git worktree: a detached worktree, nothing run in it
git worktree add --detach at the candidate; a block of ports held for the place on the host, each checked free
the checks’ process group ended; the policy’s release command run in the place under the checks’ executor, removing what the checks handed to another process, a container engine’s containers above all; git worktree remove; the ports let go
container: a clean checkout of the candidate in a container on the executing host
the candidate fetched and checked out into a new container’s filesystem, with the environment the repository declares
the container and everything started in it removed
moon: the repository’s task runner with declared inputs and a content-keyed cache
moon’s affected projects between the branch’s revision and the candidate, downstream dependents included
moon’s run of the affected check tasks in the place; the run report gives each task’s outcome and whether it was replayed, the run record gives its hash as the key and its exit code
script: one command with an exit code
every check, always
the command’s exit code, never a replay
executor profile
execute
enforces
open: a process group on the instance’s host
the command in the place, as one process group ended with its run
the cores given, by the runner’s own threads; nothing else; never confined
sandbox: the host’s kernel sandbox, Seatbelt on macOS, bubblewrap and Landlock on Linux
the command in the place under a profile that allows writes only to the place and its scratch, the network only as the policy says, and a container engine’s socket only when the policy allows it
paths and network everywhere; cores and memory only on Linux, by a cgroup the run is started in; confined when no session on the host can write the place and the run cannot reach a container engine, whose containers may mount any path
container: a container engine on the executing host
the place mounted into a new container from the repository’s image
cores, memory, paths and network; confined as C.8 says
git rev-parse; git merge-tree --write-tree; git commit-tree with the branch and the head as parents and the verdict as Sluice-* trailers; git update-ref with the expected old value; making a branch git update-ref <branch> <rev> "", removing one git update-ref -d <branch> <expected> (104, 105); branch protection by a reference-transaction hook that refuses any update to a branch in the policy not made by sluice, and logs it (1)
pushed refs: a branch on a remote every host reaches
git fetch then git rev-parse of the remote’s branch; forming and committing as local refs, on the host advancing the branch; the landing a push with --force-with-lease=<branch>:<expected>; making a branch a push leased on its absence, --force-with-lease=<branch>:, removing one a --delete leased on its revision (104, 105); branch protection by the forge’s rules, restricting creating, updating and deleting the branch, which only sluice’s identity bypasses (1)
wt submit, the executable wt-submit on the path, waiting for the entry’s outcome, which it reports as its exit, or with --no-wait returning the entry at once; wt submit --withdraw; wt submit --status; the outcome of a waiting submit is its exit, of any other the session’s pane prompted through the multiplexer; on landing, worktrunk removes the session’s place; wt submit --check, the same forming as a submission with no entry written
crew: a bolt team’s stages
the unit’s merge stage submits, and a bolt is submitted from its own place by its conductor; sluice amend sets an After the conductor adds; the conductor reads the entry’s state as the stage; a red or a conflict re-charges the unit’s slot; the conductor’s wait runs a forecast for each unit in code and tells the unit’s agent of a conflict when it is idle
flywheel: the machinery’s effects
a session’s done exit, once approved, is the submission; the entry’s state is evidence; a forecast is evidence on the item, read each tick
branch: sluice branch
not a session’s: sluice branch create <branch> --from <branch> makes a branch at the other’s current revision and prints it (104); sluice branch delete <branch> --into <branch> removes it, main when --into is omitted (105); each exits 0 when done, 1 when a branch it names does not exist, and 2 on a refusal, naming it
remote submit: a session on any host
the head pushed to the remote and the submission written through the records (peers) or sent to the server (central server); withdrawal the same; state read through the records or from the server; a waiting wt submit polls it until the outcome; a forecast through the records or from the server
Whatever binds them, the records are one JSON document per entry and
one JSON Lines log of check runs and verdicts per branch (53), and what
outlives them is the trailers each landing commit carries (23).
profile
read / write
local files: one host
the documents under the repository’s common git directory, one directory per branch and one log of check results per repository (69), readable by every place on the host with no process running, never tracked and never pushed, a version kept beside them; a write under the branch’s lock, refused when the version moved
remote refs: peers
the records as one tree committed under refs/sluice/<branch>/records on the shared remote; a write is a push with --force-with-lease from the commit read
server: a central server
the server’s local files; other hosts read and write only by asking the server