Forty repos, one sync endpoint, forty headers

At 4 a.m. the dependency agent has patched forty checkouts under /home/user/repos/. Getting forty branches upstream used to be a script with a git pull in it and hope.

POST /api/v1/agent/github/sync runs fetch, pull, push as one logical operation and stops at the first step that isn't ok. A push never runs against a half-synced tree. The repo is chosen by the X-Hoody-Cwd header, so the loop is one URL and forty header values. When the third repo conflicts, the reply is 502 sync_step_failed naming the steps that ran and the one that didn't; the other thirty-nine carry on.

The GitHub login was a device flow you approved once; the token lives in the agent's environment and is never returned by any endpoint. The loop holds no credential.

A push that can't land on a half-synced tree isn't a rule you wrote. It's the endpoint.