feat(agent-repo): opt-in AR-42 archive-and-reset of a stale task branch (f910e2ba)

init.sh now archives and resets an existing task/<uuid> branch to the current
base when AGENT_BRANCH_RESET_ON_START=true. Default off: all nodes of a
workflow share the branch, so only the workflow's first node may set it.

Claude-Session: https://claude.ai/code/session_01N218bERyNeLhbLmDRDvbWF

harnesses/contexts/agent-repo/v1/init.sh

@@ -65,6 +65,41 @@ if [ -n "${AGENT_REPO_URL:-}" ] && [ -n "${AGENT_BRANCH:-}" ]; then
     echo "Cloning agent working repo: $AGENT_REPO_URL (branch: $AGENT_BRANCH)"
     if git clone --depth 1 --branch "$AGENT_BRANCH" "$AGENT_REPO_URL" /workspace/project 2>/dev/null; then
         echo "Cloned existing branch $AGENT_BRANCH (continuing prior work)"
+        # AR-42: archive the stale task branch and reset it to the current base.
+        # Opt-in per node (AGENT_BRANCH_RESET_ON_START=true, set by the workflow
+        # template on its FIRST node only): every node of a workflow shares this
+        # one branch, so an unconditional reset would wipe earlier nodes' commits.
+        if [ "${AGENT_BRANCH_RESET_ON_START:-}" = "true" ]; then
+            mkdir -p /workspace/.agent-output
+            AR42_TOOL=/opt/agent/agent_repo_base.py
+            AR42_FAIL() {
+                echo "ERROR: AR-42 $1" >&2
+                printf '{"error": "ar42_archive_and_reset_failed", "detail": %s}\n' \
+                    "$(printf '%s' "$1" | python3 -c 'import json,sys; print(json.dumps(sys.stdin.read()[:500]))')" \
+                    > /workspace/.agent-output/init-error.json
+                exit 1
+            }
+            AR42_SEL=$(python3 "$AR42_TOOL" select-base \
+                --workdir /workspace/project \
+                --branch "$AGENT_BRANCH" \
+                --upstream-url "${AGENT_UPSTREAM_REPO_URL:-}" \
+                --upstream-branch "${AGENT_UPSTREAM_BRANCH:-main}" \
+                --reference-dir /workspace/reference/main \
+                --out /workspace/.agent-output/branch_base.json 2>&1) \
+                || AR42_FAIL "select-base failed: $AR42_SEL"
+            AR42_SHA=$(printf '%s\n' "$AR42_SEL" | sed -n 's/^sha=//p' | head -1)
+            [ -n "$AR42_SHA" ] || AR42_FAIL "select-base returned no sha: $AR42_SEL"
+            AR42_OUT=$(python3 "$AR42_TOOL" archive-and-reset \
+                --workdir /workspace/project \
+                --branch "$AGENT_BRANCH" \
+                --base-sha "$AR42_SHA" \
+                --fork-url "$AGENT_REPO_URL" \
+                --archive-prefix archive \
+                --base-metadata /workspace/.agent-output/branch_base.json \
+                --out /workspace/.agent-output/branch_base.json 2>&1) \
+                || AR42_FAIL "archive-and-reset failed: $AR42_OUT"
+            echo "AR-42: $AGENT_BRANCH reset to base $AR42_SHA"
+        fi
     else
         echo "Branch $AGENT_BRANCH does not exist — seeding fresh branch from upstream reference"
         # Full clone (not --depth 1) so we get a working remote for finalize.sh push.

harnesses/contexts/gitea-ssh-hatchmate/v1/harness.yaml

@@ -23,6 +23,6 @@ scripts:
 
 secrets_required:
   - name: gitea-ssh-hatchmate
-    account_ref: "hatchmate.space:platform"
+    account_ref: "hatchmate.space:hatchmate"
     mount_path: /run/agent/secrets/gitea-ssh-hatchmate
     mode: "0400"