Skip to content

Claude harness settings: credential-store and destructive-git denies, Opus role agents without frontmatter isolation, rtk-aware guard - #402

Merged
seathatflowsinourveins merged 4 commits into
mainfrom
claude/claude-harness-settings-20260927
Sep 27, 2026
Merged

Claude harness settings: credential-store and destructive-git denies, Opus role agents without frontmatter isolation, rtk-aware guard#402
seathatflowsinourveins merged 4 commits into
mainfrom
claude/claude-harness-settings-20260927

Conversation

@seathatflowsinourveins

@seathatflowsinourveins seathatflowsinourveins commented Sep 27, 2026

Copy link
Copy Markdown
Collaborator

Scope

Files that running sessions load from the repository (peers main, why-is-macos, native-agent-stack-b4, mac-memory-layer-plan and every session started in this checkout after merge):

  • .claude/settings.json gains 26 deny rules (home credential stores with their **/ twins). After merge, sessions started in this repository can no longer use Claude's file tools to read ~/.ssh, ~/.gnupg, ~/.aws, ~/.azure, ~/.kube, ~/.docker/config.json, ~/.git-credentials, ~/.netrc, ~/.npmrc, ~/.pypirc, OmniRoute's data directories or ~/.codex/shell_snapshots. A project-local .npmrc, .netrc or .pypirc is denied too, by the twin semantics, as for .env. No tracked file of this repository matches any new twin (git ls-files checked against all of them).

  • New .claude/agents/ (ten files, byte-identical to adoption/agents/claude/). Project agents outrank ~/.claude/agents/, so after merge every session in this checkout dispatches the new definitions:

    • isolated-builder and stack-verifier run on Opus.
    • isolated-builder has no frontmatter worktree isolation. A builder brief must name an owned checkout, and the body refuses the coordinator's own checkout, a missing path or a HEAD off the base.
    • stack-verifier and source-scout state the BASH_MAX_TIMEOUT_MS ceiling and report a timed-out command as not run and still running.

    This host's .git/info/exclude lists /.claude/, so these files were added with git add -f; clones are unaffected.

  • scripts/hooks/secret_path_guard.py runs as the project PreToolUse hook here. After merge it blocks these, in every session in this checkout:

    • a reader, copy or search of every path the template's credential-store Read denies cover: anything in ~/.ssh (including config, known_hosts and *.pub), ~/.gnupg, ~/.aws (including config), ~/.azure, ~/.kube, OmniRoute's data directories and any shell_snapshots directory, each directory itself and a glob in it; the Docker home as a whole; the Docker, git-credential, netrc, npm and PyPI files; and any nativestack/*.key;
    • scp -i KEY, rsync -e 'ssh -i KEY' and gpg --homedir ~/.gnupg, which name a store as the operand of a program the guard treats as a reader. A key named in ~/.ssh/config or loaded with ssh-add avoids that.

    Every guard rule also reads the command inside rtk proxy|summary|err|test|run|read|smart|json|log ... and any other rtk subcommand as its native program, so rtk proxy cat .env and rtk env are blocked too; both passed before. ssh -i, ssh-add, ssh-keygen -y -f, kubectl --kubeconfig, curl --netrc, gh ssh-key add, ls, stat and chmod still pass. A grep-family search whose pattern merely spells a credential path (rg shell_snapshots docs) also passes.

Nothing on any host was changed: no ~/.claude, ~/.codex, service or gateway write. The host-now steps (H1, H2, H6, H8 of the synthesis: apply the template keys, install guard and agents) remain for the coordinator.

SOTA sources

  • Claude Code official docs, read 2026-09-27 against the installed 2.1.283:
    • permissions: Read/Edit deny scope, including the recognized Bash file commands; ~/ and // anchors; gitignore *; trailing * semantics; "Wrappers" (a fixed list; RTK is not in it); "What a Bash rule doesn't match" (rules match the command text as written, and a PreToolUse hook is the way to inspect the full command); "not a security boundary".
    • permission modes: "Deny rules block in every mode".
    • sub-agents:
      • frontmatter isolation branches from the default branch;
      • "A subagent starts in the main conversation's current working directory";
      • "Subagent names", scope priorities, and memory auto-enabling Read/Write/Edit;
      • claude-code-guide runs on Haiku, and an Agent(name) deny works for built-ins;
      • the concurrent-subagent limit does not apply under Ultracode.
    • agent teams: teammates inherit the lead's effort; skills is not applied; -p spawns no teammates; the "0" override and --settings precedence.
    • workflows: the prefix-sharing condition; a resume re-runs stages.
    • hooks:
      • SubagentStart scope and the Agent tool's input fields;
      • PreToolUse updatedInput ("Claude Code evaluates permission rules ... against the input your hook returns, not the input Claude sent");
      • "All matching hooks run in parallel", and the precedence deny > defer > ask > allow.
    • env vars and tools reference: BASH_MAX_TIMEOUT_MS; what happens at a timeout; "Background commands".
    • status line: refreshInterval.
    • best practices, and model-config "Automatic model fallback".
  • rtk-ai/rtk @ v0.50.0 (1d87b8e7), which the template registers as rtk hook claude:
    • src/discover/rules.rs: ^(cat|head|tail)\s+ is rewritten to rtk read.
    • src/discover/registry.rs: is_single_file_operand keeps ~ paths eligible.
    • src/hooks/permissions.rs: reads the project and user settings.json/settings.local.json only, and append_bash_rules keeps only Bash(...) rules.
    • src/hooks/decision.rs: "Deny wins outright".
    • src/hooks/hook_cmd.rs: the rewrite is returned as updatedInput.
    • src/core/config.rs and README: [hooks] exclude_commands.
    • rtk 0.50.0 rtk --help, subcommand --help and rtk hook check.
  • trailofbits/claude-code-config @ 2109be9, settings.json (credential-store Read denies, rc-file Edit denies, git denies): corroboration.
  • jarrodwatts/claude-hud @ v0.8.0, README.md (refreshInterval: 5).
  • anthropics/claude-code @ 7779afb, plugins/code-review/commands/code-review.md steps 4-6 (per-finding validation, Opus for bug and logic findings).
  • Anthropic engineering, multi-agent research system (brief contract, scaling rules) and building effective agents; arXiv:2512.08296 v3 (centralized verification).
  • openai/codex @ rust-v0.157.1: codex-rs/config/src/config_toml.rs L719-720 (max_depth "Ignored by V2"), and codex-rs/shell-command/src/shell_snapshot_exports.rs (snapshots record exported values); installed codex-cli 0.157.1 codex exec --help.
  • diegosouzapw/OmniRoute @ a58000c7 (same lines at v3.8.50): src/lib/dataPaths.ts L40-62 and L175-190; .env.example L36-41.
  • akitaonrails/ai-memory @ v2.4.1, docs/install.md ("Native hook commands invoke the installed binary directly").
  • oraios/serena @ c6fbd1c, src/serena/hooks.py (remind, activate and auto-approve behaviour) and the client guide (the hooks are opt-in and alpha).
  • git-rev-parse(1) (--show-toplevel); GNU grep(1) and rg(1) synopses (PATTERNS [FILE...], -e/-f); coreutils cp(1) -t; dd(1) of=.
  • docs/acceptance-evidence-policy.md: local contract tests are structural validation.

