feat(remote): forget — a machine can un-know a team it pulled - #562
Merged
Conversation
A disconnected remote team needs a supported cleanup path for failed rehearsals and machine retirement. Forget now shows the exact store and event count, requires terminal confirmation or --yes, and removes only validated local state while leaving the server untouched. Keep active bindings behind disconnect and revalidate that state under the registry lock before deletion. Teach every agent-facing template not to bypass the destructive confirmation.
Compare the complete remote binding again under the team lock after confirmation so an endpoint or identity ABA cannot be deleted. Preserve an age trust checkpoint while another local team references the same server/team/protocol authority, and count both event and legacy message tables when reporting the deletion scope.
A final binding comparison cannot detect a disconnect and reconnect that returns every field to its original value. Give each binding mutation a monotonically increasing revision and compare that revision across the forget confirmation window. Initialize legacy bindings under the registry lock, increment the revision in every binding writer, and exercise a real A-to-B-to-A transition through a pseudo-terminal confirmation flow.
…mote-forget # Conflicts: # scripts/remote.sh
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The machine-two dogfood (run 3) surfaced the gap: a team pulled under a broken build had no supported way back —
disconnectkeeps the local team,pullrefuses a non-empty one, so recovery meant hand-deleting stores and sync tables. Cleanup after test runs has the same shape.remote.sh forget [--yes] <team>removes this machine's copy of a disconnected team: per-team store, sync config, team config and roster, key material, trust anchors, logs. It contacts no server and no server-side delete API exists — the remote copy stays, by design.Being destructive, it shows what will be deleted (store path, event count, and that the server copy remains) and requires confirmation; non-interactive runs are refused without
--yes. An active binding is refused — disconnect first. After confirmation it re-verifies the disconnected state under the lock before touching anything.Agent surfaces (root SKILL.md and all nine type templates) are taught the command with an explicit rule: the agent never supplies
--yeson its own.PR opened on the author's behalf — their sandbox blocks GitHub access.