Agents publishing without push access #

An agent signs in with atgc auth login <did> and gets an atproto session, not an SSH key on the repo's knot. It can write records and patches; it cannot push a branch. --patch-only is the shape for that, and it has one consequence worth knowing before the first command: the records carry no source, so every later stack command needs one member's at-uri rather than a branch name.

The workflow #

Sign in once, as the account the commits should publish under:
```
atgc auth login did:web:agent.example
```
Approve the request where your operator sees it. ATGC_ACCOUNT=<did> selects the account explicitly; atgc agent prints what this build can do.
Make the commits, each with a Change-Id: trailer. The commit-msg hook atgc repo configure installs adds one; stack create --add-change-ids can rewrite a branch that predates it. Under a harness the hook knows, it also adds Assisted-by: <agent>[:<model>], with the model taken from ATGC_AGENT_MODEL when set; git config atgc.assistedByTrailer false turns that off.
Open the chain. One member per commit is the right default for an agent because it needs no marks and no branch relationships:
```
atgc stack create --per-commit --patch-only --json
```
The JSON's members[].uri is the durable address of every pull. Keep it: the appview may not have assigned numbers yet, and the branch is not recorded anywhere. The top member's Tangled URL is where the stack is drawn.

Read it back through any member:

atgc stack view at://did:web:agent.example/sh.tangled.repo.pull/3m…

After review, reconcile the records with the branch as it now stands:
```
atgc stack resubmit <any member>
```
The checked-out branch supplies the commits; nothing is pushed. Members are matched by change-id, so amending a commit appends a round to its pull rather than opening a new one.
Land it. The repo owner or a collaborator with push access performs the knot's merge; the records only have to agree with the branch:
```
atgc stack merge <any member> --dry-run
atgc stack merge <any member>
```
Abandon it, or clean up after yourself:
```
atgc stack close <any member>
```
This closes every open member in one run. A mid-stack pull cannot be closed on its own: the records above it still name it in dependentOn. Merged members are left alone, and a member whose state cannot be settled refuses the whole close rather than risking a merge.

What not to expect #

Branch discovery. atgc stack view with no arguments, stack merge, stack resubmit and stack create's adoption look for source.branch. A patch-only stack has none. Naming a member is not a convenience here; it is the address. To stack commits on a lone patch-only pull, atgc stack create --patch-only --pr <it> adopts it as the bottom member.
Numbers. The appview assigns them on its own schedule, and a number from before a resubmit can 404 because the record it named is gone. The at-uri and record key are in the record and always resolve; prefer them in scripts. A pull the appview has not indexed, or whose stack link it still holds stale, is re-emitted with atgc pr touch <record key> — the record's author can do this, and it needs no body edit or new round.
One author per chain. stack resubmit <member> rewrites every member, so it refuses a chain whose records live in more than one account. A stack is one account's log.
Push access. stack create --patch-only never pushes, and stack resubmit does not either. That is the point; a merge still needs the merge permission the knot checks.

Diagnostics #

atgc stack view <member> --json lists the whole chain, top first, with each member's state, rounds and commit count.
atgc pr view <record key> --json reads one member directly from its author's PDS when the index is behind.
atgc pr diff <record key> prints the round's patch; atgc pr resubmit appends a round to a flat pull, but refuses a member of a live stack — use stack resubmit <member> for that.
atgc pr touch <record key> re-puts one of your pull records unchanged when tangled.org's index missed its last event. It is the recovery for a pull whose number is missing or whose stack link still names a record a resubmit removed; nothing else about the pull changes.
atgc doctor local checks the session, the scope grant and the checkout's identity before a write is attempted. On an HTTP(S) clone of a repo the account does not own, a missing SSH key is a warning: --patch-only needs no key.