Not re-queued did not mean still ours. The sweep can hand a dropped job back and a second runner claim it before the first runner's report lands, and the fallback write settled whatever job it found: a job actively running another task went to Failure, the emitter skipped everything downstream of it, and those jobs stayed skipped when the real build succeeded. On a release pipeline that is a publish that quietly never happens. The write now carries the same task_id guard the other two do. The two sweeps also stopped sharing a conclusion. Zombie selects on a runner that has gone quiet, which is what a lost task looks like; endless selects on start time alone, and its runner is alive and has been reporting for hours. That job is wedged, not lost, so re-queueing it only spends hours more of a shared runner reaching the same wedge. Each sweep now says which one it is holding. The cap warning is driven by reaching the cap rather than by an in-memory count that a lost update leaves raised, so it no longer reports failing a job it did not fail. Covers the re-claim race, the wedged job, the log, and the drop count starting over on a rerun — the last so the whitelist clone that gives a new attempt a fresh budget cannot quietly become a copy of everything. Assisted-by: blue:claude-opus-5
Hanzo Git
Hanzo's self-hosted Git forge — Git hosting, code review, issues, packages, and CI/CD (GitHub-Actions-compatible), IAM-native via hanzo.id OIDC. Runs at git.hanzo.ai.
A white-label fork of Gitea (MIT). Upstream copyright and licensing are preserved in LICENSE; identity is wired to Hanzo IAM rather than local accounts, and the product is branded Hanzo Git.
Build & deploy
One way, like every Hanzo repo: the root hanzo.yml declares the
image and tests; a ~7-line .hanzo/workflows/cicd.yml
imports hanzoai/ci, which builds and pushes
ghcr.io/hanzoai/git on our own runners against git.hanzo.ai. Never build the image locally.
The running service is defined in hanzoai/universe (the git operator App CR):
a single-writer SQLite deployment, config injected via the GIT__<section>__<KEY>
env contract, OIDC login reconciled to hanzo.id.
Development
See docs/development.md for a local environment.
After building, run ./gitd web to start the server, or ./gitd help for
all commands.