What changed

Settings template and project settings (PR-A, H1, H6, H8, C4). The model-fallback guards were already in the template and are now asserted by a test. Added:

  • credential-store Read denies with their Context Mode twins, plus the two WSL2 Windows OmniRoute defaults (template only);
  • Edit(~/.bashrc|.profile|.zshrc) and Agent(claude-code-guide);
  • nine destructive-git denies, plus the six force-push forms again as rtk git push ... (--force-with-lease stays runnable for the hot-file protocol);
  • BASH_MAX_TIMEOUT_MS=1800000 and statusLine.refreshInterval: 5.

On Linux the rendered template's hooks are byte-identical to before. The only rendered differences are 49 added deny rules (none removed), one env key and refreshInterval. This comes from a render comparison of origin/main and the final template with adoption/hosts/example.json, re-run after the review repairs; this round did not change the template.

Guard. A reader, copy or search whose operand is a template credential store, a glob in one or a file in one is credential_file_read. The rule covers the directory itself and every path the template's credential-store Read denies cover: anything in ~/.ssh, ~/.gnupg, ~/.aws, ~/.azure, ~/.kube, the OmniRoute data directories and any shell_snapshots directory; the Docker, git-credential, netrc, npm and PyPI files; and the Docker home as a whole, following the Hugging Face home precedent.

It is deliberately a reader-operand rule, not a mention rule, so ssh -i, ssh-add, kubectl --kubeconfig, curl --netrc, ls, stat and the H4 chmod still pass in every session. OmniRoute's .env/server.env are now reported as reads of the data directory. A dotenv file elsewhere is still dotenv_read.

On a host that runs RTK's hook, this rule is what stops cat, head and tail -n of those stores. RTK 0.50.0 rewrites those readers to rtk read, Claude Code checks its rules against the rewrite, and RTK's own deny gate reads only Bash(...) rules (see Independent verification).

Role agents (PR-C).

  • isolated-builder and stack-verifier → model: opus (the user's rule).
  • isolated-builder drops isolation: worktree. It refuses to edit unless its brief names an owned checkout at the stated base that is not the coordinator's own (a git rev-parse --show-toplevel comparison). It accepts a prepared clone as well as a git worktree add --no-track tree.
  • The stack-verifier and source-scout timeout text follows BASH_MAX_TIMEOUT_MS.
  • A third copy of every definition lives in .claude/agents/.
  • Contract suite:
    • no agent declares frontmatter isolation;
    • an editing agent carries the refusal, with each condition asserted;
    • three new mutations here and six more in the review repairs;
    • no memory on read-only roles (failing-first control).

Portable instructions and dispatch (PR-D).

  • examples/claude-native/CLAUDE.md now carries the user's four dispatch modes (solo, one unnamed subagent, Ultracode workflow, agent team). It also carries the verified named-spawn rule with the per-run opt-out.
  • The Ultracode recipe gains the dispatch facts, verification patterns (a)-(h), the prefix-sharing condition and teammate effort.
  • The workflows README gains a brief contract. It keeps lane text in saved-workflow packets until a Workflow child is observed with the SubagentStart block.
  • The cooperation recipe gains the headless codex exec -s read-only ... < /dev/null review form and the Codex V2 depth note.

Token gaps.

  • ai-memory#2: hook commands run ${AI_MEMORY_BIN}. It is rendered from the selected platform's pin (--platform, default this machine; macOS → tools/ai-memory-2.3.2) or from a host-supplied binary. The false macOS pin note is corrected.
  • serena#2: not adopting Serena's alpha hooks, with source evidence:
    • the remind hook denies Read/Grep in roles that have no Serena tools;
    • activate asks for activate_project, which the single-project claude-code context disables;
    • auto-approve is inert under bypassPermissions.
  • codebase-memory-mcp#2: Claude registration is explicitly gated on a manual install. No agent gets the server's tools until a useful call per intended agent is recorded.

Word budget. PortableTopRuleTests is re-baselined to 1,205 words, from a 925 ceiling. The user's four modes plus the named-spawn rule do not fit; a 344-word Workers section still dropped user rules. The reason is recorded in the test docstring and the decision record. Reviewers: this is a deliberate budget change.

The synthesis also listed the Codex V2 depth statement for the portable CLAUDE.md. It sits in the Ultracode and cooperation recipes instead, so the portable file keeps only the user's approved text and the named-spawn rule.

Review repairs (commit 3).

  • The six force-push denies again as rtk git push .... RTK 0.50.0 already leaves a command alone when a Bash(...) deny rule of the settings files it reads matches it, so a typed git push --force stays denied. But a hand-typed rtk git push --force passes RTK unchanged. And a rule from a source RTK does not read (managed settings, --settings) sees only the rewrite.
  • The guard reads the command inside every rtk form.
  • The guard treats cp -t DIR operands as sources and dd's of= as a write. It no longer takes a grep-family search's own pattern for a file when only plain flags precede it; otherwise every argument still counts.
  • The verifier's timeout text now distinguishes foreground and background subagents.
  • The builder contract test asserts each refusal condition. It also checks the README's agent table, whose builder and verifier rows still said Sonnet.
  • The agent-contract evidence is reclassified as structural validation.
  • A new anti-pattern row records this unit's flawed first reproduction of finding 1: a hook's decision checked with settings the deployed host will not have.

