found the monitor with an
unanchored pgrep -f, so a process that only named the monitor path was
reported as the restarted monitor and none was started. lib.sh _monitor_pids
is the shell twin of daemon.find_running; update.sh and post_update.sh check
the PID start_watchdog printed with mam_monitor_started before saying
"monitor: restarted".
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- daemon.find_running matches `<bash> <reconcile.sh> --subscribe[ ...]`
exactly instead of an unanchored, unescaped pgrep regex: another
workspace's daemon (ws.a vs wsXa) or a process naming the path in an
argument is no longer signalled by the update. update.sh re-checks which
PIDs are still the monitor before SIGKILL.
- create and resume (spawn path) take the update admission of every
installed workspace at or above the pane cwd, not only the control
root's (lib.sh mam_update_admit_at, lib_py.update target-workspaces --cwd);
the ~/.local/bin wrapper child drops all of them.
- tests: snapshot() skips the SQLite -wal/-shm and compares the DB by its
rows (macOS keeps the sidecars and a read rewrites -shm); regression tests
for the monitor match and for create/resume in another installed
workspace (marker and lock wait); evidence line refs shifted.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
install_phase.sh exited when it could not mark the backup `installing`,
before the installer ran, without starting the monitor phase 1 had stopped
(decision 2) and leaving the backup behind. Nothing was changed at that
point, so it now removes the backup, restarts the monitor if it ran,
releases the marker and exits 1.
SKILL.md's exit row said 1 for every failure; a failed registry conversion
after a good install passes the converter's nonzero code through, and a
cancelled prompt exits 0.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
R1: a target with no registry row skipped the target gate. Its cwd is now
read from the live agent on the server delivery uses (resolve_herdr_session),
through the real herdr only when that server is running, so no server is
started; a herdr that cannot answer refuses before registration.
R2: any .mam counted as a workspace and stopped the walk, so B/sub/.mam hid
an installed B and the row's control_plane root was dropped. Workspaces are
now update.sh's installed trees (.mam_deploy/remove.sh or remove.sh): every
installed ancestor of the cwd, plus the recorded control_plane root.
lib_py.update target-workspaces prints them one per line; the wrapper holds
each on fds 20.. until the record is written.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
R2: glob() hid a listing error, so an unreadable .mam/jobs (or MAM_JOBS_DIR,
or another row's jobs dir) counted as empty and the update installed over an
open job. Records are now listed with os.listdir; a directory that cannot be
listed, or stat'ed, is a blocker with its path.
R3: a discovered agent with no row was told to run stop with --session only;
stop then looked on the workspace's server, not the one the agent was found
on. The hint now carries --herdr-session <server>, quoted.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Decision 8: delegate submit uses the admission lock of the workspace the
target session belongs to. The wrapper resolved only its own
WORKSPACE_ROOT, so a job could be registered and delivered to an agent of
another installed workspace while that workspace was being updated.
lib_py.update target-workspace resolves a herdr:<name> row's workspace (the
.mam at or above its pane.cwd, else its control_plane.workspace_root);
mam_update_admit takes an fd, and submit holds the caller root on fd 7 and
the target on fd 8 until the record is written. Rowless and remote targets
keep the caller-root gate.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
mam_update_admit created .mam/ to hold its lock, so a checkout running its
own run_loop.sh got a .mam (test_loop_marker_isolation L1, test_issue17 W1).
A tree without .mam is not an installed workspace, the only kind the update
runs in, so the gate admits there without a lock. The update's monitor-stop
wait is a normalised integer knob and is listed in INT_KNOBS
(test_issue26_ints B5).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A v4.11.0 workspace's .mam_deploy/update.sh installs the new version - the
skill present, no updater left - and the skill run after it converts the
registry. An update-backup in an unknown state now restarts the monitor it
stopped: nothing was changed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The update is a skill (decision 4); deploy/update.sh and the installed
.mam_deploy/update.sh are gone.
- Phase 1 (installed code, update.sh): publish the update marker under the
exclusive admission lock; refuse before any change while a running row, a
live herdr agent in the workspace on any running server, an open job
(unreadable JSON included, dry_run not), a live loop marker or a
monitor.lock held by a monitor the skills did not start (U3) is there - the
calling agent (server + pane, its row and one running job) excepted
(lib_py/update.py precheck, decisions 1 and 7). Stop the monitor (TERM, then
KILL and restart it if it does not end; decision 2), handle a leftover
backup by its state (U4), back up .agents, .mam_deploy, root files, .venv,
the installer's .mam files and the registry (SQLite backup API under the
registry lock) into .mam/update-backup/, then exec a copy of
install_phase.sh outside the tree (decision 5).
