Stop publishing repository-wide prompt ledgers and enforce per-user prompt isolation through authenticated Gitea IDs.

Hop-State: A_06FN8NFDRFAFN5VCJTHJAAG
Hop-Proposal: R_06FN8NEGJ054CPMJF9ZAN70
Hop-Task: T_06FN8HT6XG332C3XY6PYCCG
Hop-Attempt: AT_06FN8HT6XGRXW0B4WPFFBJG
This commit is contained in:
2026-07-11 20:19:05 -07:00
committed by Hop
parent 56755a77fd
commit 12c806c77f
104 changed files with 255 additions and 1626 deletions
+6 -8
View File
@@ -13,15 +13,13 @@ but makes Hop's workflow the primary product model:
- a **proposal** is a reviewable candidate outcome; and
- an **accepted state** is the current shared truth.
The repository **Prompts** view is the review surface for that causal record:
the requested work, agent identity and runtime metadata, response summary, and
links to the task, attempt, and immutable state that produced it.
The repository **Prompts** view is a private, per-user review surface for that
causal record. The control plane identifies the signed-in Gitea user and only
returns prompt rows attributed to that user's immutable Gitea ID.
Hop automatically writes immutable, portable prompt records to
`.hop/records/prompts/` when it creates a proposal. Git tracks those records
with the code, while Hop's local database and disposable workspaces remain
ignored. Run `make hop-records` to export the complete local record history on
demand.
Hop's local state and exported prompt records can contain private requests and
machine paths, so `.hop/` is ignored and must never be published through Git.
`make hop-records` may be used for a local export, but its output remains local.
The product thesis is simple: