feat(cloud-folder): sync mode with rclone (cloud-folder 1.1.0)

README.md

@@ -14,7 +14,7 @@ installing Node.js, and a one-line bootstrap that wires both into any repo.
 | [`git`](src/git) | git augmented for the container: a worktree-aware wrapper that scopes `GIT_DIR` to the checkout and maps a `.git` pointer under the host's `.git-dirs` onto one shared mount, `safe.directory` and `core.hooksPath` at post-create, the global config in a volume it owns. |
 | [`gh`](src/gh) | [GitHub CLI](https://cli.github.com) from GitHub releases, checksum-verified, unless the official Feature installed it; its login (`GH_CONFIG_DIR`) in a volume it owns, git's GitHub credentials taken from it. |
 | [`ssh-agent`](src/ssh-agent) | `SSH_AUTH_SOCK` at a fixed path in every process, so git commits can be signed with an SSH key: the launcher mounts the host's agent socket (linux, macOS, a WSL distro), the private key never entering the container; the Windows engines get a plain explanation and an opt-in, temporary key mode; `ssh-agent:*` tasks for keys, dedicated-key warnings, rotation and retirement (`key:rotate`, `key:retire`, `key:age`) and git signing setup. |
-| [`cloud-folder`](src/cloud-folder) | One fixed path (`/mnt/cloud-folder`, the `mountPoint` option) for a shared document folder that must never go in git (SharePoint, OneDrive): today host mode, the launcher bind-mounting the host folder a sync client keeps (`DCF_HOST_CLOUD_FOLDER`) at `/mnt/cloud-folder-host`, linked from `mountPoint`; `cloud-folder:status` says whether it is mounted, empty and writable and fails when it is not, so a start-up check can stop. rclone sync and mount come later. |
+| [`cloud-folder`](src/cloud-folder) | One fixed path (`/mnt/cloud-folder`, the `mountPoint` option) for a shared document folder that must never go in git (SharePoint, OneDrive), filled by host mode (the launcher bind-mounting the host folder a sync client keeps, `DCF_HOST_CLOUD_FOLDER`, at `/mnt/cloud-folder-host`, linked from `mountPoint`) or sync mode (rclone, pinned and verified, running `bisync` with the remote on a timer and on demand, the sign-in in the Feature's volume; nothing privileged, so it works on a cluster); `cloud-folder:status` fails when the folder is missing, unwritable, never synced or its last sync failed, so a start-up check can stop, and `cloud-folder:shutdown-check` refuses a stop while a sync runs or local changes wait. rclone mount comes later. |
 | [`az`](src/az) | Augments the official `azure-cli` Feature: its login (`AZURE_CONFIG_DIR`) in a volume it owns, `az bicep` using the Bicep on PATH. |
 | [`kube-state`](src/kube-state) | Owns the kubeconfig (`KUBECONFIG`) the Kubernetes tools share, in a volume it owns, so velero and kubectl stop needing a hand-mounted `~/.kube`; installs no binary. |
 | [`common`](src/common) | The shared helper behind every Feature's post-create hook (`dcf-persist`: make a state directory usable and say what backs it), for a repo's own scripts too. |
@@ -301,6 +301,10 @@ signing key in the container's volume and so breaks "the key never enters the co
 `/mnt/cloud-folder-host`, and the Feature's `mountPoint` (default `/mnt/cloud-folder`) links there: the path in the
 container is named once, in that option. Drop a hand-written bind mount of the folder from `devcontainer.json`. Put
 `task cloud-folder:status` in your start-up check: it fails when the folder is missing or unwritable.
+Where there is no host folder (a cluster), `cloud-folder` 1.1.0 syncs it with rclone instead: set `siteUrl` and
+`remotePath`, run `task cloud-folder:login` once, and a timer keeps the folder in sync; add
+`cloud-folder-setup shutdown-check` to your `shutdown:check` so a stop waits for a running sync (see the Feature's
+NOTES).
 
