Builders push migrations without their pin and sink merge batches: the crew's pre-push runs pin-migrations automatically when a migration changes #6939

Every crew clone now gets a pre-push hook that pins a new migration, and the check names an unpinned migration in its summary.

Pre-push hook (src/crew/pin_hook.ts). prepareClone in src/crew/runner.ts installs it as .git/hooks/pre-push, next to the clone's exclude file. When a push's commits add or change anything under src/core/migrations/, the hook runs bun scripts/pin-migrations.ts and commits only src/core/migration-pins/. A hook can't add a commit to a push that has already started, so it refuses that push and says "run git push again". If the agent stops there, the forge's own push at the end of the run carries the pin commit.

• The agent can't skip or edit the hook: .git/hooks is read-only inside its sandbox.
• Repositories without scripts/pin-migrations.ts are left alone.
• If the pin script itself fails (someone edited a migration that was already pinned), the push goes through and the gate reports it.

Host-side push. The forge's own push in landWork now passes --no-verify. Otherwise the hook would run the repository's script on the host, outside the sandbox. The cost: if the agent never pushes and the forge commits its leftovers, nothing pins them on the way out. In that case the check's summary below makes the fix one step.

Check summary (scripts/gate.ts, unpinnedAdds in src/kernel/pin_edits.ts). The gate runs first in the check. For each migration the pull adds without a pin file, it now prints this pull adds migration X without its pin: run bun scripts/pin-migrations.ts and commit src/core/migration-pins/X.pin. These lines come last, so the check's summary (its last line) is that message.

Tests

• test/crew-pin-hook.test.ts simulates a builder pushing to a bare remote:

- a push that adds a migration ends with the pin committed, and the second push carries both; - a push with no migration, or with its pin already there, goes through unchanged; - a repository without the script is untouched.

• test/pin-refusal.test.ts checks the named refusal and that summariseCheckFailure turns the gate's output into exactly that line.

Run before pushing: bun x tsc --noEmit, the gate against origin/main, the two test files above, test/pin-edits.test.ts, test/checks.test.ts, test/schema-migrations.test.ts, and the crew runner suites. All passed; one test was skipped by the sandbox. CLAUDE.md now mentions the hook in its migrations paragraph.

🤖 Generated with Claude Code

Closes #6938

Every crew clone now gets a pre-push hook that pins a new migration, and the check names an unpinned migration in its summary.

Pre-push hook (src/crew/pin_hook.ts). prepareClone in src/crew/runner.ts installs it as .git/hooks/pre-push, next to the clone's exclude file. When a push's commits add or change anything under src/core/migrations/, the hook runs bun scripts/pin-migrations.ts and commits only src/core/migration-pins/. A hook can't add a commit to a push that has already started, so it refuses that push and says "run git push again". If the agent stops there, the forge's own push at the end of the run carries the pin commit.

• The agent can't skip or edit the hook: .git/hooks is read-only inside its sandbox.
• Repositories without scripts/pin-migrations.ts are left alone.
• If the pin script itself fails (someone edited a migration that was already pinned), the push goes through and the gate reports it.

Host-side push. The forge's own push in landWork now passes --no-verify. Otherwise the hook would run the repository's script on the host, outside the sandbox. The cost: if the agent never pushes and the forge commits its leftovers, nothing pins them on the way out. In that case the check's summary below makes the fix one step.

Check summary (scripts/gate.ts, unpinnedAdds in src/kernel/pin_edits.ts). The gate runs first in the check. For each migration the pull adds without a pin file, it now prints this pull adds migration X without its pin: run bun scripts/pin-migrations.ts and commit src/core/migration-pins/X.pin. These lines come last, so the check's summary (its last line) is that message.

Tests

• test/crew-pin-hook.test.ts simulates a builder pushing to a bare remote:

- a push that adds a migration ends with the pin committed, and the second push carries both; - a push with no migration, or with its pin already there, goes through unchanged; - a repository without the script is untouched.

• test/pin-refusal.test.ts checks the named refusal and that summariseCheckFailure turns the gate's output into exactly that line.

Run before pushing: bun x tsc --noEmit, the gate against origin/main, the two test files above, test/pin-edits.test.ts, test/checks.test.ts, test/schema-migrations.test.ts, and the crew runner suites. All passed; one test was skipped by the sandbox. CLAUDE.md now mentions the hook in its migrations paragraph.

🤖 Generated with Claude Code

Every crew clone now gets a pre-push hook that pins a new migration, and the check's summary names a migration added without its pin. Nothing in the code changed after the triage note; branch head is still 8c234622. The note asks for the issue to name a pillar so it can get past the Later gate. That is a planning call for the issue's owner, so this pull doesn't set one. The pull serves the merge queue: it stops unpinned migrations from sinking merge batches.

Pre-push hook (src/crew/pin_hook.ts). prepareClone in src/crew/runner.ts installs it as .git/hooks/pre-push, next to the clone's exclude file. When a push's commits add or change anything under src/core/migrations/, the hook runs bun scripts/pin-migrations.ts and commits only src/core/migration-pins/. A hook can't add a commit to a push that has already started, so it refuses that push and says "run git push again". If the agent stops there, the forge's own push at the end of the run carries the pin commit.

• The agent can't skip or edit the hook: .git/hooks is read-only inside its sandbox.
• Repositories without scripts/pin-migrations.ts are left alone.
• If the pin script itself fails (someone edited a migration that was already pinned), the push goes through and the gate reports it.

Host-side push. The forge's own push in landWork now passes --no-verify. Otherwise the hook would run the repository's script on the host, outside the sandbox. The cost: if the agent never pushes and the forge commits its leftovers, nothing pins them on the way out. In that case the check's summary below makes the fix one step.

Check summary (scripts/gate.ts, unpinnedAdds in src/kernel/pin_edits.ts). The gate runs first in the check. For each migration the pull adds without a pin file, it now prints this pull adds migration X without its pin: run bun scripts/pin-migrations.ts and commit src/core/migration-pins/X.pin. These lines come last, so the check's summary (its last line) is that message.

Tests

• test/crew-pin-hook.test.ts simulates a builder pushing to a bare remote:

- a push that adds a migration ends with the pin committed, and the second push carries both; - a push with no migration, or with its pin already there, goes through unchanged; - a repository without the script is untouched.

• test/pin-refusal.test.ts checks the named refusal and that summariseCheckFailure turns the gate's output into exactly that line.

To try it: run bun test test/crew-pin-hook.test.ts test/pin-refusal.test.ts. Before pushing I also ran bun x tsc --noEmit, the gate against origin/main, test/pin-edits.test.ts, test/checks.test.ts, test/schema-migrations.test.ts and the crew runner suites. All passed; one test was skipped by the sandbox. CLAUDE.md now mentions the hook in its migrations paragraph.

🤖 Generated with Claude Code