Independent-verification repairs (commit 4). The guard now covers every template credential store (above) and any nativestack/*.key. A new test derives a reader of every anchored template Read deny. The RTK statements are narrowed to Bash(...) rules in docs/secret-storage.md, the decision record (rows 5 and 6) and the anti-pattern log, with a new dated log row. source-scout gets the timeout text. The decision record's mutation evidence row is corrected.

Evidence-class table

Claim Evidence class Command / receipt
Agent contract, role tables and three agent copies agree structural_validation node test-envelope.mjs 254/254; python3 -m unittest tests.test_install_claude_profile (also with PyYAML via uv run --no-project --with pyyaml, 58 tests, no skips)
Builder contract text fails closed structural_validation, failing-first node test-contract-mutations.mjs 74/74. The six mutations added in review pass unnoticed against the pre-repair suite (68/74): the HEAD read and the three refusal conditions of the builder, and two agent-table rows. This checks the instruction text, not an agent refusing
Force-push denies also match RTK's rewrite structural_validation, failing-first test_the_push_denies_also_match_the_rtk_rewrite applies the documented wildcard rules to both spellings. The template at 08b84af3 fails all five rtk git push spellings (template-control.out)
ai-memory hook binary follows the platform pin local_integration, failing-first AiMemoryBinTests: 4 failures against the 5f3a7c21 template, 0 now
Guard blocks every template credential store (also behind rtk) and passes the clients and search patterns local_integration, failing-first tests.test_secret_path_guard, including test_every_template_read_deny_has_a_blocked_bash_reader, which runs cat, head -n, tail -n and rtk read over 26 derived paths. Against the new suite, the guard at 3eeb5f7b fails 33 blocked cases, 66 rtk proxy, 33 keyring-exec and 40 template-deny subtests (guard-control-2.out); the repaired guard fails none. Of all 25,626 documented shell lines and code spans in the tracked Markdown outside evidence/, the repair newly blocks 15. Each is an example of a blocked form in this branch's own docs (documented-newly-blocked.out). The review round's control is guard-control.out: the guard at 08b84af3 failed 11 blocked cases, 204 rtk proxy subtests and 5 safe cases
On an RTK host, cat, head and tail -n of a Read-denied store reach Claude Code's rule check as rtk read upstream example or native operation (dry run) rtk hook check on rtk 0.50.0, in a probe project whose .claude/settings.json held the template's 86 deny rules (rtk-read-probe.out). It rewrote cat ~/.ssh/config, cat ~/.ssh/*, head -n 5 ~/.aws/credentials and tail -n 3 ~/.kube/config to rtk read ..., and grep token ~/.kube/config to rtk grep .... It returned "No rewrite" for a bare tail FILE, sed, tee and input redirections. The control git push --force origin HEAD returned "Denied by a permission rule"
Claude Code then checks the rules against rtk read ..., which it does not treat as a file command source_review hooks (updatedInput), permissions ("Wrappers", the Bash file commands), corroborated by the retained rtk ls observation in blueprints/convergence-practice/worker-recovery/README.md. Not exercised in a live session
Linux render unchanged except the intended keys local_integration render comparison of origin/main vs the template with adoption/hosts/example.json: hooks identical, 49 deny rules added, none removed
RTK leaves a denied push alone, rewrites a plain push, passes a typed rtk git push through upstream example or native operation rtk hook check on rtk 0.50.0, in a probe project whose .claude/settings.json held the six push denies. All five force-push forms returned "Denied by a permission rule". A plain and a --force-with-lease push came back as rtk git push .... rtk git push --force origin HEAD returned "No rewrite". Sources: src/hooks/decision.rs and src/hooks/permissions.rs at v0.50.0
Named spawns, teammate effort, scopes, memory, permissions, hook rewrites, timeouts source_review docs cited above, 2.1.283
Serena hook behaviour source_review src/serena/hooks.py @ c6fbd1c; installed serena-hooks --help
Opus builder/verifier quality not run re-qualification pending

Local commands run

At the final head 45568642 (worktree of this branch):

$ bash <scratch>/rec/validate.sh python3
ok: workflows sums+node, validate.py, host_receipts validate, release_due --strict-if-repinned origin/main, validate_catalogs,
    validate_foundation, landscape, audit_reports --check, validate_convergence --all-recorded, build_verdicts --check,
    component_matrix --check, new_host_grand_list --check, gap_crosswalk build --check, gap_wave_ledger --check,
    build_ecosystem --check, evidence_manifest --check
FAILS=0
$ python3 -m unittest <59 modules under tests/ that reference a changed file>
Ran 2906 tests in 356.760s
FAILED (failures=1, skipped=156)

The one failure is test_secret_path_guard.test_host_profile_copy_is_verbatim, and it is expected. This host's ~/.claude/hooks/secret_path_guard.py is the previous guard until install_claude_profile.py --only guard runs, which is a host step outside this unit. The test skips in CI.

$ uv run --no-project --with pyyaml python3 -m unittest tests.test_install_claude_profile
Ran 58 tests ... OK
$ cd examples/claude-native/workflows && sha256sum --check --strict SHA256SUMS && node test-envelope.mjs && node test-contract-mutations.mjs
SUMMARY passed=254 failed=0 total=254 / SUMMARY passed=74 failed=0 total=74
$ cd adoption/hooks/claude && sha256sum --check --strict SHA256SUMS
all OK

Decision record

  • docs/decisions/2026-09-27-claude-harness-settings.md: the decisions, evidence, alternatives (now 1-11), overturn conditions, open user decisions, and the cross-family review and independent verification sections.
  • Addendum 2026-09-27 to docs/decisions/2026-09-26-stack-agents-role-dispatch.md. It amends arm B before any run: an Opus builder and verifier, and no frontmatter isolation.

