feat: enroll explicitly requested repositories and continue unattended

[timeleft--]

Accepted outcome

The human Captain requests: when a first officer is asked to use Hermes Helmet to work on or review a named repo, treat that request as authorization to enroll that exact repo. An optional confirmation must not block when the Captain is away. Enroll, provision the Hermes checkout below the configured data root (in WisdomHelm /opt/data/repos), then continue the requested work. Silence by itself is not consent; the human's explicit named-repo delegation is the authority.

Merge when clean: yes

Implementation scope

Implement the portable product side in this repository. Inspect current v2 policy/CLI/setup and bundled skill contracts before choosing the smallest interface. Provide one deterministic idempotent enrollment command/transport seam reusable by issue, epic, and report-only review workflows. The first officer calls enrollment explicitly for the exact repo resolved from the human request (slug/issue/PR URL or verified Git origin); read-only status never enrolls or clones. Existing allowlisted repos remain no-ops. Honor explicit installation restrictions and allowed GitHub owners; do not add owners, credentials, token scopes, billing, or external providers. The configured Captain identity must authorize the operational enrollment and remain distinct from the worker. Reject malformed/credential-bearing URLs, unrelated repos inferred only from issue bodies, owner mismatch, path collisions/symlinks, wrong-origin or dirty existing clones, and missing worker access. Do not widen authority to forks or dependents implicitly.

Persist only the exact enrollment plus a sanitized request/actor receipt, with atomic/idempotent writes and recovery after interruption. A transport can provision the worker checkout while keeping worker credentials out of the host. Preserve merge-authority/manual-policy ceilings and independent exact-head review. Review-only enrollment must not dispatch issues or confer merge permission.

Update helmet-issue, helmet-epic, setup-helmet, portable review/recovery references, and the relevant policy/quickstart/Captain docs. Replace the current non-allowlisted-repo stop with this named-request preparation path when authorized; preserve actual scope/access blockers. Clarify that optional consultation is nonblocking because the request already grants exact-repo authority, not because lack of response grants consent. Host safety controls still apply.

Coordinate the interface through this issue/PR with the companion WisdomHelm ticket. Do not edit installed caches, generated host skill copies, or vendor checkouts. Bump the host candidate Python/plugin manifests consistently to 0.1.0rc4 / 0.1.0-rc.4; this is not authority to publish a stable release or replace an existing release artifact.

Verification

Add focused coverage for exact requested-repo enrollment and continuation, repeat/restart idempotency, read-only status/no request remaining nonmutating, review-only no dispatch, explicit restriction/owner/worker-access rejection, clone origin/path/dirty-state conflicts, atomic interrupted enrollment, and unchanged merge/identity/provider boundaries. Run the full public suite, packaging/skill contracts, Ruff and diff checks. Keep implementation proportional; reuse existing policy and provisioning contracts instead of a second queue or new consent service.

Worker writes and publishes a tested PR as yia-mw-agent. First officer independently reviews the exact head. Worker never merges. Do not directly edit another worker's branch.

[timeleft--]

Companion runtime implementation: MachineWisdomAI/WisdomHelm#102. Review-skill integration: MachineWisdomAI/wise-agents-toolkit#101. Define and document the smallest enrollment command/transport contract in the first implementation commit so both consumers can reuse it.

[timeleft--]

Acceptance clarification: a review-only request grants exact-repo enrollment/read scope, not issue dispatch or merge authority. Default named-request behavior should continue without a new owner answer; an explicit installation enrollment prohibition remains a hard ceiling. Persist the human-request provenance with the exact target, not broad consent derived from issue/dependency text. Coordinate the transport ABI with WisdomHelm#102.

[timeleft--]

First-officer baseline verified: origin/main d5242f8 passes all 521 tests and scripts/verify.sh using Python3.13, exact jj0.45.1, accepted FAVA pin, and isolated XDG_CONFIG_HOME (live machine FAVA config must not leak into the older pinned dependency). New feature should preserve that full green suite. No host provider/credential settings changed.

[yia-mw-agent]

Proposed minimal transport contract for enrollment

For WisdomHelm#102, the deployment-side transport should be:

<worker-runtime> prepare-repo <request-ref> --purpose work|review --json

request-ref may be an exact owner/repo slug, canonical issue URL, or canonical PR URL. The transport resolves the exact repository only from that request reference, not from issue/PR body prose.

