Home / Projects / Orchestrata Ultimate / Decisions / ADR index / ADR-0122
ADR-0122: One coordinator per worktree at a time; the shared handoff board is the coordination channel
| field | value |
|---|---|
| Status | Accepted — Accepted (ruling, Mohamed, 2026-10-20) |
| Date | 2026-10-20 |
| Register | factory (docs/adr, 4-digit ids) |
| Source | docs/adr/0122-one-coordinator-per-worktree-handoff-board-is-the-channel.md — permalink at 7b9f8f648 (unchanged on master since that commit) |
| Wiki register entry | ADR-0122 (wiki status: Accepted) |
The record
Status: Accepted (ruling, Mohamed, 2026-10-20) · Date: 2026-10-20
Context
On 2026-10-20 two resumed coordinator sessions operated the same worktree (wt-COMPONENTS) with no
coordination channel. Measured cost: one session reverted the other's sanctioned pyproject.toml /
uv.lock edits (record corrected only afterwards, RUL-024-style); push gates ran against a tree in
flux (dependency-tier edits mid-run plus a concurrent streaming verification), which wasted three
push attempts before the real cause (batch-child guard kills) was found; and a T17 worker was
mis-attributed for damage the concurrent session's worker actually did. The de-facto channel that
ended the incident was: the shared handoff board plus "check the other session's mtimes before
touching any fence", with the rule "one coordinator commits". Mohamed was asked to ratify that as
the standing rule.
Decision (Mohamed, 2026-10-20, verbatim)
"a" — option (a): formalize the proven convention.
Implemented as: one coordinator per worktree at a time. A second session on the same worktree is
READ-ONLY until the shared handoff board (the knowledge-wiki sessions page + each repo's
plans/handoff-*.md) marks the worktree free. Before touching any fence (any file another
workstream owns or any push/gate invocation), a coordinator checks the handoff board AND the other
session's file mtimes; only one coordinator commits. The rule rides every handoff as a standard
clause.
Alternatives rejected
- A hard per-worktree lock file (option b) — more mechanism than the incident needs; the board + mtime check already ended the incident, and a lock adds claim/release failure modes.
- No mechanism, handoff files only (option c) — exactly the state that allowed the incident.
- Defer (option d) — rejected: the rule is needed before the next concurrent-session event, not after.
Consequences
- Every handoff written for a multi-coordinator worktree carries the clause: second session read-only until the board frees the worktree; board + mtime check before any fence touch; one coordinator commits.
- Enforcement is judgment plus the board convention (like RUL-040's
none (judgment)class) — the board is the shared artifact every session already writes and reads. - A session that ignores the channel and reverts sanctioned work is a record-correction incident (RUL-024), as it already was on 2026-10-20.
Provenance
Mohamed, in-session, 2026-10-20, session 272: "a" (verbatim), choosing option (a) of the
coordinator's §5.6 prompt. Evidence: session 272 work log (the two-coordinator incident, the
record correction, the "one coordinator commits; check session_v2 + file mtimes" rule that ended
it); plans/handoff-2026-10-20-proper-install.md §1 and §8.
Related ADRs
No other ADR is named in this record.
Rulings cited
- RUL-024: RUL-024 — "pre-existing" is a diagnosis, not a disposition
- RUL-040: RUL-040 — verification scope is measured at symbol granularity; a full-suite escalation is a bug
Specs cited
None (or no spec page exists for the ones named).