fix(kvb-org-queue): restart holders on stale queue code; link host skills into projects

Every holder judges the shared queue.json with its own loaded code, so the project copies from 2026-11-07 (no RAM/CPU budget) granted heavy jobs on the slot limit alone and overloaded the host at 18:24. Each entry now stamps a hash of queue.py and the sibling scripts it loads; a poll that finds other code installed in ~/.agents/skills leaves the queue ungranted and re-execs the same hold with the installed queue.py, on the realpath interpreter, with signals reset and a caught signal ending the hold instead. queue.py list prefixes entries on other or unstamped code. A project install now symlinks every skill the global install holds instead of copying it, so the project hooks and ../ references stay valid and one host runs one version.

🎯 Fix: 92 %
💥 Break: 4 %
💸 Cost: 100 %
⏱️ Time: 100 %
🛡️ Security: 100 %
🏆 Score: 88
🚦 Gate: ✅ 90/5, cost and time <= 100, security 100 %

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_install.py

@@ -14,29 +14,47 @@ NPX = "#!/bin/sh\nmkdir -p .agents/skills/locked\necho locked > .agents/skills/l
 
 
 class TestInstall(unittest.TestCase):
+    def install(self, root: Path, target: Path) -> None:
+        repo, stubs = root / "repo", root / "bin"
+        (repo / "scripts").mkdir(parents=True)
+        shutil.copy(INSTALL, repo / "scripts" / "install.sh")
+        (repo / "scripts" / "enable-plugins.js").write_text("", encoding="utf-8")
+        (repo / "skills" / "own").mkdir(parents=True)
+        (repo / "skills" / "own" / "SKILL.md").write_text("own", encoding="utf-8")
+        stubs.mkdir()
+        (stubs / "npx").write_text(NPX, encoding="utf-8")
+        (stubs / "npx").chmod(0o755)
+        env = {**os.environ, "PATH": f"{stubs}:/usr/bin:/bin", "TARGET": str(target), "HOME": str(root / "home")}
+        done = subprocess.run(["bash", str(repo / "scripts" / "install.sh")], env=env, capture_output=True, text=True, check=False)
+        self.assertEqual(done.returncode, 0, done.stderr)
+
     def test_reinstall_empties_the_skill_directories_in_place(self):
         with tempfile.TemporaryDirectory() as tmp:
             root = Path(tmp)
-            repo, target, stubs = root / "repo", root / "target", root / "bin"
-            (repo / "scripts").mkdir(parents=True)
-            shutil.copy(INSTALL, repo / "scripts" / "install.sh")
-            (repo / "scripts" / "enable-plugins.js").write_text("", encoding="utf-8")
-            (repo / "skills" / "own").mkdir(parents=True)
-            (repo / "skills" / "own" / "SKILL.md").write_text("own", encoding="utf-8")
-            stubs.mkdir()
-            (stubs / "npx").write_text(NPX, encoding="utf-8")
-            (stubs / "npx").chmod(0o755)
+            target = root / "target"
             installed = [target / ".agents" / "skills", target / ".claude" / "skills"]
             for folder in installed:
                 (folder / "stale").mkdir(parents=True)
             before = [folder.stat().st_ino for folder in installed]
-            env = {**os.environ, "PATH": f"{stubs}:/usr/bin:/bin", "TARGET": str(target)}
-            done = subprocess.run(["bash", str(repo / "scripts" / "install.sh")], env=env, capture_output=True, text=True, check=False)
-            self.assertEqual(done.returncode, 0, done.stderr)
+            self.install(root, target)
             self.assertEqual([folder.stat().st_ino for folder in installed], before)
             for folder in installed:
                 self.assertEqual(sorted(path.name for path in folder.iterdir()), ["locked", "own"])
 
+    def test_a_project_install_links_every_skill_the_global_install_holds(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            root = Path(tmp)
+            target = root / "target"
+            target.mkdir()
+            linked = (".agents/skills/locked", ".claude/skills/own")
+            for folder in linked:
+                (root / "home" / folder).mkdir(parents=True)
+            self.install(root, target)
+            for folder in (".agents/skills", ".claude/skills"):
+                installed = {path.name: path.readlink() if path.is_symlink() else None for path in (target / folder).iterdir()}
+                expected = {name: root / "home" / folder / name if f"{folder}/{name}" in linked else None for name in ("locked", "own")}
+                self.assertEqual(installed, expected)
+
 
 if __name__ == "__main__":
     unittest.main()

tests/test_queue.py

@@ -6,6 +6,7 @@ import fcntl
 import importlib.util
 import json
 import os
+import shutil
 import signal
 import subprocess
 import sys
@@ -532,6 +533,41 @@ class TestQueueCommands(unittest.TestCase):
         reason = self.run_queue("list").stdout.splitlines()[1].split("\t")[-1]
         self.assertRegex(reason, r"^RAM \d+ % used \+ \d+ % still to come reach the limit 0 %$")
 
+    def install_host_skills(self) -> Path:
+        skills = self.base / "home" / ".agents" / "skills"
+        for name in ("kvb-org-queue", "kvb-org-organize", "kvb-org-rasci"):
+            shutil.copytree(QUEUE.parents[2] / name, skills / name)
+        return skills / "kvb-org-queue" / "scripts" / "queue.py"
+
+    def test_a_hold_on_other_code_than_the_host_install_restarts_with_it_before_any_grant(self):
+        host = self.install_host_skills()
+        ran = self.base / "ran"
+        args = ("hold", "--kind", "test", "--task", "work/a", "--session", "s1", "--", "touch", str(ran))
+        same = self.run_queue(*args)
+        self.assertEqual((same.returncode, same.stderr), (0, ""))
+        self.assertTrue(ran.exists())
+        ran.unlink()
+        seen = self.base / "argv.json"
+        host.write_text(f"import json, sys\njson.dump(sys.argv[1:], open({str(seen)!r}, 'w'))\nsys.exit(9)\n", encoding="utf-8")
+        other = self.run_queue(*args)
+        self.assertEqual(other.returncode, 9, other.stderr)
+        self.assertIn(f"grants nothing on its own code. Restarting this hold with {host};", other.stderr)
+        self.assertEqual(json.loads(seen.read_text(encoding="utf-8")), list(args))
+        self.assertFalse(ran.exists())
+        self.assertEqual(self.entries(), [])
+
+    def test_list_marks_an_entry_on_other_code_than_the_host_install(self):
+        queue = _load(QUEUE)
+        me, mine = os.getpid(), queue.identity(os.getpid())
+        self.install_host_skills()
+        self.write_store([
+            {**stored(1, "waiting", me, mine, None, None), "code": queue.CODE},
+            stored(2, "waiting", me, mine, None, None),
+        ])
+        reasons = [line.split("\t")[-1] for line in self.run_queue("list").stdout.splitlines()[1:]]
+        self.assertEqual(reasons[0], "granted on its next poll")
+        self.assertTrue(reasons[1].startswith(f"queue code without a stamp, the host runs {queue.CODE}: "), reasons[1])
+
     def test_hold_refuses_bad_input_with_exit_2_and_enqueues_nothing(self):
         def hold(*args: str) -> list[str]:
             return ["hold", "--session", "s1", *args]