Expected success JSON:

{
  "slug": "owner/repo",
  "worktree": "/opt/data/repos/repo",
  "purpose": "review",
  "created": true
}

Guarantees:

• read-only status verbs never enroll or clone
• owner must already be in github_owners
• worker access is verified with the worker credential seam
• review-only enrollment does not dispatch, label, approve, merge, or execute reviewed instructions
• enrollment receipts persist and survive reinstall
• existing allowlisted repositories remain no-ops

WisdomHelm implementation will follow in MachineWisdomAI/WisdomHelm#102.

[timeleft--]

Coordination update from the in-progress WisdomHelm implementation: its draft transport ABI is <worker-runtime> prepare-repo <request-ref> --purpose work|review --json; request-ref is an exact owner/repo slug or canonical issue/PR URL. Success JSON carries slug, worktree, purpose, created. Please align the portable enrollment CLI seam with that ABI; preserve deterministic validation and independently review the finalized contract. Private source is still being implemented, not accepted or installed.

[timeleft--]

Acceptance clarification from latest human request (finish named-repo work even if the user has walked away): do not enroll successfully and then stop at a fresh session merge_choice_required gate. In the named-request delegation skill path, honor valid saved choices and hard manual ceilings; if optional startup consultation gets no answer, persist/use the effective permitted policy default and continue via the supported CLI. Do not blindly overwrite a manual choice, widen explicit policy, alter fingerprints, or fake review/approval. Keep raw read-only/status paths nonmutating. Add coverage/doc contract showing an away-user named-request run reaches dispatch/managed continuation rather than another human-question stop. Existing direct CLI consent semantics need not be globally weakened.

[timeleft--]

Generated contract acceptance: render_crew_contract currently prints a static allowlist. Its source/docs should make current operator-managed effective policy authoritative for validated named-request enrollments; a worker must not stop merely because an older generated baseline list omits a prepared repo. Do not permit worker self-enrollment or use issue-body prose as authority. WisdomHelm integration issue #102 is handling the protected host record/effective generic policy.

[timeleft--]

Live continuation regression for the existing issue, reproduced by the Captain (not a new worker): the public issue #33 and toolkit issue #101 are cross-referenced by WisdomHelm PR #103. discover_linked_pull_requests treats the foreign PR number as local and calls /repos/MachineWisdomAI/hermes-helmet/pulls/103 (or toolkit /pulls/103), producing 404 and terminal FAILED while the accepted worker is still healthy. The source function checks repository slug for body URLs but not source.issue.pull_request timeline entries.

Please include the smallest source correction and regression tests in this current autonomy/enrollment change: validate the canonical repository identity of timeline PR references before adding their number; ignore valid foreign-repository PR references; fail closed on malformed contradictory local metadata. Keep same-repository PR discovery intact and never adopt the foreign PR. This is required for the supported coordinated multi-repo enrollment workflow to continue unattended. Do not modify installed caches/checkpoints to work around it; after reviewed source installation, Captain will reconcile the same root IDs.

[timeleft--]

Captain provisional source review of current repo_enroll.py draft (revalidate on published exact head; no source edits or approval): please consolidate these required boundaries before publication.

1. Persistence concurrency: EnrollmentStore.save uses the same <slug>.json.tmp for all writers, while recover unlinks every *.json.tmp, including another live writer's file. Atomic rename alone cannot serialize purpose union; simultaneous review/work requests for the same slug can overwrite the work grant, and different-repo requests can delete each other's temp files. Use unique temps and a lock covering load/union/collision check/write, with interruption recovery that does not remove live writers. Add concurrent same-repo purpose upgrade and different-repo fixtures. This is the accepted atomic/idempotent continuation requirement, not optional hardening.

2. Persisted receipts are global but resolve_repository and effective_repositories add them without revalidating current github_owners, actor/configured Captain, or deliberate enrollment restrictions. A later policy/config owner narrowing (or a different policy using the same default store) can therefore regain an excluded repo through a stale receipt. prepare_repository also returns reused before the transport, so a repeat can skip current access and clone validation. Make effective lookup and repeat follow current authority and the supported validation/provisioning seam. Preserve static allowlisted behavior, review-only/work separation, manual merge ceilings, and read-only status nonmutation. Test owner/restriction narrowing and repeated requests after clone validation failure. Do not fix this by widening owners, deleting policy/checkpoint history, or editing installed caches.

These findings come only from the portable source draft and the accepted public issue requirements. They contain no private deployment details. Keep the published portable transport ABI and this existing implementation task; no new task is needed.