- Plan is a pure function (inventory, manifest, disk facts, injected path
mapping) emitting exactly six actions: deploy, update, skip+warn,
leave+warn, remove, keep — deterministic order, no filesystem access
- full 3x3 matrix (disk unmodified/user-modified/never-managed x upstream
added/changed/removed) table-tested plus missing-disk restore cases,
a mixed fixture and a purity/determinism guarantee test
- executor applies plans item by item (atomic deploy/remove per item),
rewrites the manifest once, appends timestamped SKIP/LEAVE lines with
item name and reason to the sync log
- sync now plans before mutating: unmanaged occupants block new deploys,
upstream deletions remove only unmodified copies, local modifications
always win and are warned about
- admin-protected client config (flag > AGENT_LIB_CONFIG > platform default),
token used for basic auth only, redacted from all errors and files
- work-repo pull via go-git (bare cache clone + fetch, remote re-pointed on
config change), clean failure keeps previous state
- inventory: own items + external areas from lockfile; MCP inventoried but
never deployed
- manifest v1 records name/type/origin/revision/content-hash per item,
deterministic bytes; folder hashes over sorted relpath+filehash lines so
tree and disk hashes agree
- shared deploy package (atomic temp+rename, exec-bit preserving) now backs
both curator materialization and client deployment
- sync validates and hashes everything before the first mutation; second run
is a byte-level no-op
m3ta-chiron