feat: AR-39a — templates pass AGENT_UPSTREAM_REPO_URL/BRANCH; agent-repo/v1 init.sh invokes select-base (upstream > reference > fork) (bug 0772408e)

Claude-Session: https://claude.ai/code/session_01G3SkMRBRWXyiGuMGs8WVas

harnesses/contexts/agent-repo/v1/init.sh

@@ -70,8 +70,29 @@ if [ -n "${AGENT_REPO_URL:-}" ] && [ -n "${AGENT_BRANCH:-}" ]; then
         # Full clone (not --depth 1) so we get a working remote for finalize.sh push.
         if git clone "$AGENT_REPO_URL" /workspace/project; then
             cd /workspace/project
+            # AR-39: resolve the seed point via entrypoint.agent_repo_base
+            # (upstream > reference > fork). Writes branch_base.json for
+            # finalize.sh to merge into ci_metadata.json (AR-25). Falls back
+            # to the legacy inline AR-14a logic if the CLI is unavailable.
+            mkdir -p /workspace/.agent-output
+            AR39_OUT=$(python3 -m entrypoint.agent_repo_base select-base \
+                --workdir /workspace/project \
+                --branch "$AGENT_BRANCH" \
+                --upstream-url "${AGENT_UPSTREAM_REPO_URL:-}" \
+                --upstream-branch "${AGENT_UPSTREAM_BRANCH:-main}" \
+                --reference-dir /workspace/reference/main \
+                --out /workspace/.agent-output/branch_base.json \
+                --fork-url "$AGENT_REPO_URL" 2>&1) && AR39_RC=0 || AR39_RC=$?
+            if [ "$AR39_RC" = "0" ]; then
+                AR39_SHA=$(printf '%s\n' "$AR39_OUT" | sed -n 's/^sha=//p' | head -1)
+                AR39_SRC=$(printf '%s\n' "$AR39_OUT" | sed -n 's/^source=//p' | head -1)
+                git checkout -b "$AGENT_BRANCH" "$AR39_SHA"
+                echo "Seeded $AGENT_BRANCH from $AR39_SRC @ $AR39_SHA (AR-39)"
+            else
+                echo "WARNING: AR-39 select-base failed (rc=$AR39_RC): $AR39_OUT — falling back to inline AR-14a seeding" >&2
+            fi
             REF_REPO=/workspace/reference/main
-            if [ -d "$REF_REPO/.git" ]; then
+            if [ "$AR39_RC" != "0" ] && [ -d "$REF_REPO/.git" ]; then
                 # Seed working tree from the upstream reference clone — AR-14a.
                 # Reference is read-only (chmod a-w), but git can still read it
                 # as a local-path remote for fetch + reset.
@@ -105,7 +126,7 @@ if [ -n "${AGENT_REPO_URL:-}" ] && [ -n "${AGENT_BRANCH:-}" ]; then
                     git checkout -b "$AGENT_BRANCH"
                     echo "WARNING: upstream-ref had no resolvable HEAD; using fork main (may be stale)" >&2
                 fi
-            else
+            elif [ "$AR39_RC" != "0" ]; then
                 # No reference clone available — fall back to fork main.
                 git checkout -b "$AGENT_BRANCH"
                 echo "WARNING: $REF_REPO/.git not found; using fork main (may be stale)" >&2

task-templates/workflow/integration@1.yaml

@@ -22,6 +22,9 @@ nodes:
       # see the same tree). Without AGENT_REPO_URL the agent-repo layer never
       # clones and the agent's output evaporates (E2E 2026-07-04).
       AGENT_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes-agents.git"
+      # AR-39a: fresh task branches seed from live upstream, not the fork mirror
+      AGENT_UPSTREAM_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes.git"
+      AGENT_UPSTREAM_BRANCH: "main"
       AGENT_BRANCH: "task/${item.uuid}"
     prompt: |
       You are the integration gate for this work item.

task-templates/workflow/merge@1.yaml

@@ -20,6 +20,9 @@ nodes:
     template: best-practices-minimax-repo
     runtime_env:
       AGENT_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes-agents.git"
+      # AR-39a: fresh task branches seed from live upstream, not the fork mirror
+      AGENT_UPSTREAM_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes.git"
+      AGENT_UPSTREAM_BRANCH: "main"
       AGENT_BRANCH: "task/${item.uuid}"
       AGENT_SKIP_BRANCH_PUSH: "true"
       AGENT_EMPTY_DELIVERABLE_CHECK: "false"

task-templates/workflow/scaffold@1.yaml

@@ -22,6 +22,9 @@ nodes:
       # see the same tree). Without AGENT_REPO_URL the agent-repo layer never
       # clones and the agent's output evaporates (E2E 2026-07-04).
       AGENT_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes-agents.git"
+      # AR-39a: fresh task branches seed from live upstream, not the fork mirror
+      AGENT_UPSTREAM_REPO_URL: "git@gitea.oreillyit.nz-ai-enablement:skynet/agent-runtimes.git"
+      AGENT_UPSTREAM_BRANCH: "main"
       AGENT_BRANCH: "task/${item.uuid}"
     prompt: |
       Write stub implementations for the following task.