chore(agents): stop tracking agent directories

[jason931225]

Agent working directories were tracked and pushed, which the no-dot-agent-directories rule forbids: .grok (41 files), .claude (9), .cursor (53), .codex (2), .beads (10), .omx (4).

Load-bearing content

Unlike oyatie's, console's .grok held no source that other code reads. Its one code reference — tools/ci/ingest-soft-reds.mjs — wrote to .grok/harness/lane-board.live.json, a generated artifact that was already gitignored. That output is redirected to ci/harness/ so no tool points into an agent directory.

Untracked, not deleted

.claude, .cursor, .codex, .beads and .omx remain on disk — agent tools read those exact paths. The requirement is that they not reach GitHub. .grok is gone; nothing consumed it.

Everything is preserved at refs/preserved/{grok,claude,codex,cursor,beads,omx} on this remote. Recover with git checkout refs/preserved/<name> -- .

.omx needed a second pass: the first sweep enumerated only the six dot-directories then known, which is exactly how a stale allowlist lets something through.

Tracked hooks

.githooks/ is tracked and reviewable, and delegates to local untracked hooks (.beads/hooks/<name>, .git/hooks/<name>.local), propagating their exit codes — so per-developer tooling keeps working while stopping being the only thing between a mistake and the remote.

• pre-commit refuses staged agent-directory files and staged gitignored files
• pre-push refuses a workspace that does not compile

Enable with git config core.hooksPath .githooks.

Verified by firing them: a staged .claude file was refused, a local delegate ran, and a delegate exiting 3 propagated 3 rather than 0.

Note

.beads/ carried executable hooks (post-checkout, pre-commit). They remain on disk and work, but wiring them from a tracked location is follow-up work — a hook that exists only on the machine that wrote it is a local habit, not enforcement.

[jason931225]

Executive Overview

The PR untracks agent-specific dot-directories (.beads/, .claude/, etc.) to enforce repo isolation and prevent local agent state, logs, and metadata from reaching the remote repository.

16-Lens Reasoning Framework Summary

Lens	Evaluation
1. Cartesian Doubt & 2. Essentialism	Validates the root requirement: agent scratchpads and local state should not pollute source control.
3. Chesterton's Fence & 9. Operability	Shared review harnesses (such as .claude/workflows/lane-fanout.js) are untracked; any team-wide scripts must be relocated to canonical paths like tools/ or scripts/.
7. Red Team & 16. Zero-Trust	Reduces blast radius and accidental secret/state leakage by stopping tracking of local agent state.
8. Systems Thinking & 11. Blast Radius	Truncated diff confirms deletion of dot-directories; hook delegation to .githooks/ must be verified across contributor environments.

Key Considerations

• Review is scoped to the provided diff slice (untracking .beads/ and .claude/).
• Verify that shared automation workflows previously housed in .claude/workflows/ are preserved in a tracked tools/ directory if team-wide execution is required.

Findings not addressable in the diff

• .claude/workflows/lane-fanout.js:1 [RIGHT] -- diff unavailable or unparseable: If lane-fanout.js or backlog-audit.js are load-bearing harnesses used across the engineering team, relocate them to a standard tracked path (e.g. tools/ci/ or scripts/) rather than leaving them untracked.

---

🤖 [Reviewed] by Oyatie Anvil

[jason931225]

❌ Blocked — 12 finding(s) across 72 gates; 10 gate(s) produced no measurement.

