workspace repos should link their parent by pinned pubkey (not remote-add); add `%` parent sentinel + `der sync`

[sfriedenberg-etsy]

Problem

der init-workspace records no link to a parent repo, and the only existing
way to set up sync — remote-add — writes the remote as a content object
(genre Repo). A subsequent push :z (or any query catching it) would ship
that pointer object back to the parent, which is nonsensical. A workspace's
parent relationship is infrastructure, not content.

Proposed feature

Record a workspace's parent as a pinned-by-pubkey entry in
.dodder-workspace (never a content object), reached via a position-scoped
% sentinel in push/pull, plus a new der sync for the bidirectional
flow.

• [parent] pin in .dodder-workspace: pubkey (authoritative identity,
  verified on every use), locator, location-type, original-id
  (scope-prefixed, for guidance/debugging).
• % in remote-position of push/pull resolves to the verified pin.
  Distinct from %'s existing query-position virtual-marker meaning — no
  collision.
• der sync [query] = pull % then push %, local conflict resolution
  between (halt before push if pull leaves conflicts).
• Parent inference at init-workspace (and der set-parent): 0 in-scope
  repos → no pin; 1 → silent pin; 2+ → interactive picker
  (clown-resume-styled bubbles/list, grouped by scope, dialog-local tridex
  for pubkey shortening), hard-fail non-TTY.
• New CLI: der set-parent [id] / -unset, der init-workspace -parent <id>
  / -no-parent, der info-workspace surfaces the pin.

Purely additive: remote-add + explicit der push /name unchanged.

Dependency

Builds on the in-flight repo-id resolution / pinning layer (scope
enumeration: cwd/user/system, ../ distance). Cannot land until that exists.

Design doc

Full design committed at
docs/plans/2026-06-24-workspace-parent-linking-design.md. Likely warrants an
FDR once implemented.

:clown: clown 0.3.14+295fae7
amarbel-llc/clown@295fae7

[sfriedenberg-etsy]

Correction after reviewing master: the repo-id resolution/pinning layer this
feature was said to depend on is already landed as FDR-0019 (Scoped Repo
Resolution) (docs/features/0019-scoped-repo-resolution.md), not in-flight.

Key reconciliation (design doc updated):

• Selector is madder's scoped_id.Id; grammar is dot-depth (.name,
  ..name, //name), not ../.
• Scope enumeration already exists: commands_dodder.listScopedRepos
  (backs info-repo repos) — the picker's data source.
• Resolution seam: MakeOperateEnvDir / ResolveNthAncestorMatch.
• Overlap to note: FDR-0019 explicitly defers remote transport —
  repo_id.CheckSupported rejects remote-first /name ("no remote transport
  yet"). This feature (the %-parent push/pull) is that deferred
  remote-transport work, scoped to a single pinned parent.
• Enumeration gap to close here: listScopedRepos surfaces only
  Name + IsCwd; the picker additionally needs each repo's pubkey,
  directory path, the system scope, and dot-depth. Extending the enumerator is
  in-scope for this feature.

:clown: clown 0.3.14+295fae7
amarbel-llc/clown@295fae7

[sfriedenberg-etsy]

Reconciled (step C): much of this already shipped path-based

Before building, reconciled the design against master. A path-based
implicit parent already exists, so #287 is no longer greenfield:

Landed today (init-workspace -experimental-repo, the default):

• -parent <path> records a CWD-scoped parent; omitting -parent links the
  home (XDG-user) repo.
• Stored as a flat parent-path string in workspace config V1
  (workspace_config_blobs.V1.ParentPath; empty => home repo).
• Bare push/pull already resolve it
  (Remote.ResolveImplicitDirectPath -> GetParentPath() -> DirectPath).
  Covered by workspace_repo_implicit_parent_push_pull.
• TomlPointerV1 blob store to the parent (init-workspace -experimental-repo should use a pointer blob store to the parent #200); parent yin/yang linking;
  sync-tai/sync-digest checkpoint (now guarded by push fails with ErrBlobMissing when sync boundary references an inventory list whose blob was never durably written to the shared store #286).

Not landed (the genuine remaining work): identity pinning by pubkey +
verification, the % explicit spelling, der sync, scope-picker
inference (extending listScopedRepos with pubkey/dir/system/dot-depth),
and set-parent / -no-parent / info-workspace.

Design doc updated (commit a65383063) with a Landed Baseline section, the pin
modeled as fields extending the existing V1 parent-path (with a back-compat
hinge: pin-less V1 workspaces must keep working), and an Open Decision (a/b):

• (a) Full design (pinning + % + der sync + picker + new commands).
• (b) Incremental: add only pubkey pinning + verification to the
  existing path-based parent (closes the "silently wrong parent" gap), defer
  %/der sync/picker as follow-ups.

Leaning (b) as the highest-value first increment, but holding for the scope
decision before writing code.

:clown: clown 0.3.14+295fae7
amarbel-llc/clown@295fae7

[sfriedenberg-etsy]

Path B landed (pubkey pinning + verification)

Merged to master (commit fd2710af0). The "silently wrong parent" gap is
closed; the % sentinel / der sync / scope-picker (path A) remain open for
after a soak period — leaving this issue open to track them.

What shipped:

• init-workspace pins the parent repo's pubkey into the workspace config
  (parent-pubkey, additive on V1, omitempty — old configs decode to "" =
  unpinned, fully back-compat).
• push/pull verify the resolved parent's live pubkey against the pin
  only when the remote was resolved from the workspace parent (explicit
  -direct / stored remotes are untouched). Mismatch → hard error.
• Legacy pin-less workspace: TTY → confirm-pin (upgrades the config in place);
  non-TTY → hard error pointing at set-parent.
• New dodder set-parent: explicit (re-)pin of the current parent — the
  non-interactive migration path, and how to re-pin after a parent legitimately
  moves.

Tests: unit (AssertParentPubkeyMatches: match/mismatch/unpinned/
unparseable) + BATS (pin-at-init, mismatch hard-fail, legacy non-TTY hard-fail,
set-parent-then-push); the pre-existing implicit-parent push/pull test stays
green and now also exercises the happy verify path.

Deferred to path A (post-soak): % remote-position sentinel, der sync,
full listScopedRepos scope-picker inference, -no-parent, info-workspace
pin display. Design doc Status section updated accordingly.

:clown: clown 0.3.14+295fae7
amarbel-llc/clown@295fae7