Add guard rails for several agents working on the repo at once

Deploys from unpushed branches were being reverted by the next deploy
from main, and in-place vault edits could overwrite each other.

- deploy-guard.yml (imported by site.yml and dns.yml) refuses real runs
  unless the checkout is clean and exactly origin/main; --check is fine.
- bin/deploy holds a lock so only one deploy runs at a time.
- bin/vault-run edits the vault under a lock with an atomic swap.
- bin/worktree starts a task in a fresh worktree from origin/main.
- CLAUDE.md explains the workflow.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

This commit is contained in:

Phil

2026-10-31 09:29:41 -06:00

co-authored by

Claude Opus 5.5

parent 9363bc24d5

commit 0875389d02

8 changed files with 149 additions and 0 deletions

									
										dns.yml
									
		+2
		
												View File
												
				@@ -1,5 +1,7 @@

				---

				# dns.yml

				- import_playbook: deploy-guard.yml

				- name: Add A Records for thesatelliteoflove.com and nerder.land

				  hosts: localhost

				  gather_facts: false