 All of them also answer to `dc:` (the include's alias in the generated
 Taskfile). Each task dispatches per platform (Task's per-command

TODO.md

@@ -272,6 +272,7 @@ stays. Ids are short descriptive slugs (two to four kebab-case words naming the
 - [ ] **cloud-folder-ci-check Read the first CI run of the cloud-folder tests** (engineers). The Feature's container tests (`test/cloud-folder`) and the collection-wide test have not run with Docker anywhere but CI; read the first CI run and file what it shows. Added 2026-10-27.
 - [ ] **cloud-folder-workstation-up Run cloud-folder once on the workstation** (the Operator). One real `up` with a cloud folder whose path has spaces, on Docker Desktop and on wslc, to check the launcher's mount and `cloud-folder:status` on real hosts. Added 2026-10-27.
 - [ ] **release-cloud-folder Release cloud-folder 1.0.0 and devcontainer-cli 1.12.0 after the step 1 pull request merges** (the Operator). The host does not start the release. Until it runs, consumers cannot pull cloud-folder or name it in `installsAfter`. Added 2026-10-27.
+- [ ] **cloud-folder-step-2-rebase Rebase cloud-folder step 2 onto main** (host). The step 2 branch `feature/cloud-folder-feature/2` was cut from step 1 before #82 was squash-merged, so it carries the old history; rebase it onto `origin/main` once its subagent has finished, before any commit on it. Added 2026-10-27.
 
 ## Next
 
@@ -288,8 +289,10 @@ stays. Ids are short descriptive slugs (two to four kebab-case words naming the
 - [ ] **kube-state-installs-after kube-state integrations and test count derivation** (host). After release (release-collection): add kube-state to `installsAfter` in velero, kustomize, argocd and kubeconform Features; derive Feature count in test/_global from src/ listing instead of hard-coded value. (was TD-17) Added 2026-10-16.
 - [x] **merge-features-pr Merge the Features PR #12** (the Operator). devhost 1.2.3 and git 1.1.0 (the src and test commits plus the sign-off hook fix), on `features/devhost-and-git-fixes`; the records PR #13 stacks on it. Merge with the admin bypass once CI is green, then run the release. Added 2026-10-16. Done 2026-10-19.
 - [x] **new-feature-checklist One checklist for adding a Feature** (host). What a new Feature needs is spread over README, CONTRIBUTING, the CI matrices and `test/_global` (a hard-coded Feature count), and scenarios that call `task` need `go-task` listed; three cons rediscovered it. One list in CONTRIBUTING.md. Ledger review 2026-10-16, group 5. Added 2026-10-16. Done 2026-10-16.
-- [ ] **claude-host-join-running claude-host joins a running session with CLAUDE_HOST_JOIN=1** (host). Requested by agentic-operating-framework (its ADR 0015, 2026-10-27): with `CLAUDE_HOST_JOIN=1`, claude-host attaches to a live background session in the folder (the pinned id if live, else the newest by `startedAt`) instead of refusing, with a one-line note on stderr and a duplicates line when more than one is live; nothing live keeps today's `--resume`/`--session-id`; an interactive one prints its session id, pid and terminal (`ps -o tty=`), says to switch to that terminal or Remote Control, and exits 1 starting nothing; `devcontainer:claude` passes the variable through. claude-code 1.7.0 and a devcontainer-cli minor bump. Their `scripts/test-join.sh` (fake `claude`; cases: nothing live as an ended entry, a dead pid or another folder; one background session; two live with the pinned one older; two live with the pin in neither; the duplicates line; an interactive session; an unreadable list) fits `task test:claude-unit`; they drop `scripts/join.sh` once the release ships. Linked to `fleet-attach-wording` (the same attach advice, same release) and `session-concept-drop` (the host sees no conflict; decide it first). Added 2026-10-27.
+- [ ] **claude-host-join-running claude-host joins a running session with CLAUDE_HOST_JOIN=1** (host). Requested by agentic-operating-framework (its ADR 0015, 2026-10-27): with `CLAUDE_HOST_JOIN=1`, claude-host attaches to a live background session in the folder (the pinned id if live, else the newest by `startedAt`) instead of refusing, with a one-line note on stderr and a duplicates line when more than one is live; nothing live keeps today's `--resume`/`--session-id`; an interactive one prints its session id, pid and terminal (`ps -o tty=`), says to switch to that terminal or Remote Control, and exits 1 starting nothing; `devcontainer:claude` passes the variable through. claude-code 1.7.0 and a devcontainer-cli minor bump. Their `scripts/test-join.sh` (fake `claude`; cases: nothing live as an ended entry, a dead pid or another folder; one background session; two live with the pinned one older; two live with the pin in neither; the duplicates line; an interactive session; an unreadable list) fits `task test:claude-unit`; they drop `scripts/join.sh` once the release ships. Linked to `fleet-attach-wording` (the same attach advice, same release) and `session-concept-drop` (the host sees no conflict; decide it first). Added 2026-10-27. Paused 2026-10-27 by the Operator: `agent-kind-standard` replaces it (a resident agent always attaches); not built; the requester keeps `scripts/join.sh` until that ships.
 - [ ] **cloud-folder-feature A cloud folder in the container through rclone** (host). Requested by the client engagement office (2026-10-27): one fixed path in the container (`/mnt/cloud-folder`, option `mountPoint`) that agents read and write as a directory, filled from SharePoint or OneDrive through rclone, so it no longer depends on one Windows host's sync client and works on a Kubernetes cluster. The rclone binary is on containers.dev; no Feature configures a remote, signs in, mounts or syncs. Modes: `auto` (default: `mount`, else `sync`), `mount` (`rclone mount`, needs FUSE), `sync` (`rclone bisync` to a volume, on a timer, unprivileged), `host` (a host bind mount, no rclone); tasks `login`, `status`, `sync`, `unmount`. The Operator said yes (2026-10-27): a proposal in `docs/proposals/` first, then three slices (`host` plus `status`; `sync` plus `login`; `mount` with the launcher granting FUSE). Added 2026-10-27.
+- [ ] **agent-kind-standard One agent list and two agent kinds for every agent CLI** (host, the Operator's direction 2026-10-27). Each repository declares its agents in one list (default `.devcontainer/agents.yml`, its path configurable, the Operator 2026-10-27): a name, a CLI and one of two kinds, `resident` (runs continuously in the background, started with the container; starting it attaches) or `on-demand` (starting it opens a new session; a resume on request). One verb (`task agent -- <name>`) does the right thing for the kind; each CLI Feature supplies an adapter with the same verbs (start in the background, attach, resume, new, list running), Claude Code first, Copilot and others later, so the standard is the same across CLIs. Replaces session pins, the pin hook, claude-host's refusals and attach advice, the fleet's `SESSIONS` line and `CLAUDE_HOST_JOIN`. First test the Claude Code facts it rests on (from `fleet-design-rethink`), then a proposal in `docs/proposals/` for the Operator. Added 2026-10-27. Folded in `agents-feature-redesign`, a duplicate (2026-10-27).
+- [ ] **agent-rebuild-check Check background agents come back after a rebuild** (the Operator). The agent-kind standard's Claude Code facts are tested in a sandbox, but whether background sessions return after a devhost rebuild can only be checked on the workstation. Run it there once the proposal `docs/proposals/agents.md` is accepted. Added 2026-10-27.
 