Needs follow-up (not in this PR)

  • Frozen PR-H: E2E preregistration for the token-save-practice stack (frozen tasks, metrics, gate, procedure) #381 preregistration (evidence/artifacts/token-adoption-e2e-20260926/): its B arm binds isolated-builder/stack-verifier stages to model: 'sonnet', and its runbook says "Keep isolation: worktree". Its own rule requires a merged amendment before launch; this PR does not edit the frozen protocol.
  • Foundation catalog (catalogs/foundation/decisions.json, decision lean-workflow-child-routing). Its activation text still routes "isolated-builder (Sonnet/max, own worktree)". This PR's builder is Opus in a coordinator-created checkout with no frontmatter isolation. The decision's source_paths include recipes/claude-native-ultracode.md and examples/claude-native/workflows/README.md, which this PR changed. Update it through the catalog's own tooling and validate_foundation in a foundation-lane follow-up. It is outside this unit's paths (independent verification, finding 5).
  • Host steps for the coordinator: apply the template keys (H1/H6/H8 as a partial template through apply_claude_settings.py), then install_claude_profile.py --only guard --only agents. After the guard install, sessions on this host also block Bash readers of the whole ~/.ssh, including config, known_hosts and *.pub.
  • Re-qualify isolated-builder and stack-verifier on Opus. Run the WorktreeCreate and named-spawn guard probes, and a Workflow-child SubagentStart probe.
  • User decisions left open:
    • the ~/.ssh carve-outs (U5), which would now change both the template and the guard;
    • the AGENTS.md trading paragraphs (U6);
    • auto mode (U8);
    • Codex interactive effort (U4);
    • the OmniRoute build, login and usage credential (U1-U3);
    • codex-plugin-cc on 2026-10-06 (U9);
    • the claude.ai connector (U10);
    • the Codex tmp trust entry (U11);
    • per-tool Codex MCP approvals (U7).
  • docs/token-efficiency-stack.md still carries Practice gaps #6 and #8: truthful skills-install message; agent teams are an allowed dispatch mode #388's dispatch sentence; another unit owns that file.
  • After the rebase onto Codex templates: OmniRoute gateway profile, verified base keys and the Codex-template token gaps #395, the Codex shell snapshots bullet in docs/secret-storage.md can add that Codex templates: OmniRoute gateway profile, verified base keys and the Codex-template token gaps #395's user template sets [features] shell_snapshot = false. The deny rules and the guard still cover snapshots written before that change, or by a lane that turns the feature on.
  • When a host adopts the template's git denies, take the six rtk git push forms with them. After each RTK upgrade, re-run both probes, each in a project whose settings hold the template's rules, then rtk hook check on each form. The push probe confirms RTK still leaves denied commands alone. The read probe checks whether RTK still rewrites cat of a Read-denied store. On this host's current settings, RTK 0.50.0 also leaves the template's other Bash denies alone: env, printenv, git credential fill and gh auth git-credential return "Denied by a permission rule". The token-print forms were not probed, because the guard blocks a probe that names them and blocks those commands itself.
  • git reset --hard and git clean -f have no rtk forms, so a hand-typed rtk git reset --hard passes the template's denies (recorded in the decision record's limitations).

Residuals

  • Bash(git clean -*f*) false positive (cross-family finding 5). A dry run on a path containing f is denied, and this is kept deliberately: narrower * rules would miss clusters such as -dfx, and a git token hook would have no upstream source. It is recorded as a limitation and as alternative 9.

  • Guard gaps, recorded and asserted in EXPECTED_PASS_THROUGH:

    • a relative read after cd;
    • a client that prints its own store (kubectl config view --raw, gpg --export-secret-keys);
    • a program that opens a store itself (sqlite3);
    • an archiver (tar czf k.tgz ~/.ssh);
    • a glob that names a store only after expansion (~/.n*rc);
    • a copy or search of an ancestor of a store (~/.config, and ~/.codex, which holds shell_snapshots);
    • a copy or search of a directory that holds an older store file (~/.claude, whose .credentials.json is blocked only by name);
    • an OmniRoute DATA_DIR elsewhere.

    Closing the ~/.claude and ~/.codex directory forms would also block common whole-directory searches in every session. They are outside this round's findings and are left to a decision.

  • Guard over-blocking, recorded and asserted in BLOCKED. scp -i KEY, rsync -e 'ssh -i KEY' and gpg --homedir ~/.gnupg are blocked, and so is cp -t DIR into a store directory.

  • No live permission evaluation. No Claude Code session evaluated the new rules. The RTK side is a dry run, and the Claude side is source review.

  • Host test. test_host_profile_copy_is_verbatim fails on this host until the coordinator installs the guard.

Checklist

  • No GitHub Actions changed.
  • No secrets printed, logged or committed, and no credential store was read. In the review round, the guard blocked three of this unit's own commands. Two were inline scripts, moved to script files. One was an rtk hook check probe that named a token command, and it was dropped. The guard was never bypassed. This round's RTK probe is a dry run (rtk hook check) that opens none of the files it names.
  • No paid surface introduced.
  • Peer-owned files and worktrees preserved; catalogs/foundation/ is left to its owner (follow-up above).

Cross-family review

One round was run, as required, from the worktree on the pre-repair head a22a042f. That head held commits 1-2 plus the first manifest re-registration; that commit was rebuilt as the last commit after the repairs. The reviewed patch is retained as review.diff (git diff origin/main...HEAD, 2,016 lines). The command:
~/.local/share/codex-ecosystem/bin/codex-omniroute exec --skip-git-repo-check -s read-only -o gpt6-review.md "<prompt>" </dev/null.

The events header records model: cx/gpt-6-astra, provider: omniroute, sandbox: read-only and reasoning effort: max. That effort is the client's request; what the gateway forwarded upstream was not observed. The run used 86,448 tokens and took 10 minutes 18 seconds. The prompt named the local copies of the cited upstream sources and carried no reasoning of this unit.

Verdict: DEFECTS FOUND, 9 findings. Seven held and were fixed. One held in part and was fixed for the part that held. One is kept as a recorded residual. There was no second round.

