From 7934367f156d22cae6736e2c967e1b6bcffdbcb0 Mon Sep 17 00:00:00 2001
From: autonomic-bot <64+autonomic-bot@noreply.git.autonomic.zone>
Date: Mon, 14 Sep 2026 16:57:07 +0000
Subject: [PATCH] cctest-recipe-upstream: always emit step 0 fetch-from-mirror
 commands for the operator

---
 .opencode/skills/cctest-recipe-upstream/SKILL.md | 12 ++++++++++++
 scripts/gen-cctest-skills.py                     | 13 +++++++++++++
 2 files changed, 25 insertions(+)

diff --git a/.opencode/skills/cctest-recipe-upstream/SKILL.md b/.opencode/skills/cctest-recipe-upstream/SKILL.md
index 61c55c4..4e40a36 100644
--- a/.opencode/skills/cctest-recipe-upstream/SKILL.md
+++ b/.opencode/skills/cctest-recipe-upstream/SKILL.md
@@ -50,6 +50,18 @@ not the test server — so it can run either way. Probe, then follow that branch
   4. Everything else in the canonical script (origin/dev remote setup, release recommendation,
      emitted next-steps) is identical.
 
+Every time the branch was prepared **here**, remember it exists only on this host — the
+operator's machine must fetch it first. Always emit this **step 0** before the push step
+(anonymous public fetch, no credentials needed):
+
+```
+  # 0. On a machine WITHOUT the branch pre-fetched, get it from the autonomic mirror:
+  cd <local checkout of the recipe>          # or: git clone https://git.autonomic.zone/recipe-maintainers/<recipe>.git
+  git remote add gitea https://git.autonomic.zone/recipe-maintainers/<recipe>.git 2>/dev/null ||     git remote set-url gitea https://git.autonomic.zone/recipe-maintainers/<recipe>.git
+  git fetch gitea +refs/pull/<PR_NUM>/head:refs/heads/<HEAD_REF>
+  git checkout <HEAD_REF>
+```
+
 In both modes the final output is a set of commands for the operator to run on a machine **with
 push access to `git.coopcloud.tech`** — always print them, even when everything local is
 already prepared.
diff --git a/scripts/gen-cctest-skills.py b/scripts/gen-cctest-skills.py
index 4a1caa0..69346d5 100644
--- a/scripts/gen-cctest-skills.py
+++ b/scripts/gen-cctest-skills.py
@@ -78,6 +78,19 @@ not the test server — so it can run either way. Probe, then follow that branch
   4. Everything else in the canonical script (origin/dev remote setup, release recommendation,
      emitted next-steps) is identical.
 
+Every time the branch was prepared **here**, remember it exists only on this host — the
+operator's machine must fetch it first. Always emit this **step 0** before the push step
+(anonymous public fetch, no credentials needed):
+
+```
+  # 0. On a machine WITHOUT the branch pre-fetched, get it from the autonomic mirror:
+  cd <local checkout of the recipe>          # or: git clone https://git.autonomic.zone/recipe-maintainers/<recipe>.git
+  git remote add gitea https://git.autonomic.zone/recipe-maintainers/<recipe>.git 2>/dev/null || \
+    git remote set-url gitea https://git.autonomic.zone/recipe-maintainers/<recipe>.git
+  git fetch gitea +refs/pull/<PR_NUM>/head:refs/heads/<HEAD_REF>
+  git checkout <HEAD_REF>
+```
+
 In both modes the final output is a set of commands for the operator to run on a machine **with
 push access to `git.coopcloud.tech`** — always print them, even when everything local is
 already prepared.