feature/auth/middleware
claude · opus 4.7
- pkka73 scaffold session middleware
- hxe72g verify access-token grants
- 5xtkhq rate-limit per session
- 2qpsr7 extract token store
Agents
Every agent gets its own thread. No collisions, no lost context.
Two agents on the same repo collide. Retries duplicate work. Handoffs lose context. The shared record is whatever survives in chat. Heddle gives each agent its own task-thread, and the team one operating record across them. Cursor, Claude Code, Codex converge on one Heddle repo.
heddle agent list · heddle/core-services
Agent Thread Status States Elapsed
- mochi claude-opus-4.7
task/biscuit-authzwriting tests for scope denialrunning711m 04s - nori claude-sonnet-4.6
chore/structured-loggingrefactoring log handlerrunning408m 22s - ume claude-opus-4.7
fix/migration-0042awaiting signatureready1224m 58s - haku claude-haiku-4.5
docs/agents-api-referencewaiting for review feedbackidle202m 17s
02 Task threads
Run many task-threads.
One repository.
Each task is its own named thread: isolated by default, addressable, recoverable. Merge creates a new state. The whole record holds: every capture, every retry, every fork.
feature/auth/tests
gpt · 5.4
- zepss6 cover login happy path
- 3jmtnk test expired tokens
- 9fbcqm fuzz the rate limiter
feature/auth/docs
grok · 4.20
- x9r2qm draft auth API reference
- vknq84 add migration notes
MERGE feature/auth
Isolated worktrees
One repo. Many agents. No lock contention.
Each worktree is a lightweight pointer into the shared object store. Any agent gets an independent working directory backed by the full history. Isolation is structural: not coordinated, not negotiated.
heddle start task/biscuit-authz --agent-provider anthropic --agent-model claude-opus-4.7 Multi-agent coordination
Parallel threads. Merged with attribution intact.
Each agent works on its own worktree with independent state. Snapshot isolation is structural: the worktree holds its own view, the shared object store keeps the record consistent.
Merge when the work is ready. Attribution from every agent is preserved through the merge. You always know who contributed which state.
Attribution
Every action carries its author.
The agent registry records ID, provider, model, and status at spawn time. That metadata is structural, threaded into the object model from the first write. When work is merged, attribution from every agent is preserved.
You always know what each agent did, under which model, with what authorization. The record survives the merge.
task
task/biscuit-authzstate
hd-0t4vb369z687actor claude-opus-4.7
provider anthropic
delegated by anan@heddle.sh
confidence 0.94
signature
ed25519:a8f3c1d7 ✓captured 2026-04-22 · 11:47
Context annotations
The next agent sees your constraints before it edits.
Constraints, invariants, and design rationale attach directly to the code they govern, scoped to a file, a symbol, or a line range. When the next agent opens the same function, the annotation is already there.
crates/objects/src/object/state_review.rs fn signing_payload moduleEvery review signature must be computed over the exact bytes signing_payload produces, never an ad-hoc serialization. That payload is the single source of truth for what a verifier signs over.
The payload always begins with SIGNING_PAYLOAD_VERSION_TAG (hd-rev-sig-v1), so verifiers in any language reproduce the bytes and reject an unknown version outright. Bumping the tag versions the format without silently accepting stale signatures.
Any new signing surface should mirror this contract: a versioned, length-delimited payload from one shared function, so ReviewSignature::validate can authenticate who reviewed which state without trusting the caller's framing.
crates/objects/src/object/action_struct.rs struct Action moduleThe action DAG is append-only. An action's id (a BLAKE3 content hash over its parents, tree, and metadata) is immutable once written.
Rebase, collapse, and merge produce new actions. The pre-operation tip stays reachable from whatever ref originally held it. No force-push semantics, no rewriting in place. git push --force has no analog here.
Practical consequence: any hd-… state-id you've ever recorded in a comment, ticket, audit log, or another annotation will resolve forever. The audit trail isn't best-effort.
crates/repo/src/commit_graph.rs fn find_merge_base moduleThread resolution walks the DAG upward to the most recent common ancestor (the LCA) rather than dereferencing the named head directly.
An agent that forked at state hd-1bagvnhmt61d expects to see that state. If the parent thread rebased after the fork, the named head moved on disk but the agent's view didn't. Walking to the LCA preserves the agent's structural view across long-running sessions, even when a teammate has been rebasing on top of them.
The trade: thread resolution is O(depth-to-LCA) instead of O(1). Measured at 0.4ms p99 across the workspace's internal repos; acceptable.
A codebase that remembers
Scoped to the symbol. Flagged when the code moves.
Constraints and rationale attach to the code they govern, not to a
wiki that falls behind, not to a channel that scrolls away. Scoped
to the file, the symbol, or the line. Staleness is flagged on demand
with heddle context check. When the next agent opens the
file, the context is already there.