# Agents publishing without push access An agent signs in with `atgc auth login ` and gets an atproto session, not an SSH key on the repo's knot. It can write records and patches; it cannot push a branch. `--patch-only` is the shape for that, and it has one consequence worth knowing before the first command: the records carry no `source`, so every later stack command needs one member's at-uri rather than a branch name. ## The workflow 1. Sign in once, as the account the commits should publish under: ```text atgc auth login did:web:agent.example ``` Approve the request where your operator sees it. `ATGC_ACCOUNT=` selects the account explicitly; `atgc agent` prints what this build can do. 2. Make the commits, each with a `Change-Id:` trailer. The `commit-msg` hook `atgc repo configure` installs adds one; `stack create --add-change-ids` can rewrite a branch that predates it. Under a harness the hook knows, it also adds `Assisted-by: [:]`, with the model taken from `ATGC_AGENT_MODEL` when set; `git config atgc.assistedByTrailer false` turns that off. 3. Open the chain. One member per commit is the right default for an agent because it needs no marks and no branch relationships: ```text atgc stack create --per-commit --patch-only --json ``` The JSON's `members[].uri` is the durable address of every pull. Keep it: the appview may not have assigned numbers yet, and the branch is not recorded anywhere. The top member's Tangled URL is where the stack is drawn. 4. Read it back through any member: ```text atgc stack view at://did:web:agent.example/sh.tangled.repo.pull/3m… ``` 5. After review, reconcile the records with the branch as it now stands: ```text atgc stack resubmit ``` The checked-out branch supplies the commits; nothing is pushed. Members are matched by change-id, so amending a commit appends a round to its pull rather than opening a new one. 6. Land it. The repo owner or a collaborator with push access performs the knot's merge; the records only have to agree with the branch: ```text atgc stack merge --dry-run atgc stack merge ``` 7. Abandon it, or clean up after yourself: ```text atgc stack close ``` This closes every open member in one run. A mid-stack pull cannot be closed on its own: the records above it still name it in `dependentOn`. Merged members are left alone, and a member whose state cannot be settled refuses the whole close rather than risking a merge. ## What not to expect - **Branch discovery.** `atgc stack view` with no arguments, `stack merge`, `stack resubmit` and `stack create`'s adoption look for `source.branch`. A patch-only stack has none. Naming a member is not a convenience here; it is the address. To stack commits on a lone patch-only pull, `atgc stack create --patch-only --pr ` adopts it as the bottom member. - **Numbers.** The appview assigns them on its own schedule, and a number from before a resubmit can 404 because the record it named is gone. The at-uri and record key are in the record and always resolve; prefer them in scripts. A pull the appview has not indexed, or whose stack link it still holds stale, is re-emitted with `atgc pr touch ` — the record's author can do this, and it needs no body edit or new round. - **One author per chain.** `stack resubmit ` rewrites every member, so it refuses a chain whose records live in more than one account. A stack is one account's log. - **Push access.** `stack create --patch-only` never pushes, and `stack resubmit` does not either. That is the point; a merge still needs the merge permission the knot checks. ## Diagnostics - `atgc stack view --json` lists the whole chain, top first, with each member's state, rounds and commit count. - `atgc pr view --json` reads one member directly from its author's PDS when the index is behind. - `atgc pr diff ` prints the round's patch; `atgc pr resubmit` appends a round to a flat pull, but refuses a member of a live stack — use `stack resubmit ` for that. - `atgc pr touch ` re-puts one of your pull records unchanged when tangled.org's index missed its last event. It is the recovery for a pull whose number is missing or whose stack link still names a record a resubmit removed; nothing else about the pull changes. - `atgc doctor local` checks the session, the scope grant and the checkout's identity before a write is attempted. On an HTTP(S) clone of a repo the account does not own, a missing SSH key is a warning: `--patch-only` needs no key.