• clean-arch — not measured: no core/ports/adapters/facade layering found: 0 of 2 file(s) examined belong to a recognised layer
• coverage — not measured: the synchronous entry point cannot run a coverage tool; call CoverageGuard::measure_diff_coverage
  • fix: add tests covering the lines this PR adds
  • note: this gate is aspirational fidelity and does not fully measure what its name implies
• slo — not measured: no Prometheus or OpenTelemetry endpoint is configured, so error budget consumption over any window was never queried
  • note: this gate is aspirational fidelity and does not fully measure what its name implies
• cluster-audit — not measured: no Kubernetes API or ArgoCD cluster access is configured, so no live state was read back and no comparison against Git was performed
  • note: this gate is aspirational fidelity and does not fully measure what its name implies
• ci-wallclock — not measured: no GitHub Actions workflow-run timing API access is configured, so neither this PR's CI duration nor its billable compute was read
  • note: this gate is aspirational fidelity and does not fully measure what its name implies
• remote-cache — not measured: no sccache or Buck2 CAS statistics endpoint is configured, so no cache hit rate was read and no lockfile was hashed
  • note: this gate is aspirational fidelity and does not fully measure what its name implies
• shadow-traffic — not measured: no traffic mirror and no replay target are configured, so no production requests were sampled and no responses were compared
  • note: this gate is aspirational fidelity and does not fully measure what its name implies
• brand-absence — failed: 12 name(s) or PR-visible string(s) stamp an aspiration instead of naming what the code verifies
• shape — warning: no shape spec adopted (.anvil/shape.json absent); see anvil shape validate-spec
  • fix: run anvil shape plan --repo-dir <clone> for the move plan; a regression on a blocking rule needs an entry in .anvil/baselines/shape.signoff.json
  • note: this gate is partial fidelity and does not fully measure what its name implies
• automated-canary — not measured: no canary deployment and no Prometheus or OpenTelemetry metrics endpoint are configured, so no baseline or canary latency samples were ever read
  • note: this gate is aspirational fidelity and does not fully measure what its name implies
• stacked-diffs — not measured: no pull request DAG was read from the forge, so this PR's parent branch and any children stacked on it are unknown and no stack was evaluated
  • note: this gate is aspirational fidelity and does not fully measure what its name implies
• microbench — not measured: no criterion benchmark harness or published baseline exists for this repository, so neither the base nor the head ns/op figure was ever measured
  • note: this gate is aspirational fidelity and does not fully measure what its name implies

---

🤖 [Blocked] by Oyatie Anvil

[jason931225]

Executive Overview

PR #851 (incremental delta d398ecd → caaef5c) completes the decoupling of repository CI tooling from tracked agent directories (.grok). Specifically, it retargets tools/ci/ingest-soft-reds.mjs output from .grok/harness/lane-board.live.json to ci/harness/lane-board.live.json and adds ci/harness/README.md to establish the directory and document its purpose.

16-Lens Adversarial Evaluation

#	Lens	Assessment	Status
1	Cartesian Doubt	Directly solves the core issue: eliminates hardcoded runtime dependencies on agent-specific dot-directories.	PASS
2	Essentialism / YAGNI	Minimal delta (+4, -2 lines); no speculative abstractions.	PASS
3	Chesterton's Fence	Preserves lane-board output functionality while moving the target path out of the deprecated .grok/ hierarchy.	PASS
4	Contrarian	Standardizing on ci/harness/ is superior to per-tool temp storage or keeping legacy agent roots.	PASS
5	Socratic	Does ingest-soft-reds.mjs safely handle directory creation, and is .gitignore updated for ci/harness/*.live.json?	ADVISORY
6	Pragmatism	High ROI maintenance fix; cleanly addresses agent directory leakage into git history.	PASS
7	Red Team	No untrusted inputs or dynamic path evaluations introduced. Safe path resolution via Node resolve().	PASS
8	Systems Thinking	Decouples shared CI scripts from developer-specific local AI agent harnesses.	PASS
9	Operability / Day-2	Path is canonical and documented in ci/harness/README.md.	PASS
10	Opportunity Cost	Negligible maintenance burden; eliminates future confusion over .grok artifacts.	PASS
11	Blast-radius	Strictly isolated to soft-red lane board ingestion.	PASS
12	Constant-work	No impact on execution complexity or runtime performance.	PASS
13	Shared-nothing	No state leakage across independent environments.	PASS
14	FinOps / Unit-cost	Zero resource overhead.	PASS
15	Telemetry-first	Script docstring updated to reflect the new output location.	PASS
16	Zero-trust / Defense-in-depth	Reinforces boundary separating local AI agent scratchpads from production repository assets.	PASS

Critical Risks & Key Observations

• Git Hygiene: Verify that .gitignore contains ci/harness/*.live.json or ci/harness/lane-board.live.json so that running tools/ci/ingest-soft-reds.mjs does not create untracked file noise in git worktrees.

Findings not addressable in the diff

• tools/ci/ingest-soft-reds.mjs:20 [RIGHT] -- diff unavailable or unparseable: Verify that ci/harness/lane-board.live.json (or ci/harness/*.live.json) is ignored in .gitignore. Previously .grok/ was ignored wholesale; ensure this relocated live artifact does not dirty developer worktrees or CI staging areas when written.

---

🤖 [Reviewed] by Oyatie Anvil