Enforcement & identity.

Modes

One setting per repo, stored in .regente/config.json:

regente enforce strict        # off | warn | strict  (default: warn)
regente enforce               # print the current mode

The pre-edit guard (symbol-aware)

Where a native adapter exposes a live edit hook, Regente calls the guard before each edit. It resolves the edited line to the function it lands in, so you're only blocked if you'd actually touch someone else's symbol — two agents on two different functions of the same file both proceed.

regente guard <path> [--line N] [--symbol S] --agent <id>   # exit 0 = allow, 2 = block

# alice holds api.js#login (lines 5-8):
regente guard api.js --line 5  --agent bob     # ⛔ exit 2 — line 5 is inside login (alice's)
regente guard api.js --line 10 --agent bob     # ✓ exit 0 — line 10 is a different function
regente guard api.js --line 5  --agent alice   # ✓ exit 0 — owner

Auto-claim on first edit. The live guard also auto-claims an unclaimed file for the editing agent at its first real edit. The claim is marked auto-claim and is released automatically when that session ends, so the first editor becomes the owner without an explicit claim, and a second live editor's edit is blocked (held-by-other) even in the default warn mode. A session that dies without a clean end (a killed terminal, a crash) cannot release its own safety net, so the stale sweep releases orphaned auto-claims once their holder has had no heartbeat past the stale window; deliberate claims are swept only on contention — or once their holder has been dark past claim_expiry_minutes (default 60; 0 disables), when every claim expires (see Concepts → Dead-holder reclaim). Disable auto-claim with {"auto_claim": false} in .regente/config.json.

Live edit-guard support: claude-code (PreToolUse) and gemini-cli (BeforeTool) block and auto-claim at edit time; codex has no pre-tool hook (and so no auto-claim), so it's enforced at commit time via verify-commit below; cursor attaches via MCP only (no hook), so agents claim with claim_path, and check_edit shows recent editors.

The interleaved-edit warning

Regente records who edited each file (a bounded one-hour history in .regente/recent-edits.json). When an agent edits a file that a different online agent edited within the last 30 minutes (config key recent_edit_warn_minutes), the guard warns and emits a conflict.detected event with conflict_type interleaved-edit. Warnings are deduped per agent pair and path (one per 10 minutes), and offline editors never trigger one. The MCP check_edit tool returns a recent_editors list; codex edits enter the tracker at commit time via the pre-commit guard.

The git pre-commit guard

Vendor-independent enforcement that works even where a live hook doesn't: it checks the staged files against the claim ledger and blocks a commit that touches files owned by another agent.

regente verify-commit --agent <id> [--files a,b] [--json]
#   ✓ commit ok — 3 staged file(s) clear for you
#   ⛔ commit blocked — server/api.js — held-by-other (held by alice)

Wire it as a git pre-commit hook for codex-driven (or any) repos. It reads staged paths with git -z (so non-ASCII filenames aren't mangled) and fails closed on a real git error — it never silently lets a commit through. It also records the committed files into the recent-edit tracker, which is how codex edits feed the interleaved-edit warning.

Agent identity

For the guard to recognize your claims, the identity it sees at edit time must match the name you claimed under. Regente reconciles this two ways:

• By session. The guard maps the editing session to the agent that joined/claimed under it (the MCP records the session on join), so an agent that claims as backend-1 isn't blocked from its own files even though the hook runs under a session id.
• By REGENTE_AGENT_ID. Set this per agent and it becomes the authoritative identity for both the guard and that agent's claims — the deterministic, recommended setup for strict enforcement.

  export REGENTE_AGENT_ID=backend-1   # in that agent's shell/session

An edit with no resolvable identity is never mislabeled as someone else's — it's advisory in off/warn and blocked only in strict.

Trust model — honest scope

Enforcement is a cooperative guardrail against accidental collisions, not a security boundary. It runs as a local advisory hook, so it's bypassable by design — don't set an identity, pass git commit --no-verify, or edit without the hook, and it won't stop you. It keeps a well-behaved fleet from overwriting each other; it does not defend against a malicious local process. The signed event log (Concepts → Signed attribution) is the tamper-evident record that complements it.