- The copy (no lib.sh/lib_py, bash 3.2) runs the installer in place; on
failure it restores the backup and restarts the monitor from the restored
tree; on success it runs phase 2, post_update.sh of the new tree, which
converts the registry with lib_py.registry_format and restarts the monitor
if it ran. The backup and the marker are removed at the end.
- install.sh updates in place (decisions 3, 4, 9): install_state keys are set,
one line each; no updater is installed and an old one (.mam_deploy/update.sh,
or a root update.sh the manifest lists) is removed; framework files the new
version no longer ships are deleted when unmodified, kept and listed when
modified, and dropped from base/, the manifest and asset_hashes.txt; a local
source's .mam is not staged. remove.sh knows the new skill; CI shellchecks
its scripts; docs point at the skill.
- test_issue8_update_state and test_deploy_layout td6/td27 run the skill.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The update skill publishes .mam/update-in-progress (pid + lstart, the
loop_lock.sh rules) while it holds .mam/update-admission.lock exclusively.
create, resume, run_loop.sh and delegate submit (decision 8) and stop and
orc-onboard (U2: a rollback would restore the registry without their write)
take that lock shared (lib.sh mam_update_admit, fd 7), refuse while the marker
is live or unknown, and hold the lock until their record is written. A stale
marker refuses nothing. lib_py.pane_lock acquire gains --shared and
--wait-env (MAM_UPDATE_ADMISSION_WAIT_S, default 120); create's wrapper path
closes fd 7 for the long-lived child. The exit-1 rows of create/resume/stop
name the refusal; skill_code_blocks.json pins follow the shifted lines.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Only create started the per-workspace monitor, and only on its job path, so
the stop -> update -> resume flow the update skill requires left no monitor.
resume now calls start_watchdog with the control root as workdir (as create
does since #21 A8, also for a worktree session) after the row is written, on
both the already-running and the spawn path. MAM_NO_SUBSCRIBER_DAEMON=1 starts
none; a failure warns and does not fail the resume.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
create's closing hint, the delegate-job wrapper's dispatch hint and stop's
stuck-TUI message printed the pre-#71 forms (`herdr session attach <name>`,
`HERDR_SESSION_NAME=... herdr agent attach <name>`), which miss an agent whose
name is over 32 characters or has upper case. They now print the session row's
attach_command, or lib_py.agents.sanitize.attach_command(server, name) when
there is no row (lib.sh session_attach_command). deploy/INSTALL.md and
install_mam.sh show the `herdr --session <server> agent attach <herdr name>`
form.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A DB without its sessions table (or without both tables) was read as an
empty registry in strict mode, so stop closed a registered session
row-less and exited 0. Strict mode now fails on any OperationalError;
the non-strict reader is unchanged.
Refs #71
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- parity and create with real line breaks in the name;
- stop with malformed YAML (no DB) or a corrupt DB refuses (exit 1);
- test_layout: the shim heredoc anchor follows the { ... } > "$tmp_file"
form (the rule it checks is unchanged);
- S11: base re-pinned to 0fc162e, which changes the shim's sanitize body.
Refs #71
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
load_state_json printed {} on a YAML/DB read error, so a registered
session was closed row-less (exit 0) and its stop workflow skipped.
stop now reads the registry strictly and exits 1 before any herdr call.
Pins of the shifted stop_session.sh lines updated.
Refs #71
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- create with a non-ASCII name: the attach target is the name herdr has;
bash/Python parity for non-ASCII and option-like names; no python3 is
an error for a non-ASCII name.
- row-less stop without --herdr-session uses HERDR_SESSION_NAME; an
unreadable row is not taken for no row.
- a retry (entry point, or any write) repairs a YAML a failed migration
left in format 1.
- tier3: the "cannot infer agent" case registers its row, as tier1 does.
- S11: base re-pinned to 5cd72d2, which changes the shim's sanitize body.
Refs #71
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
With no --herdr-session the server is chosen as create_session.sh chose
it (HERDR_SESSION_NAME, else the workspace's), not always derived from
the workspace. The row-less path runs only when the lookup says the row
is missing (exit 7); any other lookup failure stops with exit 1 as
before. Pins of the shifted stop_session.sh lines updated.
