fix(git-sync): the auto-sync toggle is authoritative and live (#3010)

[dolho]

Summary

PUT /api/agents/{name}/git/auto-sync wrote the DB row and nothing else. The container gated its heartbeat on GIT_SYNC_AUTO, read once at startup, and every recreate re-derived it as DB flag OR baked env. OFF never took effect on an agent that baked the env; ON waited for the next recreate.

• Live on toggle. The agent loop starts whenever it can ask the platform (TRINITY_BACKEND_URL + its own TRINITY_MCP_API_KEY) and reads the owner's flag every cycle through the existing GET .../git/auto-sync. OFF skips the next cycle, ON runs it, no recreate. 404 "Git not configured" → off; platform unreachable / 5xx / auth refusal / uniform 404 → the GIT_SYNC_AUTO env (the last value the platform handed the container).
• One writer. _apply_git_env_from_db derives GIT_SYNC_AUTO from auto_sync_enabled alone (the OR branch and its log are gone). Creation writes the flag from the same _git_auto_sync_baked predicate that bakes the env, ghosts included (the old and not config.ephemeral is what made env and DB disagree at birth).
• Authorization aligned. Recreate still never writes the flag, so POST .../start (AuthorizedAgentByName) can't flip the owner-only PUT (OwnedAgentByName). With the OR gone, the recreate path has no way to re-arm a flag the owner cleared.
• Reported value. Agent-side /api/git/status returns auto_sync_enabled, the value the loop is running with, from the same source GET .../git/auto-sync returns.
• Settings → Git sync panel with both toggles (auto-sync; pause schedules while sync is failing). It uses BaseToggle, InlineError per failed save, LoadFailed/skeleton, and a "not connected" state for agents with no git binding.

⚠️ Deviation from the AC: backfill scope

The AC asks for a backfill "keyed on the creation-time predicate". The DB can't reconstruct that predicate. There's no template/fork column, and agents bound later through POST /git/initialize are also source_mode = 0 but never baked the env. A source_mode = 0 backfill would therefore arm auto-push on agents that never had it. The migration (auto_sync_enabled_backfill + Alembic 0075) sets the flag only for the slice the DB can identify: live non-source-mode ghost agents, the population the old and not config.ephemeral left env-true/DB-0.

Consequences:

• A non-ghost agent whose flag is 0 but whose env was baked on stops auto-pushing. That covers two cases: an owner's earlier OFF, which now finally takes effect, and a rare swallowed DB write at creation. That write is now logged at error.
• Fork-to-own ghosts (source-mode + upstream) aren't identifiable in the DB, so they aren't backfilled. This population is expected to be tiny or empty.

Changes

• docker/base-image/agent_server/auto_sync.py: per-cycle resolve_auto_sync_enabled, should_start_loop, run_one_cycle, current_auto_sync_enabled
• docker/base-image/agent_server/routers/git.py: auto_sync_enabled in status
• src/backend/services/agent_service/lifecycle.py: DB-only derivation
• src/backend/services/agent_service/crud.py: DB write from the bake predicate
• src/backend/db/migrations.py + migrations/versions/0075_auto_sync_enabled_backfill.py: backfill, both tracks
• src/frontend/src/components/GitSyncSettingsPanel.vue, settings/SettingsPanel.vue, stores/agents.js
• Tests:
  • tests/unit/test_3010_autosync_toggle.py (26, new)
  • src/frontend/tests/unit/gitSyncSettingsPanel.spec.js (7, mounted)
  • test_ent109_git_env_seam.py rewritten to the new contract (recreate-after-OFF stays OFF)
  • test_2069_gitignore_at_creation.py: DB-flag matrix (7)
  • test_1484 fixture and test_1595 loop test updated for the per-cycle gate
• Docs: git-sync-health.md, github-sync.md, architecture/backend.md, architecture/agent-lifecycle.md

Test Plan

• Backend/agent suites around the change, run per file: all green (test_3010, ent109 ×2, 2069, 1484, agent_server_auto_sync, 1595, sync_health_service, fork_to_own, ent123, 1759, migrations, schema parity, 2742, dual ahead/behind, 69 ephemeral, alembic heads/ids)
• Mutation: with the four source files reverted, the new tests go red:
  • test_3010: 26 errors
  • ent109: recreate-after-OFF fails
  • 2069: the ghost case fails
• Frontend vitest run 3630/3630 (raw-colour, loading-gate and source-text ratchets included); check:tokens OK
• lint_sys_modules, lint_root_test_placement clean; single Alembic head
• Live on local dev: agent on a base image built from this branch, PUT the toggle, next cycle skips/runs (see comment)
• UI checked by a human in light + dark (Settings → Git sync)

Fixes #3010

🤖 Generated with Claude Code

[dolho]

Live verification against the local dev instance

Setup: I built the base image from this branch as trinity-agent-base:pr3010, leaving :latest untouched, and created a throwaway agent pr3010-sync on it. The dev backend was left unchanged: the GET/PUT .../git/auto-sync endpoints this PR relies on already exist there. In the agent I set up a real repo with a bare origin. Each cycle is the container's own auto_sync.run_one_cycle → _run_auto_sync_once. The flag reads are real HTTP to http://backend:8000 with the agent's injected MCP key.

Step	Owner action	Cycle result
boot	(container has no GIT_SYNC_AUTO)	✅ loop still starts: auto-sync loop started (interval=900s)
c1	no git config yet	✅ 404 Git not configured → skipped
c2	git config row, flag 0	✅ skipped
c3	PUT {enabled:true}	✅ ran, pushed (remote 9bbe8b3 → 05277e9), no recreate
c4	PUT {enabled:false}	✅ skipped, remote unchanged
c5	PUT {enabled:true}	✅ ran, pushed (→ 50c0c62)
c6	backend unreachable, env unset / env true	✅ flag read failed (ConnectError); using env fallback → skipped / ran
status	backend GET /git/status	✅ carries auto_sync_enabled

Found live and fixed in 1d3473dc: the first cycle waits a full interval. Until then, /api/git/status reported the env fallback (false) while the owner's flag was true. The loop now reads the flag once before its first sleep, and there is a test for it. Re-verified: with the flag on and the env unset, a restart reports true straight after boot, and it reads false after an OFF + restart.

Not covered here: the backend half of this PR (the DB-only recreate derivation, the creation write, the migration) didn't run live, because that needs the dev backend rebuilt from this branch. Unit tests and mutations cover it.

Cleanup: agent, workspace volume, git-config/sync-state rows and the :pr3010 image are removed.

🤖 Generated with Claude Code

[vybe]

merge-train: merged dev into this branch (mechanical). It picks up #3015's sqlalchemy<2.1 cap, which is the only reason pg-migrations / schema-parity were red here. Alembic single-head check on the merged tree: 1 head (0075_auto_sync_enabled_backfill), PASS.

Heads-up: #2984, #3000, #3005 and #3023 also declare down_revision = "0074_role_readiness_rollout_seed"; once this lands they must re-parent onto 0075.

Riding the current merge train together with #3016 (validation flagged that the live toggle should not land without #3016's shared-branch push refusal).

[vybe]

merge-train: batch validated on train/20260925-1608 (#3027, full suite green).