A cached bare clone's HEAD points at refs/heads/<branch>, which is written
once at clone time and never updated again — fetch only touches
refs/remotes/*. Syncs without --ref therefore resolved the frozen
clone-time revision forever: the literal "cached version of the repo"
symptom.
Resolve the default branch via remote.List instead: the advertised HEAD
(plain hash or symref target) is the only source of truth. Verified
against the production Forgejo instance; e2e test fails on the pre-fix
binary and passes now.
- admin-protected client config (flag > AGENT_LIB_CONFIG > platform default),
token used for basic auth only, redacted from all errors and files
- work-repo pull via go-git (bare cache clone + fetch, remote re-pointed on
config change), clean failure keeps previous state
- inventory: own items + external areas from lockfile; MCP inventoried but
never deployed
- manifest v1 records name/type/origin/revision/content-hash per item,
deterministic bytes; folder hashes over sorted relpath+filehash lines so
tree and disk hashes agree
- shared deploy package (atomic temp+rename, exec-bit preserving) now backs
both curator materialization and client deployment
- sync validates and hashes everything before the first mutation; second run
is a byte-level no-op
m3ta-chiron