1b805c05d5
Two independent features landed together in this checkout: - Isolated per-job git worktrees for the flake repo (only) so Builder jobs stop serializing on one shared checkout, plus a second dedicated builder instance/inbox for the board's "leicht" column (cheap OpenRouter model) alongside the existing "schwer" one. Fixes bundled in: correct -C/prompt path once a worktree is in play, git+ssh in the deploy runner's PATH, ProtectHome write access for its own sync-to-dev step, and per-(role,sender,board_slug) scoping for the Builder's carried-forward context so concurrent jobs sharing the board's fixed owner sender no longer bleed context into each other. - A new Operator role and deterministic scheduler between planning and Builder execution (docs/intent/board-intent-operator-orchestration.md): moving a planned intent into the Operator column analyzes it read-only and automatically dispatches either a direct Builder run or a validated split into dependency-aware, wave-scheduled child intents, capped at two concurrent Operator-originated Builder jobs. Synthesis only fires once every child has passed review. Also fixes a live incident hit while deploying this: board-agent-worker and board-agent-completion-watcher gained ReadWritePaths entries for the new leicht-lane inbox/processing dirs without a matching tmpfiles rule, so the directories not existing yet crashed the service (start-limit-hit) the first time a job needed them. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GurGgq83aNurjWbaNQ71Jr
32 lines
694 B
JSON
32 lines
694 B
JSON
{
|
|
"permissions": {
|
|
"defaultMode": "dontAsk",
|
|
"allow": [
|
|
"Read(**)",
|
|
"Glob(**)",
|
|
"Grep(**)",
|
|
"Bash(graphify query *)",
|
|
"Bash(graphify path *)",
|
|
"Bash(graphify explain *)"
|
|
],
|
|
"deny": [
|
|
"Edit(**)",
|
|
"Write(**)",
|
|
"NotebookEdit(**)",
|
|
"WebSearch",
|
|
"WebFetch",
|
|
"Bash(sudo *)",
|
|
"Bash(git commit *)",
|
|
"Bash(git push *)",
|
|
"Bash(agenix *)",
|
|
"Bash(ssh *)",
|
|
"Bash(nixos-rebuild *)",
|
|
"Bash(nix build *)",
|
|
"Bash(graphify save-result *)",
|
|
"Bash(graphify reflect *)",
|
|
"Bash(graphify update *)",
|
|
"Bash(graphify add *)",
|
|
"Bash(graphify watch *)"
|
|
]
|
|
}
|
|
}
|