repo-fleet-hygiene: the plugin reports per-repository facts a sibling already owns, and cannot perform the fleet-wide cleanup it exists for

[kyle-sexton]

Problem

/repo-fleet-hygiene:audit is correct and does not do the job it exists for.

A full run against a real 19-repository fleet produced 869 findings across 6204 lines. Independent verification found the findings accurate — 20/20 sampled re-derived, 377/377 HIGH verified by whole-population OID join, zero false negatives across 138 unflagged branches. The collector is sound and its HIGH tier can drive deletions.

The mismatch is scope. The operator's intent is a machine-wide cleanup: find every repository, remove every worktree and branch that is provably merged, and converge the machine on one worktree convention. What the plugin delivers is a per-item read-only report that then requires 38 separate gated invocations of two other skills to act on — and several of the per-repository facts it computes are already computed, more safely, by source-control:worktree.

Evidence

Fleet: 19 canonical repositories reached via 127 supplied paths, 292 linked worktrees.

Finding kind	n	Confidence
reclaimable-worktree	263	MEDIUM
merged-local-branch	214	HIGH
merged-worktree	163	HIGH
local-ancestry-only	105	LOW
merged-pr-tip-drift	98	MEDIUM
merge-evidence-privacy-gated	10	UNKNOWN
worktree-nested-in-repository	9	MEDIUM
others	7	mixed

Verification (deterministic stride sampling plus whole-population offline joins):

Category	Confidence	Sampled	Confirmed	Refuted
merged-local-branch	HIGH	12	12	0
merged-worktree	HIGH	8	8	0
reclaimable-worktree	MEDIUM	8	8	0
merged-pr-tip-drift	MEDIUM	5	5	0
github-remote-moved	HIGH	1	1	0

214/214 merged-local-branch OIDs still equal their branch tips. 163/163 merged-worktree OIDs equal both branch tip and worktree HEAD. Zero overlap between the two sets. Zero of the 214 collide with a worktree-attached, current, or default branch.

source-control:worktree meanwhile already provides status (inventory with a stranded-work axis computed from landed-work.sh — unpushed unlanded commits, with unknown treated exactly as stranded), cleanup [--dry-run] (prune, remove, verify, with Windows file-lock release and git branch -D emitted rather than run), and audit. Against that, this plugin's reclaimable-worktree rests on git status --porcelain emptiness alone.

The capability no skill in the fleet provides — fanning a cleanup across 19 repositories behind one gate — is the one that was actually wanted.

Proposed change

Narrow the plugin to the axis only it can serve, and delegate the rest.

Concern	Owner
Worktree convention, worktree_root, creation placement	source-control:worktree (already)
Per-repository worktree inventory, stranded-work classification, removal	source-control:worktree status / cleanup (already)
Per-repository branch, cache, and build hygiene	repo-hygiene:clean (already)
Fleet discovery — every repository on a machine, resolved to canonical checkouts	repo-fleet-hygiene
Cross-repository GitHub merge evidence at fleet scale	repo-fleet-hygiene
Conformance reporting against the configured worktree root	repo-fleet-hygiene (reads the key; never defines it)
Fleet batching — one confirmation gate, many repositories	repo-fleet-hygiene (missing today)
Merged remote branches	unowned — new capability

Execution model, decided with the operator:

• read-only by default — report and stop, preserving today's boundary as the default
• execute — act on a previously produced manifest, as a separate explicit act
• report-and-execute in one unit of work — the report is still produced and shown; the operator has pre-authorized the follow-through in the same invocation

The manifest is the interchange format, and it is the only dry-run available for git worktree remove and git branch -d, neither of which has a native one. An execute pass must re-derive OIDs at execution time; nothing in a report is self-refreshing.

Acceptance criteria

• The plugin no longer computes a per-repository worktree-disposability verdict of its own; it delegates to source-control:worktree status or consumes its classification.
• A fleet run can hand off cleanup for N repositories behind one confirmation, not 2N.
• Read-only remains the default mode; execution requires an explicit act or an explicit single-transaction flag.
• The report states a per-repository verdict, not only per-item findings.

Child issues

Filed separately per this repository's one-defect-per-issue convention. This issue is the shared context they reference.

repo-fleet-hygiene

• repo-fleet-hygiene: one non-repository path under --root aborts the entire audit #2598 — one non-repository path under --root aborts the entire audit
• repo-fleet-hygiene: a bare path and a drive root are outside the flag grammar, and no-argument scope is the project directory rather than the machine #2599 — a bare path and a drive root are outside the flag grammar; no-argument scope is the project directory rather than the machine
• repo-fleet-hygiene: branch and worktree analysis is silently skipped on a moved-identity checkout, dropping a genuine HIGH finding #2600 — branch and worktree analysis silently skipped on a moved-identity checkout, dropping a genuine HIGH finding
• repo-fleet-hygiene: reclaimable-worktree rests on git status alone, so ignored files are destroyed without warning #2601 — reclaimable-worktree rests on git status alone, so ignored files are destroyed without warning
• repo-fleet-hygiene: a bare repository with a live working tree is rejected before classification and appears nowhere in the report #2602 — a bare repository with a live working tree is rejected before classification and appears nowhere in the report
• repo-fleet-hygiene: merged-pr-tip-drift evidence asserts the commits may never have been pushed when all of them are on GitHub #2603 — merged-pr-tip-drift evidence asserts the commits may never have been pushed when all of them are on GitHub
• repo-fleet-hygiene: per-repository REST merged-PR queries truncate and force a privacy gate; one aliased GraphQL query retires both finding kinds #2604 — per-repository REST merged-PR queries truncate and force a privacy gate; one aliased GraphQL query retires both finding kinds
• repo-fleet-hygiene: reclaimable-worktree duplicates source-control:worktree's stranded-work axis with a weaker signal #2605 — reclaimable-worktree duplicates source-control:worktree's stranded-work axis with a weaker signal
• repo-fleet-hygiene: no conformance report against the configured worktree root, so ~245 misplaced worktrees are invisible #2606 — no conformance report against the configured worktree root, so ~245 misplaced worktrees are invisible
• repo-fleet-hygiene: no merged-remote-branch capability, and no plugin in the fleet owns one #2607 — no merged-remote-branch capability, and no plugin in the fleet owns one
• repo-fleet-hygiene: 869 findings across 6204 lines with no rollup, and one target emitting multiple independent findings #2608 — 869 findings across 6204 lines with no rollup, and one target emitting multiple independent findings
• repo-fleet-hygiene: handoffs do not scale — acting on one fleet report means 38 separately gated invocations #2609 — handoffs do not scale: acting on one fleet report means 38 separately gated invocations

source-control — the convention layer this plugin reads but must not define

• source-control: the worktree convention lives where only this plugin can read it, so nothing else on the machine can honor it #2610 — the worktree convention lives where only that plugin can read it
• source-control: nothing prevents a raw git worktree add or EnterWorktree(name:) from landing inside a repository #2611 — nothing prevents a raw git worktree add or EnterWorktree(name:) from landing inside a repository
• source-control: worktree_root cannot vary per Git identity, so a multi-account machine has one root for two identities #2612 — worktree_root cannot vary per Git identity