{"slug": "one-workspace-two-patch-jobs-a-gate-that-validated-a-mixed-tree", "title": "One Workspace, Two Patch Jobs: A Gate That Validated a Mixed Tree", "summary": "A developer outlined a patch-gating approach for AI-generated code that isolates each job in its own cloned working directory, asserts strict equality between declared and actually changed files, and fingerprints the tree before and after tests to catch mutations. The writeup argues that sharing a single checkout across concurrent patch jobs lets a gate validate a mixed tree that no single job produced while still reporting green, and recommends per-job clones, worktrees, or containers depending on volume and trust. The plan is presented as an illustrative drill rather than an executed test, with no measurements claimed.", "body_md": "**Conclusion first:** a patch gate is only as trustworthy as the working tree it inspects. When two jobs share one directory, the gate can validate a tree that no single job produced, and still report green.\n\nThe scenario below is an illustrative drill, not a report of a real incident. It is written for teams that gate AI-generated patches before they touch main. No measurements or test outcomes are claimed here.\n\nTwo patch jobs run against the same checkout on one host. Job A edits `src/a.py` and starts a slow test. Job B edits `src/b.py` in the same directory one second later. The gate then runs the full suite once, on one tree, and reports green.\n\nNo single patch caused that tree. Job A's tests exercised Job B's file. Both patches may be individually correct, but the gate proved nothing about either one.\n\n`/srv/patch-work`, for every job.\nIsolation starts with a job-scoped path. Clone fresh, check out the base commit, then apply.\n\n``` bash\n#!/usr/bin/env bash\n# illustrative gate runner; not executed in this article\nset -euo pipefail\n\nJOB_ID=\"${1:?job id required}\"\nPATCH_FILE=\"${2:?patch file required}\"\nWORK_ROOT=\"${WORK_ROOT:-/srv/patch-jobs}\"\nBASE_SHA=\"${BASE_SHA:?base sha required}\"\n\nWORKDIR=\"$WORK_ROOT/$JOB_ID\"\nrm -rf \"$WORKDIR\"\ngit clone --quiet --no-hardlinks \"$REPO_URL\" \"$WORKDIR\"\ncd \"$WORKDIR\"\ngit checkout --quiet \"$BASE_SHA\"\n\ngit apply --index \"$PATCH_FILE\"\ngit diff --cached --name-only --diff-filter=ACMR | sort > .changed-files\ntest -s .changed-files   # an empty diff is a gate failure, not a pass\n```\n\nThe `test -s` line matters. A no-op patch should stop the pipeline, not sail through it.\n\nAsk the patch producer for the file list up front. Write it to `.declared-files` before applying anything. Then assert equality, not overlap.\n\n```\nsort .declared-files > .declared.sorted\nsort .changed-files  > .changed.sorted\n\ndiff -u .declared.sorted .changed.sorted\n```\n\nStrict equality catches two useful failures at once: undeclared edits, and patches that silently lost a hunk. Set comparison beats counts. A patch declaring three files that touches three different files is still a violation.\n\nDiffs describe intent. Tree hashes describe state. Record both ends.\n\n```\nfingerprint() {\n  git add -A\n  git write-tree\n}\n\nBEFORE=\"$(fingerprint)\"\n# ... run the test command here ...\nAFTER=\"$(fingerprint)\"\n\nif [ \"$BEFORE\" != \"$AFTER\" ]; then\n  echo \"tests mutated the tree; result is not attributable\" >&2\n  exit 1\nfi\n```\n\nA test run that rewrites fixtures, snapshots, or config invalidates its own verdict. The comparison above forces the suite to be read-only, or the job to declare its side effects.\n\nBefore trusting any of this, run a canary patch on purpose. It should break exactly one assertion and should turn the gate red.\n\n`.changed-files`.\nThis plan is illustrative and was not executed. Run it in a sandbox repository with quick tests.\n\n```\nfor i in 1 2 3 4 5; do\n  ./gate.sh \"a-$i\" patches/a.patch &\n  sleep 1\n  ./gate.sh \"b-$i\" patches/b.patch &\n  wait\ndone\n```\n\nExpected result with job-scoped directories: zero cross-links in five rounds. Expected result with a shared directory: at least one run where `.changed-files` contains both `a` and `b` paths. Record the count either way, and keep it as a regression baseline.\n\n| Setup | Isolation | Cost | Where it fits | \n|---|---|---|---|\n| Shared dir, one worker, fresh reset per run | Time-only | Lowest disk | Low volume, strict serialization | \n| Per-job clone | Full | Repo size times jobs | Default for untrusted model patches | \n| Per-job `git worktree` | Full working tree, shared objects | Medium | Many jobs on one repo | \n| Container per job | Full, including toolchain | Highest | Concurrency plus untrusted build steps | \n\nThe shared-directory row is honest only when the queue guarantees one job at a time and resets the tree. Concurrency breaks it silently.\n\nDisclosure: This article was prepared as part of MonkeyCode's product outreach.\n\nThe project offers free model access and a free server option, as described by its operator. That combination makes parallel patch jobs tempting on one machine. It also makes path collisions more likely, because one host often means one working directory unless the runner creates more.\n\nA practical split for that setup:\n\n`git write-tree` ignores `.gitignore` d files; model-written caches can hide there.`--no-hardlinks` trades space for safety.\nSolo developers patching their own branch do not need three gates. Teams without a stable job identifier should add that first. Anyone whose test suite must write artifacts should fix the suite before adding fingerprints.\n\n`.declared-files`.\nIf a mixed-tree postmortem sounds familiar, the free model access and free server option are a cheap way to rehearse this drill. Check the current terms first, then keep the canary red until the gate earns its green.", "url": "https://wpnews.pro/news/one-workspace-two-patch-jobs-a-gate-that-validated-a-mixed-tree", "canonical_source": "https://dev.to/bytepro_1774/one-workspace-two-patch-jobs-a-gate-that-validated-a-mixed-tree-2kg4", "published_at": "2026-11-09 21:14:21+00:00", "updated_at": "2026-11-09 21:24:22.337752+00:00", "lang": "en", "topics": ["ai-agents", "developer-tools", "mlops", "ai-tools"], "entities": ["MonkeyCode", "Git"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/one-workspace-two-patch-jobs-a-gate-that-validated-a-mixed-tree", "markdown": "https://wpnews.pro/news/one-workspace-two-patch-jobs-a-gate-that-validated-a-mixed-tree.md", "text": "https://wpnews.pro/news/one-workspace-two-patch-jobs-a-gate-that-validated-a-mixed-tree.txt", "jsonld": "https://wpnews.pro/news/one-workspace-two-patch-jobs-a-gate-that-validated-a-mixed-tree.jsonld"}}