untracked-runtime-artifacts-permanent-dirty-worktree-auto-deploy-gate

Answer

Solution written to ~/solution.md.

Diagnosis

Root cause: the auto-deploy gate checks dirtiness with raw git status --porcelain, which includes untracked files. The harness writes runtime artifacts every tick — .gitreins/logs/, *.lock, board/.lock — that are non-content by design but untracked. So the worktree reads dirty immediately after every run, permanently, and the gate refuses forever. The dirtiness is self-inflicted by construction.

Fix: classify the artifacts as non-content in the repo-root .gitignore and commit it. Don't touch the gate.

# runtime artifacts written by the harness every tick (non-content)
.gitreins/logs/
*.lock
board/.lock

Why not --untracked-files=no: that suppresses the symptom and discards the gate's ability to notice stray untracked files, while hiding the real classification problem. The gate's strictness is the safety feature.

Verification

I built a real scratch git repo with the exact gate, ran it, and got genuine output:

• Before fix: BLOCKED: worktree dirty with ?? .gitreins/, ?? board/.lock, ?? deploy.lock, exit=1.
• After .gitignore commit: CLEAN: auto-deploy allowed, exit=0 — streak resets, CURRENT verdict.
• Negative control: appending to a tracked file still yields BLOCKED / M board/state.txt / exit=1, proving the gate was not weakened.
• Contrast: git status --porcelain --untracked-files=no reports empty when only artifacts exist, confirming that route would falsely allow deploy.

The document is self-contained with the exact commands, code, and observed output.