# Severity Finding Disposition
1 high The force-push denies miss rtk git push ..., the spelling RTK's hook produces Held in part, fixed. A first reproduction on this host, whose settings lack the rules, showed the rewrite. RTK 0.50.0's source and a probe with the rules in settings show that RTK does not rewrite a command a Bash(...) deny rule matches, so the typed forms stay denied. The six rtk git push denies still close a hand-typed rtk spelling and rules from sources RTK does not read. There is a failing-first matcher test, and the anti-pattern log records the flawed first reproduction
2 high The guard's new rule is bypassed by rtk/rtk proxy prefixes Fixed. Reproduced (rtk proxy cat .env also passed). Every rule now reads the command an rtk form runs, and every blocked case is re-tested behind rtk proxy
3 medium cp -t DIR SRC passes because the last operand was taken for the destination Fixed (cp(1) -t), with tests
4 medium Search patterns and dd's of= were taken for credential reads Fixed. A grep-family pattern is dropped only when plain flags precede it, and of= is a write. There are tests for both, and --include, -g, -e, -f and -A stay blocked
5 medium Bash(git clean -*f*) denies git clean -n foo Residual (see Residuals)
6 medium The verifier's timeout text is true only for foreground subagents Fixed in all three copies (tools reference, "Background commands")
7 medium The builder test passes when a refusal condition is removed Fixed. The conditions are asserted verbatim. Four new builder mutations, and the two table mutations of row 8, fail the suite; the pre-repair suite let all six through (68/74)
8 low The workflows README's agent table still says Sonnet for the builder and verifier Fixed, plus a new envelope check of that table with two mutations
9 low Agent-contract checks labelled local_integration Fixed: structural_validation in the decision record and this body

The raw review is units/claude/gpt6-review.md, the events are units/claude/gpt6-review.events.jsonl, and the reviewed diff is units/claude/review.diff.

Independent verification

An independent verifier checked the repaired head 3eeb5f7b and reported five defects. Each was checked against source before acting, and all five held and were fixed, finding 5 as a recorded follow-up. No further GPT-6 round was run.

# Severity Finding Disposition
1 high The docs said the credential-store Read denies also stop Bash cat/head/tail, and the RTK text said RTK leaves any deny-matched command alone. On hosts running rtk hook claude, neither holds, and the guard did not cover these stores Reproduced and fixed. A probe project holding the template's 86 deny rules returned rtk hook check 'cat ~/.ssh/config' → rtk read ~/.ssh/config; head -n and tail -n were rewritten too, and grep became rtk grep. The source matches: rtk rules.rs, registry.rs and permissions.rs (append_bash_rules). The guard now blocks a reader of every path the template's credential-store Read denies cover. The guard reads the command as written, and its deny wins (hooks precedence). A new template-derived test (26 rules × cat, head -n, tail -n, rtk read) exposed and closed nativestack/*.key as well. The RTK wording is narrowed to Bash(...) rules in docs/secret-storage.md, decision rows 5 and 6, the anti-pattern row and the profile test comment. There is a new dated anti-pattern row, and alternatives 10-11 record why the gap was not left documented and why RTK exclusions or per-reader Bash denies were rejected
2 medium Directory and glob operands of a store passed (cat ~/.ssh/*, cp -r ~/.ssh, grep -r BEGIN ~/.ssh, find ~/.aws -exec cat, rtk read ~/.aws/* ...) Fixed by the same rule, following the HF_HOME_ROOT precedent. It covers each store directory, a glob in it and the Docker home as a whole, and every listed form is now a BLOCKED case (also behind rtk proxy). ls, chmod, stat and ssh -i still pass. .pub, config and known_hosts follow the template's whole-~/.ssh deny, and a U5 carve-out would change both. Ancestors (~/.config, ~/.codex) and ~/.claude stay recorded gaps in both documented lists
3 low source-scout still said "The tool limit is 10 minutes" Fixed. stack-verifier's BASH_MAX_TIMEOUT_MS ceiling and background-command text is now in all three copies (byte-identical), and the envelope, mutation and profile suites pass
4 low Decision record line 90 named the wrong four mutations Fixed after reading mutations-control-old-envelope.out. The stop mutation was detected; the HEAD read and the three refusal conditions, and the two table rows, were not (68/74)
5 low catalogs/foundation/decisions.json lean-workflow-child-routing still routes isolated-builder (Sonnet/max, own worktree), and it was not in the follow-up list Recorded under Needs follow-up. The file is outside this unit's paths and has its own tooling

Receipts, all in units/claude/: rtk_read_probe.py and rtk-read-probe.out, guard_control2.py and guard-control-2.out, tests-all-5.out, and validate-sh-5.out.

🤖 Generated with Claude Code

@seathatflowsinourveins seathatflowsinourveins added the lane:foundation Foundation lane: Claude/Codex setup, hosts, memory, RAG, research, workers label Sep 27, 2026
Scout and others added 4 commits September 27, 2026 09:43
Scout @claude
Claude settings template: credential-store and destructive-git denies…
5841299 
…, docs-agent deny, 30-minute Bash ceiling, status-line refresh; ai-memory hook binary rendered from the platform pin

Settings synthesis PR-A (rows A1, A2, A3, A6, B1, C4, C6 and H4's deny rule) and
token gap ai-memory#2. The model-fallback guards (H1) were already in the
template; they are now asserted by a test in the next commit.

- adoption/templates/claude.settings.template.json: Read denies for ~/.ssh,
  ~/.gnupg, ~/.aws, ~/.azure, ~/.kube, ~/.docker/config.json,
  ~/.git-credentials, ~/.netrc, ~/.npmrc, ~/.pypirc, OmniRoute's data
  directories (~/.omniroute, ~/.config/omniroute and the two Windows
  defaults under WSL2's /mnt) and ~/.codex/shell_snapshots, each with its
  Context Mode **/ twin; Edit(~/.bashrc|.profile|.zshrc);
  Agent(claude-code-guide) (Haiku); nine destructive-git denies that leave
  --force-with-lease runnable; BASH_MAX_TIMEOUT_MS=1800000;
  statusLine.refreshInterval 5. The eight ai-memory hook commands run
  ${AI_MEMORY_BIN}.
- .claude/settings.json: the same home credential-store denies and twins.
- scripts/hooks/secret_path_guard.py: a reader, copy or search of a home
  credential file (an SSH private key but not its .pub) or of a Codex
  shell_snapshots file is credential_file_read; clients that use a key or a
  store, listings and chmod still pass. SHA256SUMS re-pinned.
- tools/adoption/render_config.py: AI_MEMORY_BIN defaults to
  ${ECO_ROOT}/tools/ai-memory-<version>/ai-memory from
  adoption/pins-<os>-<arch>.json (--platform, default this machine), or a
  host-supplied binary; a platform without a pins file fails closed. On
  Linux the rendered hooks are byte-identical to before; macOS renders
  2.3.2.
- Docs: secret-storage "Home and tool credential stores", the macOS note and
  pin note, the bootstrap render step, two appended anti-pattern cells.

