Module multiplayer 

Multiplayer development: a work item moves Build → Improve → Polish through different developers before it may merge. Design and rationale: docs/proposals/multiplayer-development.md.

This is a layer on top of coder sessions, not a change to them. Each stage is an ordinary coder.* session, run on its owner’s own machine with the engine they chose. What this module adds is the hand-off:

• A work item record, committed at .car/multiplayer/<id>.json on the branch car/mp/<id> in the team’s shared git remote. The artifact carries the record; nothing else travels between stages. The record has no free-text field except the intent fixed at Build, and deserializes with deny_unknown_fields, so a hand-off cannot smuggle the previous owner’s reasoning even if someone wants it to.
• publish, which turns a finished stage session into the next commit on that branch after checking the rules the concept depends on: one stage per account, each stage starts from the previous stage’s tip, the contract only grows, and a stage never edits the record itself.
• merge_check, which re-verifies the recorded history and re-runs the final contract before producing a squash branch for the team’s normal pull-request flow. CAR never pushes to main.

Eligibility is advisory. account_id is the stage owner’s own auth.snapshot account, written into a git file that anyone with push access could edit. The rules catch honest mistakes; making them unforgeable needs server-attested stage receipts (the proposal’s slice 5).

Structs

PublishRequest

What to publish.

StageRecord

One completed stage.

StageSignals

Runtime-collected measures of what a stage changed. None of it is the model’s self-report.

SubmitRequest

A stage done outside CAR — a developer’s own Claude Code or Codex session.

WorkItem

The work item record committed at .car/multiplayer/<id>.json.

Enums

Stage

One stage of a work item.

Constants

BRANCH_PREFIX

Branch prefix for work items, locally and on the remote.

RECORD_DIR

Where the record lives inside the tree.

SCHEMA_VERSION

Wire version of WorkItem. The record rejects unknown fields (so a hand-off cannot smuggle prose) and readers require an exact match, so ANY field change — even an additive optional one — must bump this: a teammate on an older CAR then gets a clear “schema version” error instead of an unreadable item.

Functions

admissible

Whether a contract can carry a multiplayer work item. Beyond the coder’s own validation: every stage and the merge check re-run it cold, in a fresh worktree with no session-start capture, so baseline and differential checks — which compare against a before-value captured at a session’s start — would fail every such run and make the item unmergeable.

contract_grows

Whether next only adds to prior: every prior check present and unchanged, and no credential grant the prior contract did not make. Returns how many checks were added.

contract_hash

A stable digest of a contract’s checks and credential grant. The description is prose and deliberately excluded.

get

One work item’s full record and tip.

handle_get

handle_list

handle_merge_check

handle_publish

handle_start_stage

Start the item’s next stage as an ordinary coder session at the item’s tip. The reply is coder.start’s, plus multiplayer.locked_contract: confirm with coder.confirm_contract { contract: <that> } (adding checks is fine; multiplayer.publish refuses a contract that dropped or changed one).

handle_submit_stage

list

Every work item on remote, with the caller’s eligibility for its next stage when account is known.

merge_check

Re-verify a work item end to end and, if it holds, produce car/mp/<id>-final: one squash commit on the item’s origin, with the record removed, for the team’s normal pull-request flow.

prepare_stage

The tip and record of one item, refusing a caller who already owns a stage.

publish

Publish a finished stage: check the hand-off rules, commit the updated record on top of the stage’s work, and push car/mp/<id> to the remote.

record_path

The record’s path inside the tree.

submit_stage

Submit a stage done outside CAR. CAR did not watch those edits, so it judges only what it can verify itself: the commit descends from the tip, changes something (an empty submission is refused — “no change” cannot be adjudicated for work CAR did not see), leaves the record alone, and passes the locked contract plus any additions, run here without credentials.