 ### Devhost and the way of working
 
@@ -325,6 +328,8 @@ stays. Ids are short descriptive slugs (two to four kebab-case words naming the
 - [ ] **az-pinned-version Decide how a consumer gets a pinned az** (host). Two entries for az and `azure-cli` with different options install the CLI twice, and the CLI's own ordering decides which version wins (`src/az/NOTES.md`). Decide how a consumer that needs a pinned az version gets one. Added 2026-10-21.
 - [ ] **scribe-stale-expiry The scribe drops a stale pending stretch by age** (host). The shutdown check already notes a pending file untouched for over a day; the scribe's job still expires a pending item only by its run count, so a finished subagent's stretch can stay pending. Expire it by age as well, with a test; split out of `shutdown-stale-stretch`, which keeps only the shutdown half it finished, as the Operator decided on 2026-10-23. Added 2026-10-23.
 - [ ] **fleet-design-rethink Agents without sessions: rethink the fleet from what Claude Code provides** (host). The Operator (2026-10-24) finds the pins and `/clear` handling overcomplicated and wants the session out of the domain: an agent is a role, a room and its records; a disposable background worker per agent starts with the container; a human opens a conversation in the agent's room and leaves; the ledger (reached through a records MCP) carries continuity. First test the Claude Code facts it rests on (`--bg` restore after a rebuild, `--bg` with `-c`, attach by part of a name, whether a name survives `/clear`), then write the proposal in `docs/proposals/`: the model, what wakes a worker (backlog, schedule, events), two sessions in one room, idle cost, the ledger as the only memory, and the migration (claude-code 2.0, the AOF). The proposal also covers the shutdown handshake (tabled here 2026-10-24): the stop writes a request marker, idle agents count as yes, busy agents are asked through a hook and vote yes or no with a reason, the backs pause and vote too, and the stop waits for every vote or a deadline (it absorbs `safe-shutdown-backs-pause`). Tabled by the Operator 2026-10-24; decision `session-concept-drop`. Added 2026-10-24.
+- [ ] **remote-control-bg Check whether Remote Control reaches background sessions** (the Operator). The docs are silent on it and a third-party write-up says it cannot, which matters for the host agent; try it on the workstation with a background session and record the result in the agents proposal (`docs/proposals/agents.md`). Added 2026-10-27.
+- [ ] **resident-agents-late-records Check back records under load with several resident agents** (engineers). Each back job takes a lock, so a turn that finds it busy is skipped and its record lands on that session's next turn; with several resident agents busy in one folder the record can arrive a turn late. Run three resident agents in the repository root under load and measure the lag in the ledger. Added 2026-10-27.
 