Sources: code.claude.com/docs/en/permissions, permission-modes, sub-agents,
env-vars, tools-reference, statusline (read 2026-09-27, Claude Code
2.1.283); trailofbits/claude-code-config@2109be9 settings.json;
jarrodwatts/claude-hud v0.8.0 README; cheaper-inference/OmniRoute@a58000c7
src/lib/dataPaths.ts; openai/codex rust-v0.157.1
shell-command/src/shell_snapshot_exports.rs; akitaonrails/ai-memory v2.4.1
docs/install.md.

Tests: test_secret_path_guard (blocked, allowed and recorded-gap cases),
test_render_config.AiMemoryBinTests (four failures against the previous
template, none now), test_apply_claude_settings (status-line merge).

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Scout @claude
Role agents on Opus without frontmatter isolation, project-scope copi…
922a0eb 
…es, and portable dispatch rules for named spawns and teammates

Settings synthesis PR-C (F1, F2, orchestration 4, 5, 6, 11, C4) and PR-D
(orchestration 1, 7, 8, 9, 10, 19; F3 rule text, F4, G1; the Codex depth
statement), plus token gaps serena#2 and codebase-memory-mcp#2 on the
Claude side.

- isolated-builder and stack-verifier declare model: opus (the user's rule:
  Opus at effort max for build and verification). isolated-builder drops
  isolation: worktree and edits only in the owned checkout its brief names,
  refusing the coordinator's own checkout (git rev-parse --show-toplevel
  compared with its starting directory's). stack-verifier's timeout text
  follows BASH_MAX_TIMEOUT_MS.
- .claude/agents/ holds byte-identical copies of the ten installed
  definitions (project scope outranks user scope).
- test-envelope.mjs: no agent declares frontmatter isolation, and an agent
  that can edit files carries the own-checkout refusal; three new mutations
  fail the suite. SHA256SUMS re-pinned. Role tables say Opus.
- tests/test_install_claude_profile.py: third copy byte identity, no memory
  on read-only roles (failing-first control), the template settings of the
  previous commit, and a re-baselined word budget for the portable
  instructions (1,205 words; the user's four dispatch modes did not fit 925).
- examples/claude-native/CLAUDE.md: the four dispatch modes and the
  named-spawn rule (a named spawn becomes a teammate at the lead's effort,
  without its definition's skills or isolation; per-run opt-out).
- recipes: dispatch facts, verification patterns (a)-(h), prefix sharing,
  teammate effort, the headless cross-family review form and the Codex V2
  depth note; the workflows README gains a brief contract and keeps lane
  text in saved-workflow packets until a Workflow child is observed with the
  SubagentStart block.
- docs/decisions/2026-09-27-claude-harness-settings.md, and a dated addendum
  to the 2026-09-26 role-dispatch record (arm B amended before any run).
  Serena's alpha hooks are not adopted (remind denies reads roles without
  Serena cannot replace; activate conflicts with the single-project context);
  codebase-memory-mcp stays a manual per-host registration.

Sources: code.claude.com/docs/en/sub-agents ("Subagent names", scopes,
memory), agent-teams, workflows, hooks, best-practices (2.1.283);
Anthropic "multi-agent research system"; anthropics/claude-code@7779afb
plugins/code-review/commands/code-review.md; arXiv:2512.08296 v3;
oraios/serena@c6fbd1c src/serena/hooks.py; openai/codex rust-v0.157.1
config/src/config_toml.rs L719-720; git-rev-parse(1).

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Scout @claude
Cross-family review repairs: rtk-spelled push denies, rtk-aware guard…
aa61bac 
…, verifier timeout text, builder refusal checks

One read-only GPT-6 review round (cx/gpt-6-astra through the OmniRoute
profile, client effort max) returned nine findings on this branch. Each
was checked against source before acting: seven held and are fixed, one
held in part and one is kept as a recorded limitation.

- Template, partly held: the six force-push denies again as
  `rtk git push ...`. The finding said no push deny matches RTK's rewrite;
  RTK 0.50.0 does not rewrite a command that a deny rule of the project or
  user settings files matches (src/hooks/decision.rs "Deny wins outright";
  a probe project holding the rules got "Denied by a permission rule" for
  all five forms), so a typed `git push --force` stays denied. A
  hand-typed `rtk git push --force` passes through RTK unchanged, and a
  rule from a source RTK does not read (managed settings, --settings) sees
  only the rewrite; the rtk forms cover both.
  test_the_push_denies_also_match_the_rtk_rewrite fails all five rtk
  spellings on the old template.
- Guard: every rule reads the command an `rtk` invocation runs (proxy,
  summary, err, test; run via sh -c; read, smart, json and log as readers;
  other subcommands as the program of that name, per `rtk --help`);
  `cp -t DIR` makes every other operand a source (cp(1)); dd's `of=` is a
  write (dd(1)); a grep-family search's own pattern is not taken for a
  credential file when only plain flags precede it (grep(1), rg(1)), and
  anything else keeps every argument. The home-credential cases move into
  BLOCKED, so the keyring and the new rtk-proxy tests cover them. Against
  the guard at 08b84af3 the suite fails 11 blocked cases, 204 rtk-proxy
  subtests and 5 safe cases; none now. SHA256SUMS re-pinned.
- stack-verifier (three copies): a timed-out command stops at the final
  response only in a foreground subagent and keeps running in a background
  one (tools reference, "Background commands"; sub-agents: background is
  the default); report it as not run and still running.
- test-envelope.mjs asserts each builder refusal condition verbatim and
  the workflows README's agent table; four builder and two table mutations
  (74 in all) went unnoticed by the old suite (68 of 74) and fail now.
  The README's builder and verifier rows say Opus.
- Decision record: agent-contract checks are structural validation
  (docs/acceptance-evidence-policy.md), the rtk probe, a cross-family
  review section, alternatives 8-9, and limitations incl. the kept
  `git clean -*f*` false positive. Secret storage, and a harness-defaults
  anti-pattern row for reproducing a hook decision with settings the
  deployed host will not have.

