Flightdeck Tools is a public Apache-2.0 reference collection, deprecated for new Claude Code integrations as of September 22, 2026.

Many local automation failures happen in the gap between checking a condition and changing the thing it described.

The branch was clean when it was inspected. The test passed before another process changed an input. The candidate document looked plausible until it replaced a much larger durable record.

The Flightdeck tools do not make those races disappear. They make the boundary visible and give cooperating processes a way to narrow it.

Gate Runner keys a check to its inputs

Gate Runner builds an identity from Git state, staged entries, non-ignored untracked bytes, the executable and arguments, declared inputs, selected environment, and a caller-supplied salt.

A detached supervisor records an immutable attempt, combined output, and the command’s real exit status. Concurrent requests for the same key share one run. A prior result can be reused only while the selected identity still matches.

This avoids treating a reassuring log line as success or rerunning the same expensive check from several terminals. It is still a live-worktree check: ignored files and undeclared external systems remain outside the identity unless the caller includes them.

The later review found a cancellation boundary that the original suite missed. A command had exited successfully, but SIGTERM arrived while the supervisor checked the final input snapshot. The recorded result still became reusable success. The repair keeps cancellation active through final validation, then blocks TERM, INT and HUP before checking accepted interruptions again and publishing the terminal result. That blocking operation is the completion boundary: earlier accepted cancellation records an error; signals arriving afterward do not change the completed verdict. Regressions deliver actual signals on both sides, including a successful child command whose interrupted supervisor must not become reusable success.

Cleanup also needs an ownership contract

A disposable demo still has real process authority. Its old cleanup matched command-line text containing the fixture path, which also selected a synthetic diagnostic process merely quoting that path. A matching string is not proof of ownership. The repair selects supervisor PIDs from this fixture’s attempt records, matches the complete interpreter, script, attempt path and descriptor arguments, and rechecks before signalling. Ambiguous ownership retains the fixture with an error. Tests show that a real interrupted supervisor stops while diagnostic bystanders survive. Process inspection and signalling are still separate operations, so this is a narrower trusted-fixture contract, not atomic protection against every PID-reuse race.

Shell Lock keeps cooperating writers apart

Shell Lock holds an operating-system advisory file lock across a directly executed command. It avoids the stale-process ambiguity of a plain PID file and returns the command’s exit status.

The protection is deliberately local. Every writer must use the same persistent path, and replacing that lock file can split callers across different inodes.

Worktree Guard inspects the actual Git operation

Worktree Guard has separate read-only checks for merging and removing linked worktrees. It checks the expected main checkout and branch, unfinished operations, ordinary changes, concealed index entries, and whether commits are retained.

It does not merge, remove, fetch, or run tests. That keeps the destructive step explicit. When the following change needs a smaller race window, the preflight and mutation can run together under Shell Lock.

File Guards cover three different hazards

Agent File Guards contains three utilities because the risks are distinct.

  • Untrusted Intake inventories known instruction, hook, and configuration surfaces without sourcing checkout files.
  • Shrink Guard refuses empty or unexpectedly small rewrites and checks for an intervening content change before rename.
  • NUL Lint scans tracked files, staged blobs, or selected untracked paths for literal NUL bytes that can make text appear binary to Git and review tools.

None is a semantic proof. A same-size rewrite can still be wrong, and a static inventory does not certify a checkout as safe. The value is a concrete refusal at the boundary where a common class of damage would otherwise be easy to miss.