patpat-run

Patpat Run

When invoked directly, read the operating protocol in full. Do not load the router.

Read sequence verifiable units, proof over proxy, and apply the multi-phase run playbook.

Use scripts/run_state.py for durable graph state. Require a Git worktree with at least one commit and store state under Git metadata. Print the absolute store path at each checkpoint. Do not commit run state or create a tracked handoff unless the user explicitly requests it. Keep an append-only human decision trail at <git patpat/runs>/<run-id>/decisions.tsv next to state.json; same privacy as run state.

For a checked multi-unit plan, initialize scripts/program_state.py from the validated plan. Reject unordered units with exact, ancestor, or conservatively overlapping glob ownership. Keep dispatch closed until the integration owner supplies an absolute content-bound parallel-gate receipt that binds the plan digest, every unit's unique isolation identity, and all earned-parallelism checks. Open dispatch with set-gate dispatch open --receipt /absolute/path --integration-owner <identity>, then assign each dependency-ready frontier unit with an explicit actor, receipt-bound isolation identity, and expected generation. Pass the returned generation on every worker-controlled head, state, verdict, and unit-inbox mutation; never infer the current generation for a caller. Change a unit head only with its expected current head (none for the first head), and require that head to contain every declared dependency head in its Git ancestry. Treat each verdict slot as write-once until head change or reassignment. Reassignment increments the fencing token and rejects stale worker output. Closing dispatch revokes every active assignment; reopening it requires fresh assignment calls. Record unit events through the inbox with that unit's current head. Require the bound integration owner for program-wide events and acknowledgement; peek first and acknowledge a sequence only after processing the handoff. A changed dispatch receipt clears the inbox so a new authority epoch cannot inherit unattributed events. Bind verification and independent review to commits present in the repository. Require a fresh passing verification before review, and reject the verifier, assigned worker, or integration owner as reviewer. Recheck dependency ancestry before verdicts, completion, and delivery. Open delivery only when every dependency has fresh evidence. Any unit head change clears that unit's proof and inbox; a changed dependency head also revokes downstream assignments and evidence before work can resume. The program store coordinates state only; its local identities are self-asserted labels, not authentication. It does not stop an old process from writing an external surface, spawn workers, observe providers, or grant commit, push, merge, publish, or deploy authority.

Before fan-out, write the earned-parallelism receipt as bounded JSON and pass its absolute path to scripts/team_shape.py with --parallel-gate-receipt, --program-id, --plan-digest, --integration-owner, every --unit, observed capacity, and an explicit worker budget. Writable selection fails closed unless those expected values match the receipt; receipt-internal claims do not bind themselves to the active job. A boolean claim alone cannot admit writable fan-out. Accept serial fallback; the recommendation and receipt never grant authority. Send typed handoff cards and evidence pointers, never full worker transcripts. Mutation commands print bounded receipts by default; request --full only for deliberate ledger inspection. Use status --brief or status --unit <id>, and page the inbox with --after plus --limit.