{"record":{"id":"3d23a5a51a2f6ed0","repo":"Yeachan-Heo/oh-my-codex","slug":"refusing-mutating-ultragoal-command-command-f","errorCode":null,"errorMessage":"Refusing mutating ultragoal command \"${command}\" from Team worker ${workerIdentity}. Ultragoal state is leader-owned; workers must report checkpoint evidence upward instead of mutating .omx/ultragoal.","messagePattern":"Refusing mutating ultragoal command \"(.+?)\" from Team worker (.+?)\\. Ultragoal state is leader-owned; workers must report checkpoint evidence upward instead of mutating \\.omx/ultragoal\\.","errorType":"exception","errorClass":"UltragoalError","httpStatus":null,"severity":"error","filePath":"src/cli/ultragoal.ts","lineNumber":354,"sourceCode":"  'complete',\n  'complete-goals',\n  'next',\n  'start-next',\n  'checkpoint',\n]);\n\nfunction readTeamWorkerIdentity(env: NodeJS.ProcessEnv = process.env): string | null {\n  const publicIdentity = typeof env.OMX_TEAM_WORKER === 'string' ? env.OMX_TEAM_WORKER.trim() : '';\n  if (publicIdentity) return publicIdentity;\n  const internalIdentity = typeof env.OMX_TEAM_INTERNAL_WORKER === 'string' ? env.OMX_TEAM_INTERNAL_WORKER.trim() : '';\n  return internalIdentity || null;\n}\n\nfunction assertUltragoalMutationAllowedFromCurrentProcess(command: string): void {\n  if (!ULTRAGOAL_MUTATING_COMMANDS.has(command)) return;\n  const workerIdentity = readTeamWorkerIdentity();\n  if (!workerIdentity) return;\n  throw new UltragoalError(\n    `Refusing mutating ultragoal command \"${command}\" from Team worker ${workerIdentity}. `\n    + 'Ultragoal state is leader-owned; workers must report checkpoint evidence upward instead of mutating .omx/ultragoal.',\n  );\n}\n\nexport interface UltragoalCommandDependencies {\n  buildCodexGoalInstruction?: typeof buildCodexGoalInstruction;\n}\n\nexport async function ultragoalCommand(args: string[], deps: UltragoalCommandDependencies = {}): Promise<void> {\n  const command = args[0] ?? 'help';\n  const rest = args.slice(1);\n  const json = hasFlag(rest, '--json');\n  const cwd = process.cwd();\n  const buildGoalInstruction = deps.buildCodexGoalInstruction ?? buildCodexGoalInstruction;\n\n  try {\n    if (command === 'help' || command === '--help' || command === '-h') {","sourceCodeStart":336,"sourceCodeEnd":372,"githubUrl":"https://github.com/Yeachan-Heo/oh-my-codex/blob/3ad79a8a6fe6e95fdbb8c00e40716fffe4011ce2/src/cli/ultragoal.ts#L336-L372","documentation":"A hard safety guard: when the process is identified as a Team worker (readTeamWorkerIdentity returns an identity), mutating ultragoal subcommands (those in ULTRAGOAL_MUTATING_COMMANDS, e.g. steer, add-goal, record-review-blockers) are refused. Ultragoal plan state is leader-owned; workers must surface evidence upward instead of editing .omx/ultragoal directly.","triggerScenarios":"A Team worker environment (worker identity file/env present) invoking any mutating command, e.g. `omx ultragoal steer ...` or `omx ultragoal add-goal ...`, from within a worker process.","commonSituations":"Worker scripts copied from leader playbooks; local dev machine accidentally carrying a worker identity file in .omx; orchestrator misrouting steering calls to worker nodes.","solutions":["Run mutating commands from the leader process/agent only; from workers, emit checkpoint evidence reports instead","If this is a local machine wrongly flagged, remove/clear the stale Team worker identity (check readTeamWorkerIdentity's source for the marker location) and re-run","Use read-only commands (status/next) from workers — those are not blocked"],"exampleFix":"# before (inside Team worker)\nomx ultragoal steer --kind update_goal ...\n# Error: Refusing mutating ultragoal command \"steer\" from Team worker ...\n\n# after\n# worker reports evidence upward; leader runs:\nomx ultragoal record-review-blockers --goal-id g1 --title t --objective o --evidence e","handlingStrategy":"validation","validationCode":"import { readTeamWorkerIdentity } from './team';\nconst MUTATING = new Set(['steer','add-goal','record-review-blockers' /* ULTRAGOAL_MUTATING_COMMANDS */]);\nif (MUTATING.has(cmd) && readTeamWorkerIdentity()) {\n  console.error('worker detected: emit checkpoint evidence instead of mutating ultragoal');\n  process.exit(3);\n}","typeGuard":"function isMutatingUltragoalCommand(cmd: string, mutating: ReadonlySet<string>): boolean {\n  return mutating.has(cmd);\n}","tryCatchPattern":null,"preventionTips":["Route all mutations through the leader agent","Only run read-only subcommands (status, next) inside workers","Clear stale worker identity files on dev machines that double as workers"],"tags":["ultragoal","authorization","multi-agent","cli"],"backgroundTag":"worker-write-forbidden","analyzedSha":"3ad79a8a6fe6e95fdbb8c00e40716fffe4011ce2","analyzedAt":"2026-08-27T22:18:39.783Z","schemaVersion":2},"datasetVersion":"2026-08-28T00:17:15.603Z"}