live-evidence-branch-freeze

name	live-evidence-branch-freeze
description	Run BEFORE any force-push, rebase, branch restart (`checkout -B`), or squash-merge-and-reuse of a branch in this repo — and BEFORE dispatching any SSH-free/self-reporting RunPod lane (open-judge, virtue-evals, independence-eval-v2, long-horizon, wisdom-pilot) — to check whether live pods or workflows are still PUSHING EVIDENCE to that branch. Those pods clone the branch at pod start and push receipt commits back to it; a mid-run history rewrite makes their pushes non-fast-forward, which either times out the launcher (a wasted paid pod-hour) or silently drops the receipts while the Actions run still reports SUCCESS (green-but- resultless). Fires on: "rebase the PR branch", "restart the branch from main", "force-push", "re-use the merged branch", or dispatching a lane whose workflow says "pod self-reports via git push".
metadata	{"short-description":"Never rewrite a branch that live self-reporting pods are pushing evidence to"}

Live-evidence branch freeze

The incident this prevents (2026-07-06, PR #655 / runs 28772411875 + 28772413187)

Eleven benchmark lanes were dispatched against a PR branch. While three SSH-free pods were still running, the branch history was rewritten twice (a lease-caught force-push collision, then a checkout -B restart from main after the PR merged). Consequences, both real:

• open-judge (run 28772411875): the pod finished but its receipt push could no longer fast-forward; the launcher's 60-min wait timed out and deleted the pod — one paid pod-hour spent, zero receipts ([selfreport] wait timed out after 60 min; deleting pod ... to be safe).
• virtue-evals (run 28772413187): the Actions run concluded success, but no sophrosyne/dikaiosyne receipts ever landed on any branch — the pod's push was silently orphaned. Green-but-resultless, exactly the failure mode wisdom-gpu-prebaked §6 warns about ("Actions success is not proof of a result").

An earlier, luckier variant in the same session: --force-with-lease on the same branch rejected a push because independence/long-horizon evidence commits had landed mid-rebase; the 5 clobbered bot commits had to be recovered by cherry-pick (all were, zero loss — but only because the lease fired and the objects were still fetchable).

The rules

1. Before ANY history rewrite of a branch (force-push, rebase-push, checkout -B restart, branch deletion): list in-flight runs pinned to it — curl -sf "https://api.github.com/repos/tomyimkc/sophia-agi/actions/runs?branch=<branch>&status=in_progress" (also check status=waiting and status=queued). Any self-reporting lane in that list → freeze: wait for it to conclude AND for its receipts to appear on the branch, or cancel it deliberately and note the spend. Do not rewrite under it.
2. Prefer dispatching self-reporting lanes on main (or another branch nobody rewrites), not on an active PR branch that may be rebased/restarted/squash-merged while pods run.
3. After a lease-rejected push, investigate before overriding: the commits that moved the ref may be a pod's evidence. git fetch the branch, git log <yours>..origin/<branch>, and cherry-pick/preserve bot commits (authors like github-actions[bot], subjects like ckpt ..., pod heartbeat, evidence(...)) before any --force-with-lease retry.
4. A green self-reporting run is unverified until its receipt is on the branch. Always confirm the artifact path the workflow names (e.g. agi-proof/benchmark-results/{sophrosyne,dikaiosyne}/, agi-proof/benchmark-results/wisdom-market/open-judge-regrade.json) actually gained a commit. No receipt → treat as failed, re-dispatch on a stable ref.
5. Merged-PR branch restarts (checkout -B <branch> origin/main) count as rewrites: do step 1 first — evidence pods dispatched pre-merge may still be running against the pre-merge history.