DEN-3945: consolidate all branches into main (2026-09-12 sweep)

.github/workflows/ores-compose-format-candidate.yml

@@ -0,0 +1,63 @@
+name: normalize ores-compose candidate formatting
+
+on:
+  push:
+    branches:
+      - chatgpt/ores-compose-infra-fleet-20260914
+    paths:
+      - .github/workflows/ores-compose-format-candidate.yml
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ores-compose-format-candidate-20260914
+  cancel-in-progress: false
+
+jobs:
+  format:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    env:
+      GH_TOKEN: ${{ secrets.ZED_FLEET_GH_TOKEN }}
+      EXPECTED_SHA: 9b6883c395248af61fed155e772c1bfd1deb86a0
+      TARGET_REPO: ORESoftware/ores-compose
+      TARGET_BRANCH: DEN-1862-infra-owned-compose-cold-start
+    steps:
+      - name: Check out controller exactly
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+          fetch-depth: 1
+
+      - name: Format exact candidate and publish deterministic delta
+        shell: bash
+        run: |
+          set -euo pipefail
+          test -n "${GH_TOKEN:-}"
+          gh auth setup-git
+          root="$RUNNER_TEMP/ores-compose"
+          gh repo clone "$TARGET_REPO" "$root" -- --filter=blob:none
+          git -C "$root" checkout "$TARGET_BRANCH"
+          actual="$(git -C "$root" rev-parse HEAD)"
+          test "$actual" = "$EXPECTED_SHA"
+          cargo +stable fmt --manifest-path "$root/Cargo.toml" --all
+          cargo +stable fmt --manifest-path "$root/Cargo.toml" --all --check
+          if git -C "$root" diff --quiet; then
+            echo "Candidate already formatted"
+            exit 0
+          fi
+          git -C "$root" diff --check
+          git -C "$root" -c user.name='ORESoftware' -c user.email='alexander.d.mills@gmail.com' add -u
+          git -C "$root" -c user.name='ORESoftware' -c user.email='alexander.d.mills@gmail.com' \
+            commit -m 'chore: rustfmt cold-start stack'
+          git -C "$root" push origin "$TARGET_BRANCH"
+          {
+            echo '## ores-compose formatting publication'
+            echo
+            echo "- prior exact SHA: \`$EXPECTED_SHA\`"
+            echo "- new exact SHA: \`$(git -C "$root" rev-parse HEAD)\`"
+            echo "- changed files: \`$(git -C "$root" show --format= --name-only HEAD | sed '/^$/d' | wc -l | tr -d ' ')\`"
+          } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/ores-compose-infra-fleet.yml

@@ -0,0 +1,66 @@
+name: ores-compose infra fleet rollout
+
+on:
+  push:
+    branches:
+      - chatgpt/ores-compose-infra-fleet-20260914
+    paths:
+      - tools/ores_compose_infra_fleet.sh
+      - .github/workflows/ores-compose-infra-fleet.yml
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  actions: read
+
+concurrency:
+  group: ores-compose-infra-fleet-20260914
+  cancel-in-progress: false
+
+env:
+  COMPOSE_SHA: 9992401b5fd0826792b44fd47dad5542ce9f0830
+  MAX_REPOS: '120'
+  MAX_PARALLEL: '6'
+  RUN_BRANCH: automation/ores-compose-infra-20260914
+
+jobs:
+  rollout:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 330
+    env:
+      GH_TOKEN: ${{ secrets.ZED_FLEET_GH_TOKEN }}
+    steps:
+      - name: Check out exact fleet controller
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+          fetch-depth: 1
+
+      - name: Verify exact controller and prerequisites
+        shell: bash
+        run: |
+          set -euo pipefail
+          test "$(git rev-parse HEAD)" = "$GITHUB_SHA"
+          test -n "${GH_TOKEN:-}"
+          bash -n tools/ores_compose_infra_fleet.sh
+          gh --version
+          jq --version
+          git --version
+          rustc +stable --version
+          cargo +stable --version
+
+      - name: Audit fleet, validate manifests, open PRs and merge exact-head green PRs
+        shell: bash
+        run: |
+          set -euo pipefail
+          bash tools/ores_compose_infra_fleet.sh
+
+      - name: Upload fleet evidence
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: ores-compose-infra-fleet-${{ github.run_id }}
+          path: ores-compose-infra-fleet-summary.tsv
+          if-no-files-found: warn
+          retention-days: 30