Sources: code.claude.com/docs/en/hooks (parallel hooks, PreToolUse
updatedInput), permissions (wildcard patterns, wrappers), tools-reference
(background commands), sub-agents (foreground/background), read 2026-09-27
for 2.1.283; rtk-ai/rtk v0.50.0 (1d87b8e7) src/hooks/decision.rs and
src/hooks/permissions.rs, `rtk --help` and `rtk hook check`; GNU grep(1),
rg(1), coreutils cp(1), dd(1); docs/acceptance-evidence-policy.md.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Scout @claude
Independent verification repairs: guard covers every template credent…
88af2ba 
…ial store, RTK scope narrowed, scout timeout text

An independent verifier checked 3eeb5f7b and reported five defects; all held.

1. The credential-store Read denies do not stop Bash readers on a host that
   runs `rtk hook claude`, which the template registers: rtk 0.50.0 rewrites
   `cat`, `head` and `tail -n` to `rtk read` (src/discover/rules.rs), Claude
   Code evaluates its rules against the returned input (hooks, PreToolUse
   `updatedInput`), and RTK's own deny gate loads only Bash(...) rules
   (src/hooks/permissions.rs, append_bash_rules). A dry run in a probe
   project holding the template's 86 deny rules showed
   `rtk hook check 'cat ~/.ssh/config'` -> `rtk read ~/.ssh/config`.
   The guard, which reads the command as written and whose deny wins, now
   blocks a reader, copy or search of every path the template's
   credential-store Read denies cover (HOME_CREDENTIAL_STORE), including any
   nativestack/*.key, which the new test exposed. That test derives cat,
   head -n, tail -n and rtk read of a path under every anchored template
   Read deny and expects a block. secret-storage.md, the decision record (row 5, row 6, evidence,
   alternatives 10-11, limitations, overturn) and the anti-pattern log row
   narrow the RTK statements to Bash(...) rules; a new dated log row records
   the mistake.
2. Directory and glob operands of a store passed (`cat ~/.ssh/*`,
   `cp -r ~/.ssh`, `grep -r BEGIN ~/.ssh`, `find ~/.aws -exec cat`): the
   same rule covers each store directory, a glob in it and the Docker home
   as a whole (the HF_HOME_ROOT precedent). `.pub`, `config` and
   `known_hosts` follow the template's whole-~/.ssh deny. Ancestors and
   directories that hold older store files stay recorded gaps.
3. source-scout still said the tool limit is 10 minutes; it now carries
   stack-verifier's BASH_MAX_TIMEOUT_MS ceiling and background-command text
   (env-vars; tools reference, "Background commands"), all three copies.
4. The builder-mutation evidence row named the wrong four mutations.
5. The foundation catalog's lean-workflow-child-routing text is recorded as
   a follow-up (outside this unit's paths).

Failing-first: the guard at 3eeb5f7b fails 33 blocked cases, 66 rtk proxy,
33 keyring-exec and 40 template-deny subtests of the new suite; the
repaired guard none. `scp -i KEY`, `rsync -e 'ssh -i KEY'` and
`gpg --homedir ~/.gnupg` are recorded as over-blocking in BLOCKED.
adoption/hooks/claude/SHA256SUMS re-pinned.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
@seathatflowsinourveins
seathatflowsinourveins force-pushed the claude/claude-harness-settings-20260927 branch from 5a32ea4 to 88af2ba Compare September 27, 2026 13:44
@seathatflowsinourveins
seathatflowsinourveins merged commit d022295 into main Sep 27, 2026
24 checks passed
@seathatflowsinourveins
seathatflowsinourveins deleted the claude/claude-harness-settings-20260927 branch September 27, 2026 14:04
seathatflowsinourveins pushed a commit that referenced this pull request Sep 27, 2026
Scout @claude
Merge origin/main (#401, #402) into claude/sweep-worker-agent-20260927
fbd0bad 
manifests/evidence.json follows the hot-file protocol: main's copy, with
this branch's files re-registered. #402 made .claude/agents/ a byte-for-byte
project-scope copy of adoption/agents/claude/ (test_project_scope_agents_are_
the_installed_definitions), so landscape-sweep-worker.md gets its project
copy. It is force-added and not hash-listed, like the other ten.
Tests: test_install_claude_profile, test_token_lanes_subagent_start,
test_adoption_docs_consistency, test_verdict_lane_vendoring,
test_saturation_ledger, test_landscape_sweep_harness: 287 run, OK
(7 skipped). validate.py passed.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_012qwXNtFyUhY5x2dtrm7tG5
seathatflowsinourveins added a commit that referenced this pull request Sep 27, 2026
@seathatflowsinourveins @claude
Landscape sweep: Opus judgment workers without WebFetch (context-mode…
5483412 
… fetches, skills kept); repository check ignores Codex's empty .git mount targets (#398)

The landscape sweep's Claude judgment stages (discover in both rounds,
refute-facts, refute-fit, critic) run as a new agent type,
adoption/agents/claude/landscape-sweep-worker.md: Opus, effort max,
disallowedTools WebFetch, and no tools list, so it inherits Skill and
context-mode's ctx_* tools. Pages are fetched with ctx_fetch_and_index and
read with ctx_search, and the worker prompts never mention WebFetch.
- refute-facts moves from Sonnet to Opus (the user's model rule).
- The GPT-6 wrappers stay Sonnet with the default type.
- The project-scope copy in .claude/agents/ is byte-identical (#402's rule).

Also: inside_repository() in sweep_common.py and codex_job.py treats a
repository marker as a .git directory holding HEAD (a file, or a symlink
to an unborn branch), or a non-empty .git file. Codex's Linux sandbox
creates empty .git mount targets under its writable roots, /tmp included
(bwrap.rs SyntheticMountTarget at rust-v0.157.1), and those had made
work directories under /tmp fail at random.

