Gap ledger isolation: background sessions isolate before editing, lanes park work as WIP commits, the strict sandbox names its allowlist - #1160

Scope

• What this PR changes, in one or two sentences: This PR closes the three ADOPT rows of the Claude Code practice gap ledger on the isolation layer page: B2-0003 and B4-0003 (slot worktrees) and C1-0022 (slot sandbox). The command center dispatched the ledger on 2026-10-15, and each row was confirmed by a second-family gpt-6-astra re-check.
• Base commit: 420452059
• Lane: lane:foundation
• Owned paths touched:
  • the practice skill's slots.json and isolation.md;
  • the slot manifest: sha256_when_labeled, plus sandbox and worktrees added to its existing route difference list, since the routes changed;
  • tests/test_native_practice_ledger_isolation.py (new);
  • manifests/evidence.json.

Rows:

• B2-0003, worktrees. A lane parks unfinished work as a WIP commit on its own branch, never with git stash, because every worktree of a repository shares one refs/stash.
  • Reproduced 2026-10-15 on the host's git 2.53.0 in a scratch repository: a stash pushed in one worktree showed in a sibling, and git stash pop there applied it and emptied the stack.
  • git/git@67ad4214 (v2.53.0) Documentation/git-worktree.adoc:298-302 documents the shared refs.
  • This sets a default, not a ban.
• B4-0003, worktrees. Background sessions (claude --bg, agent view) isolate before editing. worktree.bgIsolation defaults to "worktree", which blocks Edit and Write in the main checkout until the session calls EnterWorktree; a shell cp or redirect is not blocked.
  • Version correction: the subagent block dates from 2.1.154 (CHANGELOG:5037). 2.1.288 added the reminder that tells a blocked subagent how to proceed.
  • d4 trial context: d4's background copy made five Edit/Write calls, all outside its working directory (one of the documented skip cases), and no worktree was created. So the block in the main checkout was not exercised; no settings file changes the default.
• C1-0022, sandbox. network.strictAllowlist comes with an explicit network.allowedDomains (sandboxing.md:575).
  • The list is the in-repository M1 network arm: api.github.com, github.com, 127.0.0.1 and localhost. It is frozen through an M1 re-run at 2.1.300 before rollout.
  • No template on main carries sandbox settings. The host part is proposed to the command center as a host diff and is not applied; nothing on the host carries sandbox settings today.

SOTA sources

• https://code.claude.com/docs/en/agent-view.md:551, :553-559 (fetched 2026-10-15T11:41:33Z, sha256 c8e2b810…)
• https://code.claude.com/docs/en/settings-reference.md:5273-5281 (worktree.bgIsolation) and :2598-2604 (sandbox.network.allowedDomains) (8ba90434…)
• https://code.claude.com/docs/en/sandboxing.md:575 (f3feed62…)
• https://code.claude.com/docs/en/worktrees.md:84-86, :95 (a50825b4…)
• anthropics/claude-code@94506ff0 (v2.1.300) CHANGELOG.md:5037, :5283
• git/git@67ad4214 (v2.53.0) Documentation/git-worktree.adoc:298-302
• Piebald-AI/claude-code-system-prompts@0b7ce11f CHANGELOG.md:216, and system-prompts/system-reminder-subagent-write-blocked-pending-worktree-isolation.md:4-9 (a lead, checked against the installed 2.1.300 binary)
• 420452059: evidence/artifacts/claude-native-practice-20261009/probes-20261009.json:382-383, :393, :399 (the M1 network arm); docs/decisions/2026-10-11-final-stack-review-corrections.md:559

Evidence-class table

Local commands run

$ python3 -m unittest tests.test_native_practice_ledger_isolation   # base 420452059 (git archive export)
FAILED (6 of 10), e.g. AssertionError: '`claude --bg`' not found
$ python3 -m unittest tests.test_native_practice_ledger_isolation tests.test_native_practice_*
OK
$ python3 scripts/validate.py
rc 0

Follow-ups

• An M1 re-run at 2.1.300 is owed before the allowlist rolls out.
• The allowedDomains and strictAllowlist disposition rows stay baseline-unreviewed.
• Record the own-clone rule for sandboxed runs and the vendor sandbox's side effects #1129 edits the same page's sandbox Notes line. Expect a manifest and registry rebase with Record the own-clone rule for sandboxed runs and the vendor sandbox's side effects #1129, Gap ledger wave 1: route Workflow-child hooks outside project agent frontmatter; correct the TMPDIR and advisor rows #1146 and Practice rows: --max-findings, marketplace autoUpdate and trust, the workflow model override, the effortLevel origin #1147.

Checklist

• No GitHub Actions changed.
• No workflows changed.
• No secrets are printed, logged or committed.
• No new paid hosting, subscription or billing surface.
• Peer-owned untracked files and worktrees were preserved.

🤖 Generated with Claude Code