feat(fleet): Stage 0 — repo-agnostic Linux VM host for the agent fleet

[IsraelAfangideh]

What this is

Stage 0 of moving the Claude Code agent fleet off the laptop: a self-contained kit to provision one fat Linux VM and replicate the setup there, with almost no rebuild. Your /goal behavior, routines, dispatcher, and worktrees run unchanged — just on a box that won't swap itself to death at ten concurrent sessions.

Everything lives under fleet/. It is repo-agnostic and multi-host — it manages many repos across GitHub and Bitbucket. The research code in this repository is unrelated; fleet/ just happens to live here (this was the branch's repo).

On Linux, OrbStack disappears — it's the Mac shim for fast containers; Linux gets them natively through Docker, so bootstrap.sh installs Docker CE directly and that whole layer is gone.

What's included

Piece	Job
bootstrap.sh	Idempotent host provisioning: Docker CE (native), Node + Claude Code, uv, tmux/git; swap, vm.swappiness, inotify watches, and open-file limits tuned for many concurrent sessions.
bin/fleet-credentials	Multi-host git auth (GitHub + Bitbucket): SSH host-key trust and/or per-host HTTPS token helpers reading 0600 token files — tokens never touch env vars, mounts, or the agent.
bin/fleet-clone + config/repos.tsv	Clone/replicate many repos across hosts. Fresh clones run a setup command; existing repos only fetch (never force-reset — in-flight worktrees are safe); one failing repo never aborts the sweep.
bin/fleet-worktree / bin/fleet-session	Thin multi-repo git worktree helper and a tmux-backed session wrapper (reattachable equivalent of claude --bg) — drive the box from Mac or phone, survive SSH drops.
bin/fleet-doctor	Preflight: hardware headroom, tooling, kernel tuning, per-host credentials.
Dockerfile.workspace	Optional generic native-Docker image — the seed of a Stage-1 environment.
Makefile, README.md	Convenience targets and the operator runbook, with an explicit Stage 0 → Stage 1 map.

Real config is git-ignored; only *.example files ship.

Credential principle (early Stage-1 vault behavior)

HTTPS tokens live only in ~/.config/fleet/*.token at mode 0600, read on demand by a git credential helper, wired into the remote by git. They are never printed, never baked into env vars / mounted files / a system prompt, and never handled by the agent — so push/pull work from inside every session without the model seeing a credential.

Testing

All scripts pass shellcheck and were exercised end-to-end against local bare repos (no network/auth needed):

• fleet-clone: fresh clone runs setup once; re-run only fetches; a deliberately broken repo fails without aborting the sweep (regression-tested — caught and fixed a set -e + [ ] && cmd abort bug).
• fleet-worktree: add / list / path / rm lifecycle, branch names sanitized into paths.
• fleet-credentials: git credential fill returns the correct per-host username+token (GitHub x-access-token, Bitbucket x-token-auth) from the 0600 files.
• fleet-session: tmux session create / list / idempotent reattach / kill.
• fleet-doctor: correct PASS/WARN/FAIL classification on a live box.

Stage 0 → Stage 1

Each piece maps onto cloud Managed Agents so nothing is throwaway: Dockerfile.workspace → environment, token files/helpers → vaults, ~/.claude config → agent, fleet-session → session per ticket, SSH/tmux ping → webhooks (session.status_idle), the dispatcher → a scheduled deployment. Details in fleet/README.md.

🤖 Generated with Claude Code

https://claude.ai/code/session_016MdFBB1nCBndDK7KtS5t2P

---

Generated by Claude Code