 ## Decisions for the Operator
 
@@ -402,6 +407,8 @@ stays. Ids are short descriptive slugs (two to four kebab-case words naming the
 - [ ] **fleet-hook-settings Decide where the SessionStart pin hook is registered** (the Operator). The claude-code Feature's pin write-back hook is opt-in, and the documented way to register it is a `.claude/settings.json` entry; the host will not add that to this repository's settings without the Operator's decision. Should this repository register the hook, and should the Feature's default change? No recommendation given. Added 2026-10-24.
 - [ ] **pin-subfolder-skip Accept that sessions deeper than one sub-folder skip the pin without a named variable** (the Operator). A session started below the top sub-folder looks for a pin variable named after its own folder; with none, the hook skips it with a note. Recommendation: accept, as built. Added 2026-10-24.
 - [ ] **fleet-waiting-line Print the fleet's waiting line only while the list changes** (the Operator). The fleet now prints "waiting for restored sessions…" on every run and waits at least `FLEET_SETTLE_INTERVAL` (3 seconds) before starting anything. Recommendation: print it only while the session list is changing, a few lines of change; the host can fold that in before #76 merges. Added 2026-10-24.
-- [ ] **session-concept-drop Drop the session from the domain?** (the Operator). Should agents stop being identified by session id, so the domain keeps only a name and a folder, with background agents that start with the container and interactive attach for humans? The pins, the pin hook and the stale-pin warnings would go with it. No recommendation was recorded; the host's shape is untested against Claude Code (`fleet-design-rethink`). Added 2026-10-24.
+- [x] **session-concept-drop Drop the session from the domain?** (the Operator). Should agents stop being identified by session id, so the domain keeps only a name and a folder, with background agents that start with the container and interactive attach for humans? The pins, the pin hook and the stale-pin warnings would go with it. No recommendation was recorded; the host's shape is untested against Claude Code (`fleet-design-rethink`). Added 2026-10-24. Done 2026-10-27.
 - [x] **commit-sessions-setting Commit the fleet's SESSIONS setting on a topic branch** (the Operator). The `SESSIONS` line in the root `Taskfile.yml` is uncommitted on a detached HEAD beside the backs' records changes; committing needs a topic branch first (`task devhost:branch`). Commit it on a branch, or leave it uncommitted? Added 2026-10-24. Done 2026-10-24: "yes", committed on a topic branch.
-- [ ] **cloud-folder-commit Commit, push and open the pull request for cloud-folder step 1** (the Operator). Step 1 (`host` mode), the proposal, ADR 0031 and the records are in the working tree, nothing committed; the host recommends one commit, with cloud-folder at 1.0.0 and devcontainer-cli at 1.12.0, once the Operator has checked the rework. Added 2026-10-27.
+- [x] **cloud-folder-commit Commit, push and open the pull request for cloud-folder step 1** (the Operator). Step 1 (`host` mode), the proposal, ADR 0031 and the records are in the working tree, nothing committed; the host recommends one commit, with cloud-folder at 1.0.0 and devcontainer-cli at 1.12.0, once the Operator has checked the rework. Added 2026-10-27. Done 2026-10-27.
+- [x] **agent-kinds-two Two agent kinds or three?** (the Operator). The host's draft has three kinds (interface, general, contractor), each deciding what start means; the Operator suggested less prescription: two kinds, background (kept running, attached on start) and on-demand (resumed or started when asked), or the kind simply stated in `agents.yml`. No recommendation recorded. Added 2026-10-27. Done 2026-10-27: two kinds, `resident` and `on-demand` (`agent-kind-standard`).
+- [ ] **agents-file-decisions Where the agent list lives and what wins** (the Operator). Three decisions in the agents proposal (`docs/proposals/agents.md`): how a repository points at its agent list instead of the default `.devcontainer/agents.yml` (a Feature option or the `AGENTS_FILE` variable), that paths in it are relative to the repository root, and which one wins when both are set (the proposal recommends one). The five open session-pin items wait on this decision. Added 2026-10-27.