fix(drive): sync materializes the repo instead of assuming a clone

[khaliqgant]

What was broken

Every cloud tick died at the first step:

Step "sync" failed: fatal: 'origin' does not appear to be a git repository

(runs 9fc8d996, ff35187a, 06505b94, 4cf36ea7, b33c2c9a)

This was not a misconfiguration. A cloud workflow sandbox never has a clone. The CLI tars the git ls-files set — no .git — and the bootstrap runs git init over it. Files yes, history and remotes no. Nothing in the workflow-launch path runs git clone; the platform's clone helper buildGitWorkspaceSyncShell has two callers, neither of them workflows.

What changed

workflows/drive.yaml, two steps.

sync asserts materialization instead of assuming a clone, then branches on what the environment actually is:

• missing repo → SYNC_FAIL_NOT_MATERIALIZED (exit 78), naming the missing paths
• origin exists (laptop, fleet node) → SYNC_MODE=remote, unchanged behavior
• no origin (cloud sandbox) → SYNC_MODE=snapshot: the uploaded snapshot is the base, committed so git diff main in the review step has a main

pr names each delivery precondition before using it — PR_BLOCKED_NO_REMOTE / PR_BLOCKED_NO_GH_AUTH in one typed line, instead of dying opaquely after five expensive agent steps.

Evidence

Cloud run 404a8386-a129-40b0-9e5b-8ec9ad433038, launch job 9202f8cc-d206-4620-871d-e4e7895662c4, sandbox b02dd914-d10e-432d-af0d-5a809190019d:

[bootstrap] Mounted setup-token env for anthropic
[bootstrap] Mounted credentials for openai at /home/daytona/.codex/auth.json
[bootstrap] Baseline committed with 212 tracked files (clean tree).
[workflow 00:01] [sync] Output:
SYNC_WORKDIR=/project/workflows/runs/861f3cce-f349-4be8-b6be-e7aaea3cf907
SYNC_MATERIALIZED=ok
SYNC_MODE=snapshot
SYNC_BASE=3fdb63c
SYNC_BRANCH=flow/drive-3fdb63c-08280517
SYNCED
[workflow 00:01] [assess] Spawning owner "lead" (cli: claude)
[workflow 02:09] [assess] Output: ASSESS_DONE ...
[workflow 02:09] [build] Spawning owner "builder" (cli: codex)

First cloud tick to get past step 1.

What this does NOT fix — read before merging

1. The cron runs a frozen spec. agent-relay cloud schedule stores a copy of the YAML in the schedule row; the scheduled run never reads the repo. Both active flows-drive schedules carry a spec from nine commits ago (workflow_bytes 4871 and 4869 = commits 053b93b3 / 3ebcff74; origin/main is 7262). Merging this changes nothing about the scheduled tick until the schedule is re-registered. There are also two duplicate flows-drive schedules on the same cron, which is why 02:00Z produced two runs.

2. A cloud sandbox cannot open a PR. claude and codex authenticate fine (proven above), but there is no GitHub token: gh is installed and unauthenticated, cloud run has no --env flag, and WORKFLOW_GITHUB_WRITE_GRANTS is a hardcoded array of three AgentWorkforce/cloud entries, all with envTokenNames: []. Giving flows App-based write is a cloud-side change + deploy.

Full trace, the fleet-node (sf-mini / finn-mini) comparison, and the exact remaining manual steps are in ops/reviews/20260828-0127-cloud-execution.md.

A human merges.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

Next included review available in 50 minutes.

View limit details

Limit details: You’ve used the included review currently available.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Free

Run ID: 735e3c81-9a58-43c2-8f27-c63fdbf82798

📥 Commits

Reviewing files that changed from the base of the PR and between 8c7285b and 56f62c4.

📒 Files selected for processing (2)

• ops/reviews/20260828-0127-cloud-execution.md
• workflows/drive.yaml

---

Note

🎁 Summarized by CodeRabbit Free

Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Pro by visiting https://app.coderabbit.ai/settings/billing.

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 56f62c409b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Capture the credential-verification command and output

The assertion that the credential state was “Verified against provider_credentials” is a verification claim, but the report provides neither the literal query/command nor its captured rows; the subsequent bullets only summarize selected values and log lines. This makes the credential conclusion non-reproducible, so include the exact command/query and complete relevant output or narrow the claim to the evidence actually shown.

AGENTS.md reference: AGENTS.md:L51-L53

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Propagate real commit failures

When git commit fails for any reason other than an empty index—for example, a pre-commit hook or commit-signing failure in the supported laptop/fleet path—this fallback labels it as “nothing new to commit” and continues to push/open a PR from the previous HEAD. If the builder already made commits, that can create a PR while silently omitting the currently staged changes; check that the index is actually clean before skipping the commit and propagate every other failure.

AGENTS.md reference: AGENTS.md:L16-L18

Useful? React with 👍 / 👎.