fix(development-system): make local checkpoints executable

Provide one repository-owned locked compare-and-swap writer, define stable fallback checkpoint identities, and make restart owner selection depend on publication authority across every delivery mode.

Closes: 20260901-xige

Author: jwilger

plugins/development-system/components/tiber/skills/tiber/SKILL.md

@@ -87,9 +87,10 @@ relative to this skill file and prefer that launcher before probing `PATH`.
   tracked/untracked snapshot algorithm defined by the public
   `development-workflow` skill; that skill is the sole schema owner. Do not
   invent alternate keys, delimiters, hashes, or state-specific nullability.
-  For the local owner, also use its task-scoped lock and generation/predecessor
-  compare-and-swap rule so a stale linked-worktree writer cannot replace a
-  newer transition.
+  For the local owner, use the task-scoped lock and generation/predecessor
+  compare-and-swap writer bundled with the public skill so a stale
+  linked-worktree writer cannot replace a newer transition; do not synthesize a
+  second filesystem implementation.
   Never put raw logs, credentials, or secrets in the note. On restart or
   handoff, use `tiber.show` for the published owner or read the selected local
   `.latest` owner, then reconcile the record with Git and forge state before

plugins/development-system/scripts/write-local-checkpoint.sh

@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+usage() {
+  echo "usage: write-local-checkpoint.sh CHECKPOINT_ID EXPECTED_GENERATION EXPECTED_PREDECESSOR RECORD_FILE" >&2
+  exit 2
+}
+
+[[ $# -eq 4 ]] || usage
+checkpoint_id=$1
+expected_generation=$2
+expected_predecessor=$3
+record_file=$4
+
+[[ $checkpoint_id =~ ^[A-Za-z0-9._-]+$ ]] || { echo "invalid checkpoint id" >&2; exit 2; }
+[[ $expected_generation =~ ^(0|[1-9][0-9]*)$ ]] || usage
+[[ -f $record_file ]] || usage
+[[ $(wc -l < "$record_file") -eq 1 ]] || { echo "record must contain exactly one newline-terminated line" >&2; exit 2; }
+
+record=$(<"$record_file")
+[[ $record == checkpoint-v1\ * ]] || { echo "record must start with checkpoint-v1" >&2; exit 2; }
+json=${record#checkpoint-v1 }
+jq -e --argjson generation "$expected_generation" --arg predecessor "$expected_predecessor" '
+  .generation == $generation and
+  (if $generation == 0 then .predecessor_sha256 == null else .predecessor_sha256 == $predecessor end)
+' <<<"$json" >/dev/null
+
+git_common_dir=$(git rev-parse --path-format=absolute --git-common-dir)
+checkpoint_dir="$git_common_dir/development-system/checkpoints"
+target="$checkpoint_dir/$checkpoint_id.latest"
+lock="$checkpoint_dir/$checkpoint_id.lock"
+umask 077
+mkdir -p "$checkpoint_dir"
+chmod 700 "$checkpoint_dir"
+exec {lock_fd}>"$lock"
+flock -x "$lock_fd"
+
+if [[ -e $target ]]; then
+  current_generation=$(sed -n 's/^checkpoint-v1 //p' "$target" | jq -er '.generation')
+  current_predecessor=$(sha256sum "$target" | cut -d ' ' -f 1)
+  [[ $expected_generation -eq $((current_generation + 1)) ]] || { echo "stale checkpoint generation" >&2; exit 3; }
+  [[ $expected_predecessor == "$current_predecessor" ]] || { echo "stale checkpoint predecessor" >&2; exit 3; }
+else
+  [[ $expected_generation -eq 0 && $expected_predecessor == null ]] || { echo "missing checkpoint predecessor" >&2; exit 3; }
+fi
+
+temporary=$(mktemp "$checkpoint_dir/.$checkpoint_id.tmp.XXXXXX")
+trap 'rm -f -- "$temporary"' EXIT
+cp -- "$record_file" "$temporary"
+chmod 600 "$temporary"
+sync -f "$temporary"
+mv -f -- "$temporary" "$target"
+sync -f "$checkpoint_dir"
+trap - EXIT

