Build the auto-commit engine

Every settled change on a git-mode board commits, debounced 2s past
drag/typing churn, staged whole-root with .gitignore respected.
GitCommitOperation reaches the vendored libgit2 directly (same 1.9.2
pin SwiftGitX resolves — importable, not duplicated) for
signature-capable commits; add-git's config materialization is gone,
identity resolves at commit time (repo-local config, else derived
default) per the 2026-07-31 ruling in 06. CommitAttribution
classifies per file off EchoLedger receipts: user identity on
app-mediated windows, Lanework External <[email protected]>
on foreign, the modified-by refinement (<slug>@agents.lanework
.invalid) when every foreign file agrees, heal-marked receipts split
into their own commit — window split foreign → heal → user.
Edit-session granularity: ~700ms saves stay uncommitted, staging
excludes open session folders (closure-resolved so mid-session moves
stage around the new location), session end nudges the debounce so
each session lands exactly one body commit. Flush-before-overwrite
gates on known-foreign windows and commits synchronously ahead of
the write; close/quit flush the pipeline via CloseFlushCoordinator's
committerFlush. index.lock backs off briefly then re-debounces
silently; clean tree no-ops; genuine failures ride the standing
history-suspension banner and retry next debounce. Abnormal repo
states (detached HEAD, merge/rebase/cherry-pick in progress) hold
the engine with a 15s re-check; unborn HEAD commits "Initial board
state" whole-tree; dirty tree at open catches up through the same
engine. Message seam (CommitMessageComposing) ships interim — the
semantic composer is the next card.

Discovery diffs HEAD against an in-memory index with rename
detection (git status alone never pairs a bare mv), and a failed
survey reads as "could not look", never "nothing changed".

46 new tests / 8 suites, all real repositories via bundled libgit2.
2240 tests / 383 suites green; InertGitTests untouched.

Claude-Session: https://claude.ai/code/session_01SR4XGjmBE16ZUYWpfFHXwY
This commit is contained in:
2026-07-31 14:10:55 -04:00
parent 189af238a1
commit 3c07c26fda
17 changed files with 3009 additions and 60 deletions
+46 -53
View File
@@ -115,60 +115,53 @@ enum GitRepository {
return .failure(GitOperationFailure(operation: operation, message: reason(error)))
}
// A **fresh handle** for the staging and the commit, so nothing reads HEAD through a
// repository object that predates the symbolic ref just written: libgit2 caches refs per
// repository, and the whole point of writing that file was to decide where the first commit
// lands. The creating handle is dropped above.
let repository: Repository
do {
repository = try Repository.open(at: boardRoot)
} catch {
return .failure(GitOperationFailure(operation: operation, message: reason(error)))
}
// **The root commit goes through the same signature-capable path every later commit does**
// (`GitCommitOperation`), which is what retired this method's config materialization.
//
// Until the auto-commit card there was no way to hand libgit2 a signature through SwiftGitX
// `commit(message:)` leaves `author`/`committer` null and libgit2 falls back to
// `git_signature_default`, which reads a merged config ladder the sandbox cannot see so
// add-git wrote `user.name`/`user.email` into the fresh repository's own config to give that
// fallback something to find. That was an explicit interim, and it is gone: **nothing in the
// app writes those keys any more.** The identity resolves at commit time, in one place
// (`GitCommitOperation.userIdentity(at:)`), repo-local config winning over the derived
// default exactly as 06 states and a repository the app created now looks like one `git
// init` made, with no opinion of ours baked into its config. The popover's identity fields
// (a later card) are what will write that file, because there "the setting *is* the file".
//
// Every path `git status` reports is staged full `git add -A` semantics, `.gitignore`
// respected which is what "commits the whole tree" means: the board's files, the agent
// guide, strays and all (06 Commit messages: "the committer stages the whole board root").
let identity = GitCommitOperation.userIdentity(at: boardRoot)
let outcome = GitCommitOperation.perform(
at: boardRoot,
commits: [PlannedCommit(
paths: GitCommitOperation.changedPaths(at: boardRoot).map(\.path),
message: initialCommitSubject,
author: identity,
committer: identity
)]
)
applyIdentity(to: repository, gitDirectory: gitDirectory)
do {
// An empty pathspec passed to `git_index_add_all` (via `add(paths:)`) matches every path
// in the working tree full `git add -A` semantics in one step, `.gitignore` respected
// which is what "commits the whole tree" means: the board's files, the agent guide,
// strays and all (06 Commit messages: "the committer stages the whole board root").
try repository.add(paths: [])
_ = try repository.commit(message: initialCommitSubject)
} catch {
logger.error("initial commit failed at \(boardRoot.path, privacy: .public): \(reason(error), privacy: .public)")
return .failure(GitOperationFailure(operation: operation, message: reason(error)))
}
return .success(branchName(at: boardRoot) ?? initialBranchName)
}
/// Gives the repository a commit identity **only when it has none** (06-history-undo.md
/// Interaction with external writers "Where the user's git identity comes from").
///
/// `GitIdentity` resolves what the identity *is*: repo-local config when present, the derived
/// default otherwise. What this method adds is the mechanism writing the resolved identity
/// into the repository's own config so libgit2's default signature resolves to it.
///
/// **That write is a mechanism, not a design decision, and it is the narrowest one available.**
/// SwiftGitX 0.4.0's `commit(message:)` takes no signature (its `CommitOptions` leaves
/// `author`/`committer` null, so libgit2 falls back to `git_signature_default`, which fails
/// outright in a sandbox with no readable config). Every board this runs on is one the app
/// created milliseconds earlier, whose config the app itself wrote, and the keys are only ever
/// *added* a config that already names an identity is left exactly as it was, which is the
/// adopted-repo promise. The auto-commit card needs per-commit authorship anyway (foreign
/// changes commit as `Lanework External`, `modified-by` windows as the agent), so it must reach
/// a signature-capable commit path regardless; when it does, this materialization goes with it.
private static func applyIdentity(to repository: Repository, gitDirectory: URL) {
let configured = GitConfigFile.identity(inGitDirectory: gitDirectory)
guard configured.name == nil || configured.email == nil else { return }
let identity = GitIdentity.resolve(repoLocal: configured, derived: .derivedDefault())
if configured.name == nil {
try? repository.config.set("user.name", to: identity.name)
}
if configured.email == nil {
try? repository.config.set("user.email", to: identity.email)
switch outcome {
case .committed:
return .success(branchName(at: boardRoot) ?? initialBranchName)
case .nothingToCommit:
// A board with no files at all `git init` on an empty folder. The repository exists,
// which is what add-git promised; the first settled change takes the root commit through
// the ordinary engine (06 Rules Abnormal repo states: an unborn HEAD "is normal git
// mode"), and the branch line has a name to show either way.
return .success(branchName(at: boardRoot) ?? initialBranchName)
case .locked:
return .failure(GitOperationFailure(
operation: operation,
message: "another program is using this repository's index"
))
case let .held(pause):
return .failure(GitOperationFailure(operation: operation, message: pause.explanation))
case let .failed(failure):
logger.error("initial commit failed at \(boardRoot.path, privacy: .public): \(failure.message, privacy: .public)")
return .failure(GitOperationFailure(operation: operation, message: failure.message))
}
}