.github/workflows/ores-compose-lock-candidate.yml

@@ -0,0 +1,61 @@
+name: generate ores-compose candidate lockfile
+
+on:
+  push:
+    branches:
+      - chatgpt/ores-compose-infra-fleet-20260914
+    paths:
+      - .github/workflows/ores-compose-lock-candidate.yml
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ores-compose-lock-candidate-20260914
+  cancel-in-progress: false
+
+jobs:
+  lock:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    env:
+      GH_TOKEN: ${{ secrets.ZED_FLEET_GH_TOKEN }}
+      EXPECTED_SHA: 9992401b5fd0826792b44fd47dad5542ce9f0830
+      TARGET_REPO: ORESoftware/ores-compose
+      TARGET_BRANCH: DEN-1862-infra-owned-compose-cold-start
+    steps:
+      - name: Check out controller exactly
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+          fetch-depth: 1
+
+      - name: Generate and publish exact Cargo.lock
+        shell: bash
+        run: |
+          set -euo pipefail
+          test -n "${GH_TOKEN:-}"
+          gh auth setup-git
+          root="$RUNNER_TEMP/ores-compose"
+          gh repo clone "$TARGET_REPO" "$root" -- --filter=blob:none
+          git -C "$root" checkout "$TARGET_BRANCH"
+          actual="$(git -C "$root" rev-parse HEAD)"
+          test "$actual" = "$EXPECTED_SHA"
+          test ! -e "$root/Cargo.lock"
+          cargo +stable generate-lockfile --manifest-path "$root/Cargo.toml"
+          test -s "$root/Cargo.lock"
+          cargo +stable metadata --manifest-path "$root/Cargo.toml" --locked --format-version 1 --no-deps >/dev/null
+          git -C "$root" diff --check
+          git -C "$root" -c user.name='ORESoftware' -c user.email='alexander.d.mills@gmail.com' add Cargo.lock
+          git -C "$root" -c user.name='ORESoftware' -c user.email='alexander.d.mills@gmail.com' \
+            commit -m 'build: commit deterministic Cargo.lock'
+          git -C "$root" push origin "$TARGET_BRANCH"
+          {
+            echo '## ores-compose lockfile publication'
+            echo
+            echo "- prior exact SHA: \`$EXPECTED_SHA\`"
+            echo "- new exact SHA: \`$(git -C "$root" rev-parse HEAD)\`"
+            echo "- Cargo.lock SHA-256: \`$(sha256sum "$root/Cargo.lock" | awk '{print $1}')\`"
+          } >> "$GITHUB_STEP_SUMMARY"

AGENTS.md

@@ -76,3 +76,10 @@ This organization policy overrides generic feature-branch and worktree defaults
 - Concurrent agents must coordinate repository and file ownership through the available agent communication channel, keep edits scoped, inspect live state before each write, and hand off cleanly. Coordinate instead of isolating routine work in worktrees.
 - Preserve unrelated in-progress changes and never overwrite another agent's work. If safe ownership of overlapping files cannot be established, pause that overlapping edit and coordinate before continuing.
 <!-- ore-primary-branch-policy:end -->
+
+## Repository-local Git worktrees
+
+- Create or use a Git worktree only when the human operator explicitly authorizes it for the current task. Concurrency or a dirty checkout is not permission by itself.
+- Put every authorized worktree at `<repository-root>/tmp/worktrees/<name>`; from the repository root, use `./tmp/worktrees/<name>`. Never place worktrees beside repositories or organization directories.
+- Keep `tmp`, `temp`, `tmp/worktrees`, and `temp/worktrees` ignored in the repository-root `.gitignore`. Do not commit files from those directories.
+- Relocate or remove a worktree only when the operator explicitly requests it. Before removal, preserve and publish intended changes, verify its commit is represented on the target branch, and confirm there are no tracked, untracked, ignored-sensitive, or in-use files that must survive. Remove it with `git worktree remove <path>` without `--force`; never delete a worktree directory with `rm`.

agents.md

@@ -122,3 +122,10 @@ work in progress, and `-A` is how that — plus secrets — gets committed by ac
 
 Never report work as landed while it is only on local disk. A change is done when
 it is committed, pushed, and open as a pull request; compiling is not landing.
+
+## Repository-local Git worktrees
+
+- Create or use a Git worktree only when the human operator explicitly authorizes it for the current task. Concurrency or a dirty checkout is not permission by itself.
+- Put every authorized worktree at `<repository-root>/tmp/worktrees/<name>`; from the repository root, use `./tmp/worktrees/<name>`. Never place worktrees beside repositories or organization directories.
+- Keep `tmp`, `temp`, `tmp/worktrees`, and `temp/worktrees` ignored in the repository-root `.gitignore`. Do not commit files from those directories.
+- Relocate or remove a worktree only when the operator explicitly requests it. Before removal, preserve and publish intended changes, verify its commit is represented on the target branch, and confirm there are no tracked, untracked, ignored-sensitive, or in-use files that must survive. Remove it with `git worktree remove <path>` without `--force`; never delete a worktree directory with `rm`.