Refs #71
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- attach_command is `herdr --session <server> agent attach <herdr name>`
(`default` written too), built by lib_py.agents.sanitize.attach_command;
create, resume and reconcile all use it. kill_command and start_command
are no longer written, and status --json drops start_command.
- The two raw kill-session hints (create exit 43, id_order's orphan) print a
stop-skill command with --herdr-session instead.
- stop_session.sh closes a session that has no registry row, herdr only and
without --agent, when herdr runs it inside this workspace; another
workspace's session is refused (exit 5), a missing one is exit 1, one that
survives kill-session is exit 6. The registry is not changed.
- Docs: only the SKILL.md lines these changes made wrong; the skill block
pins follow. Tests that asserted the removed fields keep their intent
(issue50: create's own row; issue21: no control-root path in
attach_command; tier2: the new form and the absent fields). S11 pins the
shim to 4243da5, which changed it on purpose.
Refs #71
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
herdr registers an agent under sanitize_herdr_agent_name(session), so a
session name over 32 characters or with upper-case letters got
agent_not_found and stall detection went off. stall_watch now converts the
name for every herdr call (agent get/read/prompt, watcher.wait_once); logs
and notices keep the original name, and the agent kind is still read off
the original suffix (a long name's sanitized form ends in a hash).
The conftest mock herdr gets an opt-in strict_agent_names mode that, like
the real herdr, answers an agent only under its registered name and fails
get/read with agent_not_found JSON; existing tests see no change.
Refs #66
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A marker left on the invoking session name by a killed create/resume was
pruned before herdr was asked, so a retry under the same name took it over
while the orphaned pane was still alive (and create's failure cleanup could
then kill it). It is now kept and blocks like any other orphan until its
row is registered for the attempt or herdr reports the session gone.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
PR #69 review round 3 (rebuttal overruled; codex r2 applied as written).
- A failed `agent list`, herdr's server_not_running included, is unknown and
keeps an orphaned marker; only a successful list without the name prunes.
- No probe floor: probes get only the time left until the wait deadline, so
MAM_ID_ORDER_WAIT_S=0 asks herdr nothing (unknown, kept) and the refusal
says so.
- The timeout message reports the last definite answer of this wait, so an
alive orphan whose final probe ran out of time still reads as alive.
- Tests follow: server_not_running and cap 0 keep the marker and refuse;
delayed-probe bound is the cap itself; probing tests use a small cap.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
PR #69 review round 2.
- The herdr probe is tri-state (present / absent / unknown) from a parsed
`_herdr agent list`: absent only when the list parses without the name or
herdr answers server_not_running. A failed, unparseable or timed-out lookup
is unknown and keeps the marker (codex P1: has-session's exit 1 meant both
"absent" and "lookup failed").
- Probes run with MAM_NO_AUTOSTART=1 so a check never starts a server (agy P2).
- Probe time is capped by max(deadline, start + PROBE_FLOOR_S=2 s), shared by
all markers, so a slow herdr cannot hold the wait or its lock past the cap
(codex P2); MAM_ID_ORDER_WAIT_S=0 still gets one bounded look.
- Tests: unknown probe keeps and refuses; delayed probe at caps 0/1/3 stays
within the bound; real probe via lib.sh mam_id_order_wait against mock herdr
(listed / unlisted / failing list / server_not_running).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A create/resume killed after spawning its pane but before registering its
row left a marker whose owner pid was dead; the next same-cwd waiter pruned
it on the pid alone and could start a second session that discovers the
same workspace conversation id (PR #69 review P1).
- Markers record the herdr server. A dead owner's marker is pruned only once
its row is registered for the attempt (running, newer epoch: the row
decides) or `_herdr has-session` reports the session gone; an unanswered
probe counts as alive. On timeout the kill-session command is printed.
- A live marker of another process for the waiter's own session name is kept
and blocks instead of being deleted; the waiter's own pid's markers go.
- Tests: orphan / registered / gone / same-session / missing pane pid cases,
and a create-level reproduction against mock herdr (fails before the fix).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- workspace_uuid.py: the unused sys import.
- stop_session.sh: the orphan CAPTURE_ID and the blank padding that kept
later line numbers; the inventory pins follow the move instead.
- lib.sh: capture_conversation_id, which nothing calls any more.
- resume SKILL.md: the flow names the session-id decision (session_ids.py),
not resolve_session_id.sh.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
GodopuandClaude Opus 5.5