commit and finish treat add-dir working directories as foreign #577

New issue

Open

opened 2026-09-22 16:12:59 +00:00 by hexajon · 0 comments

hexajon commented

2026-09-22 16:12:59 +00:00

Owner

The gap

madt_commit and madt_finish refuse the primary checkout of a repository whose toplevel sits outside the server's launch directory, and point the caller at a linked worktree instead. The in-scope check reads the launch directory only. A directory added to the working-directory set after launch (add-dir) is not counted, so a repo under such a directory is treated as foreign and cannot be committed to through its normal surface.

The refusal is explicit:

targets the PRIMARY checkout of a foreign repository - committing into it is
refused even with files= named (the primary checkout's tree and HEAD are shared
state the caller does not own). A LINKED WORKTREE of the foreign repo is the
sanctioned commit target.

Why it is wrong

The guard exists to stop a caller mutating a checkout it does not own: a repo that merely happens to be on disk, that another scope may be using. That reasoning does not hold for a directory the operator added by hand as a working directory. Adding it is the statement of ownership and intent to work there.

madtea's own guards already disagree about it. The file-edit guard permits native edits to a repo under an added working directory, because it keys on the working-directory set. The commit and finish path refuses the same repo in the same run, because it keys on the launch directory alone. So add-dir half-works: edit yes, commit no, and the operator is pushed to a linked worktree for a repo they explicitly opened for work, or back to raw git.

Proposed shape

Define in scope as the union of the launch directory and every directory added to the working-directory set, everywhere the foreign check runs. A repo whose toplevel is under any of them is owned by this scope and writable on its primary checkout. A repo under none of them stays foreign, and the worktree stays the sanctioned path for it.

This refines ADR 0019's in-scope definition; it does not remove the guard. A repo the operator never named is protected exactly as today.

Acceptance criteria

A repo whose toplevel is under an added working directory is writable by madt_commit and madt_finish on its primary checkout, no worktree required.
A repo under neither the launch directory nor any added working directory stays refused, pointing at the worktree flow, unchanged.
The commit and finish scope check agrees with the file-edit guard on the same repo: both in, or both out.
ADR 0019 is updated to define in scope as the launch directory plus the added working directories.

Relates to #571 and ADR 0019.

## The gap `madt_commit` and `madt_finish` refuse the primary checkout of a repository whose toplevel sits outside the server's launch directory, and point the caller at a linked worktree instead. The in-scope check reads the launch directory only. A directory added to the working-directory set after launch (add-dir) is not counted, so a repo under such a directory is treated as foreign and cannot be committed to through its normal surface. The refusal is explicit: ``` targets the PRIMARY checkout of a foreign repository - committing into it is refused even with files= named (the primary checkout's tree and HEAD are shared state the caller does not own). A LINKED WORKTREE of the foreign repo is the sanctioned commit target. ``` ## Why it is wrong The guard exists to stop a caller mutating a checkout it does not own: a repo that merely happens to be on disk, that another scope may be using. That reasoning does not hold for a directory the operator added by hand as a working directory. Adding it is the statement of ownership and intent to work there. madtea's own guards already disagree about it. The file-edit guard permits native edits to a repo under an added working directory, because it keys on the working-directory set. The commit and finish path refuses the same repo in the same run, because it keys on the launch directory alone. So add-dir half-works: edit yes, commit no, and the operator is pushed to a linked worktree for a repo they explicitly opened for work, or back to raw git. ## Proposed shape Define in scope as the union of the launch directory and every directory added to the working-directory set, everywhere the foreign check runs. A repo whose toplevel is under any of them is owned by this scope and writable on its primary checkout. A repo under none of them stays foreign, and the worktree stays the sanctioned path for it. This refines ADR 0019's in-scope definition; it does not remove the guard. A repo the operator never named is protected exactly as today. ## Acceptance criteria - [ ] A repo whose toplevel is under an added working directory is writable by `madt_commit` and `madt_finish` on its primary checkout, no worktree required. - [ ] A repo under neither the launch directory nor any added working directory stays refused, pointing at the worktree flow, unchanged. - [ ] The commit and finish scope check agrees with the file-edit guard on the same repo: both in, or both out. - [ ] ADR 0019 is updated to define in scope as the launch directory plus the added working directories. Relates to #571 and ADR 0019.

hexajon referenced this issue

2026-09-25 16:33:29 +00:00

repo-scope: madt_adr and other MCP tools cannot target a nested repo, because they take no dir= #638

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

sixfold-space/madtea#577

No description provided.

Rows
Columns