plugins/development-system/skills/development-workflow/SKILL.md

@@ -51,17 +51,24 @@ unavailable native workflow scheduler is never the owner. When task-board
 remote publication is authorized, append every transition to the active Tiber
 task with `tiber.note.add` (CLI: `tiber note add`). When remote mutation is not
 authorized, store the latest record at
-`$(git rev-parse --git-common-dir)/development-system/checkpoints/<task-id>.latest`
-instead. Create its parent with owner-only permissions and serialize transitions
-with an exclusive task-scoped lock in that directory. While holding the lock,
-read the current complete record and require the proposed record's
+`$(git rev-parse --git-common-dir)/development-system/checkpoints/<checkpoint-id>.latest`
+instead. Use the active task ID as `checkpoint-id` when one exists. Otherwise
+derive it as lowercase hexadecimal SHA-256 of the exact byte sequence
+`baseline_oid`, one NUL byte, and the normalized original user request, and
+record that ID in every handoff. Invoke the bundled
+`<plugin-root>/scripts/write-local-checkpoint.sh` with that ID, the expected
+generation, the expected predecessor digest (or literal `null`), and a file
+containing the proposed newline-terminated record. The helper creates the
+owner-only parent and serializes transitions with an exclusive task-scoped
+lock. While holding the lock, it reads the current complete record and requires
+the proposed record's
 `generation` to equal the current generation plus one and its
 `predecessor_sha256` to equal SHA-256 of the exact current `checkpoint-v1` line;
 the bootstrap record uses generation zero and a null predecessor. Reject a
-missing or stale predecessor without replacing the current record. Then write
-one complete line to a same-directory temporary file, flush it, atomically
-rename it over the target, flush the directory, and release the lock; never
-append in place. Keep this local file
+missing or stale predecessor without replacing the current record. The helper
+writes one complete line to a same-directory temporary file, flushes it,
+atomically renames it over the target, flushes the directory, and releases the
+lock; never synthesize a second writer or append in place. Keep this local file
 untracked and out of the content snapshot. Select one owner for the current
 delivery mode and never treat an unpublished Tiber transaction as the local
 fallback. After every transition, persist exactly one record before the next
@@ -106,8 +113,9 @@ gate receipts are `null`, and CI may be empty, only when `baseline_oid` equals
 and `delivery` identifies that same pre-existing baseline. A dirty,
 non-baseline, or unreconciled starting worktree is a recovery hold, not a
 bootstrap shortcut. Store bounded references rather than raw logs or secrets.
-At session start, restart, or handoff, read the selected owner: `tiber.show` for
-authorized task publication or the exact local `.latest` file for local-only.
+At session start, restart, or handoff, read the selected owner: `tiber.show` when
+task publication was authorized for this checkpoint, otherwise the exact local
+`.latest` file regardless of repository delivery mode.
 Select its latest `checkpoint-v1`
 record, verify its generation/predecessor chain when history is available, and
 reconcile every identity with current Git and forge state before acting. A

scripts/tests/development-discipline-plugin.bats

@@ -76,8 +76,9 @@ setup() {
 
 @test "local durable checkpoints reject stale cooperative writers" {
   skill="$ROOT/plugins/development-system/skills/development-workflow/SKILL.md"
+  writer="$ROOT/plugins/development-system/scripts/write-local-checkpoint.sh"
 
-  run grep -F "exclusive task-scoped lock" "$skill"
+  run grep -F "owner-only parent and serializes transitions with an exclusive task-scoped" "$skill"
   [ "$status" -eq 0 ]
 
   run grep -F 'generation` to equal the current generation plus one' "$skill"
@@ -88,6 +89,28 @@ setup() {
 
   run grep -F "stale predecessor" "$skill"
   [ "$status" -eq 0 ]
+
+  repo=$(mktemp -d)
+  git -C "$repo" init -q
+  first="$repo/first.record"
+  second="$repo/second.record"
+  stale="$repo/stale.record"
+  printf '%s\n' 'checkpoint-v1 {"generation":0,"predecessor_sha256":null}' >"$first"
+
+  run bash -c 'cd "$1" && "$2" work-item 0 null "$3"' _ "$repo" "$writer" "$first"
+  [ "$status" -eq 0 ]
+  target="$repo/.git/development-system/checkpoints/work-item.latest"
+  predecessor=$(sha256sum "$target" | cut -d ' ' -f 1)
+  printf 'checkpoint-v1 {"generation":1,"predecessor_sha256":"%s"}\n' "$predecessor" >"$second"
+
+  run bash -c 'cd "$1" && "$2" work-item 1 "$3" "$4"' _ "$repo" "$writer" "$predecessor" "$second"
+  [ "$status" -eq 0 ]
+  current=$(<"$target")
+  printf 'checkpoint-v1 {"generation":1,"predecessor_sha256":"%s"}\n' "$predecessor" >"$stale"
+
+  run bash -c 'cd "$1" && "$2" work-item 1 "$3" "$4"' _ "$repo" "$writer" "$predecessor" "$stale"
+  [ "$status" -eq 3 ]
+  [ "$(<"$target")" = "$current" ]
 }