Uncommitted coily-regenerated lockdown drift on kai-server checkout #19

New issue

Closed

opened 2026-05-23 20:54:28 +00:00 by coilysiren · 1 comment

coilysiren commented

2026-05-23 20:54:28 +00:00

Owner

Originally filed by @coilysiren on 2026-05-22T09:33:50Z - https://github.com/coilysiren/infrastructure/issues/253

While pulling the repo on kai-server, its checkout showed uncommitted changes to .claude/lockdown-deny.sh and .claude/settings.json, both coily-regenerated:

lockdown-deny.sh: exec agent-guard hook pre-tool-use -> exec coily hook pre-tool-use (the coily#248 hook migration).
settings.json: + "Bash(coily ops gcloud:*)" in the allow list.

These are auto-generated by coily setup / coily lockdown --apply. The working tree on kai-server matches current coily output; the committed copies are stale. Likely the same drift exists in every catalog repo with a committed .claude/lockdown-deny.sh.

Decide and apply repo-wide: either commit the regenerated lockdown across repos, or stop committing the generated files (gitignore + regenerate via coily setup). Right now they drift silently on every coily lockdown-output change.

_Originally filed by @coilysiren on 2026-05-22T09:33:50Z - [https://github.com/coilysiren/infrastructure/issues/253](https://github.com/coilysiren/infrastructure/issues/253)_ While pulling the repo on kai-server, its checkout showed uncommitted changes to `.claude/lockdown-deny.sh` and `.claude/settings.json`, both coily-regenerated: - `lockdown-deny.sh`: `exec agent-guard hook pre-tool-use` -> `exec coily hook pre-tool-use` (the coily#248 hook migration). - `settings.json`: `+ "Bash(coily ops gcloud:*)"` in the allow list. These are auto-generated by `coily setup` / `coily lockdown --apply`. The working tree on kai-server matches current coily output; the committed copies are stale. Likely the same drift exists in every catalog repo with a committed `.claude/lockdown-deny.sh`. Decide and apply repo-wide: either commit the regenerated lockdown across repos, or stop committing the generated files (gitignore + regenerate via `coily setup`). Right now they drift silently on every coily lockdown-output change.

coilysiren commented

2026-05-30 05:43:34 +00:00

Author

Owner

Merged into #164 in the 2026-05-29 backlog burn-down. lockdown drift instance, same as sync task #164 Reopen if it should stand alone.

coilysiren closed this issue

2026-05-30 05:43:35 +00:00

coilysiren referenced this issue

2026-07-04 10:38:26 +00:00

Apply priority triage to 78 un-triaged flight-deck+bridge tickets (labels out of director tier) #470

coilysiren referenced this issue

2026-07-04 10:38:33 +00:00