fix(git scope-check): claim ownership match must be instance-scoped, not agent-type-scoped

[getappz]

run_scope_check (src/cli/git.rs) was comparing live claims by claims::agent_of(owner) — agent TYPE only (e.g. "claude-code"), stripping the :instance suffix — to decide which claim is "mine" for the OutOfTree check. But claims::owner_id() is deliberately instance-scoped, and claim(action="release"|"done") require an exact owner_id() match. This mismatch meant a live claim from a DIFFERENT session of the same agent type (a concurrent sibling session, or one orphaned by a crashed prior session) got misclassified as the invoker's own claim, producing a spurious OutOfTree denial ("you hold claim X -- do this work in its isolated worktree, not the canonical checkout") for a claim the invoker doesn't actually own and has no way to release — a real deadlock captured live via a vent report (orphaned claim item#JgotedejAG-2Mopg6zisS owned by a different instance blocking git commit with no escape hatch).

Fix: extracted the split into partition_claims_by_owner(live, owner), matching on the full owner_id() string instead of agent_of(). Added 3 regression tests: (1) a different instance of the same agent type must not be treated as mine, (2) the exact same instance still matches, (3) a sibling instance's scoped claim correctly lands in others for scope enforcement (second-order bug: same-agent-type-different-instance claims were previously excluded from others entirely too, so scope enforcement between two concurrent sessions of the same agent type never fired).

Verified: cargo build --bin agentflare clean, all 3 new tests pass plus the full claims:: test suite (16 tests, no regressions).

Summary by CodeRabbit

• Bug Fixes
  • Improved scope enforcement by distinguishing claims owned by the exact instance from claims owned by other instances of the same agent.
  • Ensured claims from sibling instances are treated as external scopes.
  • Added coverage for exact ownership, different-instance ownership, and sibling-instance enforcement.

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 33 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 7af70451-390f-40fb-a768-0add0bcf44f1

📥 Commits

Reviewing files that changed from the base of the PR and between 015c8f3 and 63d83e6.

📒 Files selected for processing (1)

• src/cli/git.rs

📝 Walkthrough

Walkthrough

The CLI now classifies claims by full owner_id() matches. Claims from other instances of the same agent are treated as external scopes. Tests cover exact ownership and sibling-instance enforcement.

Changes

Owner scope partitioning

Layer / File(s)	Summary
Claim partitioning and scope validation src/cli/git.rs	Adds exact owner-based claim partitioning, updates live scope checks, and tests exact ownership plus same-agent different-instance enforcement.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely identifies the instance-scoped ownership fix in git scope checks.
Description check	✅ Passed	The description clearly explains the bug, fix, regression tests, and verification, but it omits the template headings and some checklist items.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch task/444

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

src/cli/git.rs (1)

1235-1250: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win

Assert the scope-enforcement result.

This test only verifies that the sibling claim enters others. It does not verify that a changed path inside crates/foo/ produces scope::ScopeVerdict::Overlapping.

Call scope::classify_scopes with others and assert the overlapping verdict. This validates the regression described by the test name and PR objective.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/cli/git.rs` around lines 1235 - 1250, Extend
partition_claims_by_owner_enforces_scope_between_sibling_instances() by calling
scope::classify_scopes with the returned others claims and a changed path under
crates/foo/. Assert that the result is scope::ScopeVerdict::Overlapping while
preserving the existing assertions that the sibling claim is placed in others.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@src/cli/git.rs`:
- Around line 1235-1250: Extend
partition_claims_by_owner_enforces_scope_between_sibling_instances() by calling
scope::classify_scopes with the returned others claims and a changed path under
crates/foo/. Assert that the result is scope::ScopeVerdict::Overlapping while
preserving the existing assertions that the sibling claim is placed in others.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: bf74ed68-3145-4c39-9901-1383f8a8486a

📥 Commits

Reviewing files that changed from the base of the PR and between 220ee36 and 015c8f3.

📒 Files selected for processing (1)

• src/cli/git.rs