diff --git a/hive-c0re/src/forge/mod.rs b/hive-c0re/src/forge/mod.rs index dfcec6c9..89ca413d 100644 --- a/hive-c0re/src/forge/mod.rs +++ b/hive-c0re/src/forge/mod.rs @@ -18,8 +18,8 @@ pub use pr_merge::{ pub use reconcile::{reconcile_config_apply, reconcile_config_status}; pub use repos::{ clone_config_into_proposed, create_agent_repo, ensure_config_repo, ensure_knowledge_repo, - ensure_meta_remote, ensure_repo, ensure_shared_docs_repo, fetch_config_main_into_applied, - meta_read_access, push_config, push_meta, shared_docs_access, + ensure_meta_remote, ensure_repo, ensure_shared_docs_repo, fast_forward_applied_main, + fetch_config_main_into_applied, meta_read_access, push_config, push_meta, shared_docs_access, }; pub use users::{core_token, ensure_user_for, provision_user_token}; diff --git a/hive-c0re/src/forge/repos.rs b/hive-c0re/src/forge/repos.rs index 74a7252e..8a00d8c4 100644 --- a/hive-c0re/src/forge/repos.rs +++ b/hive-c0re/src/forge/repos.rs @@ -593,6 +593,66 @@ pub async fn fetch_config_main_into_applied(name: &str) -> bool { true } +/// Fast-forward `applied//main` to the config repo's current live +/// main. Unlike [`fetch_config_main_into_applied`] (reseed-only — bails +/// if `applied` already has a `.git`), this is for an `applied` repo that +/// already exists and just needs to catch up: force-sets the local ref to +/// match live main rather than requiring a fast-forward or any review +/// gate — there is no PR to review on this path, so nothing to check +/// ancestry against. Contrast the approval-deploy flow's CAS'd, +/// ancestry-gated advance for a reviewed PR merge, which this is not. +/// +/// Best-effort, same shape as [`fetch_config_main_into_applied`]: returns +/// `false` (not an error) when the forge is absent, the core token isn't +/// minted, `applied` has no `.git` yet (nothing to fast-forward — reseed +/// instead), or any git step fails. +pub async fn fast_forward_applied_main(name: &str) -> bool { + if !is_present().await { + return false; + } + let Some(token) = core_token() else { + return false; + }; + let applied = crate::paths::applied_dir(name); + if !applied.join(".git").exists() { + return false; + } + let url = forge_git_url(&format!("{CONFIG_ORG}/{name}")); + let auth = core_auth_header(&token); + let out = crate::lifecycle::git_command_authed(&auth) + .current_dir(&applied) + .args(["fetch", "--no-tags", &url, "refs/heads/main"]) + .output() + .await; + match out { + Ok(o) if o.status.success() => {} + Ok(o) => { + tracing::warn!( + %name, + stderr = %String::from_utf8_lossy(&o.stderr).trim(), + "forge: applied fast-forward fetch failed" + ); + return false; + } + Err(e) => { + tracing::warn!(%name, error = ?e, "forge: applied fast-forward fetch failed"); + return false; + } + } + if let Err(e) = + crate::lifecycle::git_update_ref(&applied, "refs/heads/main", "FETCH_HEAD").await + { + tracing::warn!(%name, error = ?e, "forge: applied fast-forward update-ref failed"); + return false; + } + if let Err(e) = crate::lifecycle::git_read_tree_reset(&applied, "refs/heads/main").await { + tracing::warn!(%name, error = ?e, "forge: applied fast-forward read-tree failed"); + return false; + } + tracing::info!(%name, "forge: fast-forwarded applied/main to agent-configs main"); + true +} + /// Seed an agent's `proposed` repo from `agent-configs/` on the forge. /// /// When the swarm creates an agent it writes that agent's config to the forge diff --git a/hive-c0re/src/job_queue/exec.rs b/hive-c0re/src/job_queue/exec.rs index 067684a5..3b4c099a 100644 --- a/hive-c0re/src/job_queue/exec.rs +++ b/hive-c0re/src/job_queue/exec.rs @@ -551,19 +551,35 @@ async fn run_meta_lock( // Pull each cascade agent's own input too — an agent's config-repo main // is trusted, so a meta-input bump is a reasonable place to also catch // it up. Without this, a meta-input bump rebuilds every affected agent - // against whatever `applied/` - // already happened to be locked to — normally current, but silently - // stale forever if a past deploy failed and nothing since retried it. - // Relocks against each agent's *declared* input (the forge URL, not the - // local `applied/` mirror `prepare_deploy` uses for a reviewed - // deploy) — this path has no PR to review, so there's nothing to gate. - // One combined call, not per-agent: simpler, at the cost of one - // unreachable/broken agent repo failing the whole cascade relock rather - // than just that agent. + // against whatever `applied/` already happened to be locked to — + // normally current, but silently stale forever if a past deploy failed + // and nothing since retried it. Relocks against each agent's *declared* + // input (the forge URL, not the local `applied/` mirror + // `prepare_deploy` uses for a reviewed deploy) — this path has no PR to + // review, so there's nothing to gate. One combined call, not per-agent: + // simpler, at the cost of one unreachable/broken agent repo failing the + // whole cascade relock rather than just that agent. if !cascade.is_empty() { let agent_inputs: Vec = cascade.iter().map(|name| format!("agent-{name}")).collect(); crate::meta::lock_update(&agent_inputs).await?; + // The relock above is a one-shot effect on *this* rebuild only — + // `applied/` itself hasn't moved, so the next `relock = true` + // rebuild trigger (the boot sweep, most notably) re-locks against + // `applied/` and reverts straight back to whatever it was + // stuck on. Fast-forward each cascade agent's own applied mirror + // too so a later rebuild through a different trigger doesn't undo + // this one. Best-effort per agent (unlike the relock above): one + // agent's forge repo being briefly unreachable here shouldn't be + // fatal to the cascade that already relocked its input above. + for name in &cascade { + if !crate::forge::fast_forward_applied_main(name).await { + tracing::warn!( + %name, + "meta-update cascade: applied/main fast-forward skipped or failed" + ); + } + } } // Grow one rebuild subgraph per affected agent into *this* meta-update // DAG (rooted on this `MetaLock`, so they build against the post-bump