worktree: drop force-discard from both surfaces; retire the #168 elicitation gate #208

New issue

Closed

opened 2026-07-17 15:28:50 +00:00 by hexajon · 0 comments

hexajon commented

2026-07-17 15:28:50 +00:00

(Migrated from codeberg.org)

Part of #206; implements ADR 0029 (#207) for worktrees.

Remove the ability to discard a dirty or locked worktree through madtea entirely, converging on the branch-delete pattern:

MCP: madt_worktrees action=remove loses force= for the discard case. A dirty or locked worktree is refused with a message that (a) explains what would be lost, (b) tells the agent to surface the situation, and (c) names raw git worktree remove --force as the command the user can run in their own shell. No runnable madtea incantation in the refusal.
CLI: madtea worktree remove --force is removed the same way branch delete removed -D/--force-delete, with the same style of typed error pointing at raw git.
The #168 elicitation gate (gateForcedWorktreeRemove, ElicitWorktreeForceRemoveConfirm) retires with the force path it guarded.
Keep: non-force remove of a clean worktree (unchanged), and action=add force= (path/branch reuse - it destroys nothing; rename or re-document it if the shared "force" name now misleads).
The root-owned-leftovers bounded-manual-cleanup message stays; it never escalated privileges anyway.

Acceptance criteria:

No parameter or flag on any madtea surface can remove a dirty or locked worktree.
Refusal text names the data at risk and the raw-git command for the user; drift/parity/description tests updated (tool summaries, paramdocs, worktreesActions manifest).
Elicitation code for worktree force-remove is gone; remaining elicitation uses (if any) are reversible-action consents per the ADR.
docs/COMPARISON.md worktree row, docs/reference/destructive.md, and the hook guidance text (check-git-worktree.sh steer messages) reflect the omission.
Full gate green.

Part of #206; implements ADR 0029 (#207) for worktrees. Remove the ability to discard a dirty or locked worktree through madtea entirely, converging on the branch-delete pattern: - MCP: madt_worktrees action=remove loses force= for the discard case. A dirty or locked worktree is refused with a message that (a) explains what would be lost, (b) tells the agent to surface the situation, and (c) names raw `git worktree remove --force` as the command the user can run in their own shell. No runnable madtea incantation in the refusal. - CLI: `madtea worktree remove --force` is removed the same way branch delete removed -D/--force-delete, with the same style of typed error pointing at raw git. - The #168 elicitation gate (gateForcedWorktreeRemove, ElicitWorktreeForceRemoveConfirm) retires with the force path it guarded. - Keep: non-force remove of a clean worktree (unchanged), and action=add force= (path/branch reuse - it destroys nothing; rename or re-document it if the shared "force" name now misleads). - The root-owned-leftovers bounded-manual-cleanup message stays; it never escalated privileges anyway. Acceptance criteria: - No parameter or flag on any madtea surface can remove a dirty or locked worktree. - Refusal text names the data at risk and the raw-git command for the user; drift/parity/description tests updated (tool summaries, paramdocs, worktreesActions manifest). - Elicitation code for worktree force-remove is gone; remaining elicitation uses (if any) are reversible-action consents per the ADR. - docs/COMPARISON.md worktree row, docs/reference/destructive.md, and the hook guidance text (check-git-worktree.sh steer messages) reflect the omission. - Full gate green.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

sixfold-space/madtea#208

No description provided.

Rows
Columns