feat(rawr): add safety checks for Graphite sync with --force

docs/projects/rawr/rebase-gotchas.md

@@ -33,6 +33,12 @@ Date: 2026-02-06
 - Avoid global Graphite restacks in parallel environments; default to `gt sync --no-restack`.
 - Do not run `gt sync` while a checkpoint rewrite is in progress (it may overwrite local trunk if it cannot fast-forward).
 - After any plain `git rebase` checkpoint on trunk, run `gt ls --all --show-untracked` and repair tracking with `gt track` if needed.
+- In non-interactive automation, `gt sync` may still require confirmations unless you add `--force`:
+  - Prefer `gt sync --no-restack --force --no-interactive` (only after the trunk push is complete).
+
+## Merge caution (Graphite)
+- `gt merge` can take time.
+- While a merge job is running, avoid other Graphite mutating commands unless you are 100% confident they are safe and isolated; it’s easy to create confusing metadata drift.
 
 ## Why this prevents recurrence
 - The canonical parent branch is explicit and stable.

docs/projects/rawr/rebase-runbook.md

@@ -53,10 +53,22 @@ Fork-specific rebase workflow for `rawr-ai/codex`, aligned with the permanent mo
 
 3. Restack tracked descendants
 - Run `gt sync --no-restack` (never a global restack in parallel workflows).
+- For non-interactive automation, prefer:
+  - `gt sync --no-restack --force --no-interactive`
 - If `gt ls --all` shows tracked descendants above trunk, run `gt restack --upstack`.
 - If `gt ls --all --show-untracked` shows untracked branches after a checkpoint rewrite, repair tracking:
   - `gt track <branch> --parent codex/integration-upstream-main`
 
+## Graphite merge caution
+- `gt merge` can take time to complete.
+- If a merge job is in progress and you are not 100% confident in the git/Graphite operations you’re running, do not run additional Graphite mutating commands (merge/sync/submit/restack). Stick to read-only inspection until the merge finishes.
+
+## Safety note: `gt sync --force`
+- `gt sync` can overwrite local trunk with remote trunk if trunk cannot be fast-forwarded.
+- Only run `gt sync --no-restack --force --no-interactive` after the checkpoint push has succeeded and your local trunk matches `origin/codex/integration-upstream-main`:
+  - `git rev-parse codex/integration-upstream-main`
+  - `git rev-parse origin/codex/integration-upstream-main`
+
 4. Validation
 - `just fmt` in `codex-rs`.
 - Run changed-crate tests.
@@ -79,7 +91,7 @@ git fetch --all --prune
 DRY_RUN=1 rawr/sync-upstream.sh codex/integration-upstream-main
 rawr/sync-upstream.sh codex/integration-upstream-main
 
-gt sync --no-restack
+gt sync --no-restack --force --no-interactive
 # If descendants exist:
 gt restack --upstack
 

rawr/prompts/rawr-upstream-rebase-orchestrator.md

@@ -32,6 +32,17 @@ This is an **agent-first** workflow: you own judgment, conflict resolution, and
 - Update doc:
   - `/Users/mateicanavra/Documents/.nosync/DEV/rawr-ai/codex/rawr/UPDATING.md`
 
+## Skills to consult (for understanding, not to supersede the runbook)
+
+Read these at the start of a daily run so you understand the intended fork model and Graphite safety invariants:
+
+- [$fork-rebase-maintenance](/Users/mateicanavra/.codex-rawr/skills/fork-rebase-maintenance/SKILL.md)
+- [$graphite](/Users/mateicanavra/.codex-rawr/skills/graphite/SKILL.md)
+
+If you are operating in parallel worktrees/multi-agent mode, also read:
+
+- [$parallel-development-workflow](/Users/mateicanavra/.codex-rawr/skills/parallel-development-workflow/SKILL.md)
+
 ## Tools available (mechanical automation)
 
 - Daily wrapper (verify + apply + graphite alignment + validation + report):
@@ -91,7 +102,10 @@ Use this when you choose to complete the checkpoint despite conflicts.
    - If you need an explicit expected SHA, fetch it and use the explicit lease form.
 
 6. Graphite alignment:
-   - `gt sync --no-restack --no-interactive`
+   - Only after the checkpoint push succeeds and local trunk matches remote:
+     - `git rev-parse codex/integration-upstream-main`
+     - `git rev-parse origin/codex/integration-upstream-main`
+   - `gt sync --no-restack --force --no-interactive`
    - If `gt ls --all` shows descendants above trunk: `gt restack --upstack`
    - Verify tracking health:
      - `gt ls --all --show-untracked`

rawr/rebase-daily.sh

@@ -250,8 +250,24 @@ if [[ "$apply_code" -ne 0 ]]; then
 fi
 
 log "graphite: sync --no-restack"
+local_patch="$(git rev-parse "$PATCH_BRANCH")"
+remote_patch="$(git rev-parse "origin/$PATCH_BRANCH" 2>/dev/null || true)"
+if [[ -z "$remote_patch" ]]; then
+  RAWR_REPORT_STATUS="graphite_sync_failed"
+  RAWR_REPORT_EXIT_CODE="$EXIT_GRAPHITE_RESTACK_FAILED"
+  export RAWR_REPORT_NOTES="failed to resolve origin/$PATCH_BRANCH; refusing to run gt sync with --force"
+  exit "$EXIT_GRAPHITE_RESTACK_FAILED"
+fi
+
+if [[ "$local_patch" != "$remote_patch" ]]; then
+  RAWR_REPORT_STATUS="graphite_sync_failed"
+  RAWR_REPORT_EXIT_CODE="$EXIT_GRAPHITE_RESTACK_FAILED"
+  export RAWR_REPORT_NOTES="local $PATCH_BRANCH ($local_patch) does not match origin/$PATCH_BRANCH ($remote_patch); refusing to run gt sync with --force"
+  exit "$EXIT_GRAPHITE_RESTACK_FAILED"
+fi
+
 set +e
-gt_sync_out="$(gt sync --no-restack --no-interactive 2>&1)"
+gt_sync_out="$(gt sync --no-restack --force --no-interactive 2>&1)"
 gt_sync_code=$?
 set -e
 if [[ "$gt_sync_code" -ne 0 ]]; then