Practice GCUs: pristine main + session harness (stop contaminating xuss examples) #101

Problem

The three practice GCUs (tig/xuss, tig/xuss-c, tig/xuss-lame) are asked to do two jobs at once, and the current workflow only serves one of them well.

What I do today

1. Try to remember to reset xuss-c (etc.) to clean start.
2. cd an existing checkout (I generally do not re-clone).
3. Start the agent and run getting-started / first ship.

What actually happens

• A previous run leaves main mid-flight (scaffold, firmware, product face, build trees).
• The next session is contaminated: agents and operators are not looking at a cold-start template.
• Public “example product” remotes stop looking like examples and start looking like abandoned WIP.
• First-ship honesty rules (clean start before mutate, no past-HEAD salvage) fight the leftover tree every time.

Live symptom class: main on a practice GCU is often not at the product-only clean start (message / tags/clean-start), even though that is what the next eval and the next reader both need.

Why “just fix CI triggers” is not enough

Each session still needs to prove CI. Today that pressure often means pushes to main (practice GCUs are steered “always land on main”).

Broadening CI to PRs / all branches / workflow_dispatch would reduce one reason to pollute main, but:

• It does not restore a pristine template face for users.
• It does not remove the “remember to reset” operator load.
• It does not close the loop (archive attempt → return to clean start).

So CI-on-main friction is a symptom amplifier, not the root design bug.

Root design bug

AGENTS.md currently hard-codes practice GCUs as always commit to main (to avoid PR theater on harness trees). That rule optimizes the harness runway and systematically destroys the public template face after every successful (or abandoned) run.

We already have pieces of the right model (tags/clean-start, occasional attempt-* tags, silico session start provenance + a print-only hard-reset recipe)—but nothing prepares, isolates, and tears down a session so main stays pristine by default.

Related: hero-video capture (docs/hero-video, PR #86) also requires a clean-start practice GCU before honest recording—the same memory hole.

Goals

1. Pristine by default — main on each xuss-family remote is a trustworthy cold-start template for humans and for the next agent.
2. Repeatable harness — automate prepare → run → prove CI → archive → restore without re-clone theater.
3. No contamination between sessions — local build artifacts and git history of attempts do not silently become the next start state.
4. Honest Stage E — CI can go green without leaving finished firmware on public main.
5. Operator gates stay — destructive reset / force-update of main never becomes silent agent habit.

Non-goals: invent a multi-PR product workflow for real customer GCUs; soft-fork Bedside; re-clone from GitHub on every run as the only fix.

Proposed solution

Product rule: dual surface

Replace “practice GCUs always land on main” with:

1. Start from clean-start (gate if not).
2. Land commits on a session branch (default for evaluation mode).
3. End with archive + restore main to clean-start (operator go on destructive remote update).
4. Optional later: a deliberate demo/latest (or separate demo remote) for a published finished face—not everyday main.

One-liner for agents and docs:

Pristine main is the product; session branches are the lab. CI proves the lab. Tags archive the lab. Teardown restores the product face.

CLI: silico practice (extends #84 session)

silico session start should check prepare/status for known practice remotes (xuss / xuss-c / xuss-lame), not only print a reset recipe to the session-start SHA.

Agent path hooks (AGENTS.md)

• Stage B on known practice remotes: run practice status before mutate.
• If not clean-start: one structured gate — prepare-fresh / continue-dirty / restore-main-first.
• Stage E: push session branch, watch Actions; do not require “must be on main” for CI proof.
• Evaluation exit / compound: archive + restore-main (or explicit open TODO if operator defers teardown).

CI (supporting, not the whole fix)

• Plate + practice GCU workflows: run on session branches / all pushes + pull_request + workflow_dispatch as needed so Stage E does not argue for polluting main.
• Treat this as support for the dual-surface model, not a standalone fix.

Hero video / capture path

• Document practice prepare (or status green) before recording first-ship takes.
• After capture: archive attempt; restore template face so the next take (and the next reader) is honest.
• CI clip can be session-branch Actions green, not “firmware forever on main.”

One-time hygiene

• When implementing: restore practice remotes whose main is mid-flight back to clean-start (operator go), after archiving any keep-worthy tip as attempt-* or optional demo/latest.
• Make tags/clean-start a single machine-readable baseline for status.

Interim fallback (if dual-surface slips)

Keep land-on-main, but make reset-to-clean-start mandatory pre- and post-session (practice status / reset) with operator gates.

Ship this only as a short bridge: it still leaves public main dirty during every session and fails open if teardown is skipped.

Explicitly not the fix

Acceptance sketch

• Practice remotes: main matches clean-start after a normal evaluation teardown.
• silico practice status|prepare|archive|restore-main (names flexible) exist and are gated where destructive.
• AGENTS practice-GCU section describes dual surface; agents no longer default “always main” for eval.
• Session branch push can show CI green without leaving firmware on main.
• Hero / record checklist points at prepare → archive → restore.
• At least one contaminated main (e.g. mid-flight xuss-c) restored once as hygiene, with attempt archived if worth keeping.

Related

• Session provenance: Mac/Codex first-ship test failed: prevent prior-attempt replay and harden C verify #84 (silico session start / past-HEAD salvage)
• Reflog / local salvage on clean-start: AGENTS: block reflog/local-machine salvage on xuss clean-start first-ship #91
• Hero video pipeline (capture assumes clean start): docs: reproducible README hero video pipeline #86