Evidence:
- smoke 3 (wf_c7bc3ee8-c16): WebFetch 0 and ctx_fetch_and_index 3 of 3
  across the Claude agents (smoke 2 had 15 WebFetch, 0 ctx_fetch_and_index);
  skills reported for every role; GPT-6 ok 2/2; copy check 2/2;
- GPT-6 review: one medium (an unborn-HEAD symlink) and one low (critic
  schema), both fixed with a red control.
Tests: 287 run, OK. validate.py passed.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_012qwXNtFyUhY5x2dtrm7tG5
This was referenced Sep 27, 2026
Merged
Merged
Merged
Merged
seathatflowsinourveins pushed a commit that referenced this pull request Sep 27, 2026
Scout @claude
PR-H Amendment 2 (2026-09-27): adopt the #402 role bodies before exec…
e143118 
…ution

The token-practice E2E preregistration (#381, merged as c7b7885) has not
executed: no organic run, capability probe or Workflow of it has run. #402
(d022295) moved stack-verifier and isolated-builder to Opus and removed the
builder's frontmatter isolation. Every Workflow stage passes an explicit
model, which outranks the definition's model, so the frozen protocol has to
change for the run to change. This follows the preregistration's own
amendment rule and Amendment 1's convention.

- preregistration.json: the six Claude stack-verifier tasks and the two
  isolated-builder tasks move from sonnet to opus (effort stays max);
  builder_worktree_policy keeps its eight Repair 1 fields and adds the
  prepared-path brief binding, the observed-tree-equals-prepared-path check
  and the retained hooks and sentinel checks. Codex tasks, source-scout and
  the blocked loopback slot are unchanged.
- token-e2e-run.mjs: role map on Opus for both roles; the builder comment
  follows #402. No logic change.
- RUNBOOK.md: the builder section follows the #402 role (prepared path in
  every arm's brief, observed edit tree must be that path, hooks
  preflight/restore and per-tree sentinels kept, the base-refusal boundary
  marked [nv]); the freeze section records the project- and user-scope
  definitions and requires byte identity with adoption/agents/claude at the
  execution HEAD.
- README.md: role table models and #402 carriers, the builder paragraph,
  a pointer under Sealing, and the append-only Amendment 2 section with its
  change table, merge chronology and seal. The Repair 1 seal table and
  Amendment 1 are preserved.
- tests/test_token_e2e_preregistration.py: five new and two extended
  tests; against the unamended artifacts they fail (27 tests,
  FAILED (failures=42)); they pass on the amended artifacts.
- manifests/evidence.json: the five changed files re-registered with
  scripts/host_receipts.py register_file.

Tasks, task text, eligibility, lanes, thresholds, exceptions, checks and
arm order are unchanged.

Sources: adoption/agents/claude/{isolated-builder,stack-verifier,source-scout}.md
at d022295; docs/decisions/2026-09-26-stack-agents-role-dispatch.md
(addendum 2026-09-27) and docs/decisions/2026-09-27-claude-harness-settings.md;
code.claude.com/docs/en/sub-agents (scope priority, starting directory,
isolation, model resolution order; read 2026-09-27); the preregistration's
Sealing section and retrieval-quality-v2's amendment convention;
docs/lanes.md hot-file protocol.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
@seathatflowsinourveins seathatflowsinourveins mentioned this pull request Sep 27, 2026
Merged
seathatflowsinourveins added a commit that referenced this pull request Sep 27, 2026
@seathatflowsinourveins Scout @claude
PR-H (#381) Amendment 2: adopt the #402 role bodies before execution …
27bf310 
…(Opus verifier and builder, builder base binding) (#413)

* PR-H Amendment 2 (2026-09-27): adopt the #402 role bodies before execution

The token-practice E2E preregistration (#381, merged as c7b7885) has not
executed: no organic run, capability probe or Workflow of it has run. #402
(d022295) moved stack-verifier and isolated-builder to Opus and removed the
builder's frontmatter isolation. Every Workflow stage passes an explicit
model, which outranks the definition's model, so the frozen protocol has to
change for the run to change. This follows the preregistration's own
amendment rule and Amendment 1's convention.

- preregistration.json: the six Claude stack-verifier tasks and the two
  isolated-builder tasks move from sonnet to opus (effort stays max);
  builder_worktree_policy keeps its eight Repair 1 fields and adds the
  prepared-path brief binding, the observed-tree-equals-prepared-path check
  and the retained hooks and sentinel checks. Codex tasks, source-scout and
  the blocked loopback slot are unchanged.
- token-e2e-run.mjs: role map on Opus for both roles; the builder comment
  follows #402. No logic change.
- RUNBOOK.md: the builder section follows the #402 role (prepared path in
  every arm's brief, observed edit tree must be that path, hooks
  preflight/restore and per-tree sentinels kept, the base-refusal boundary
  marked [nv]); the freeze section records the project- and user-scope
  definitions and requires byte identity with adoption/agents/claude at the
  execution HEAD.
- README.md: role table models and #402 carriers, the builder paragraph,
  a pointer under Sealing, and the append-only Amendment 2 section with its
  change table, merge chronology and seal. The Repair 1 seal table and
  Amendment 1 are preserved.
- tests/test_token_e2e_preregistration.py: five new and two extended
  tests; against the unamended artifacts they fail (27 tests,
  FAILED (failures=42)); they pass on the amended artifacts.
- manifests/evidence.json: the five changed files re-registered with
  scripts/host_receipts.py register_file.

Tasks, task text, eligibility, lanes, thresholds, exceptions, checks and
arm order are unchanged.

Sources: adoption/agents/claude/{isolated-builder,stack-verifier,source-scout}.md
at d022295; docs/decisions/2026-09-26-stack-agents-role-dispatch.md
(addendum 2026-09-27) and docs/decisions/2026-09-27-claude-harness-settings.md;
code.claude.com/docs/en/sub-agents (scope priority, starting directory,
isolation, model resolution order; read 2026-09-27); the preregistration's
Sealing section and retrieval-quality-v2's amendment convention;
docs/lanes.md hot-file protocol.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* PR-H Amendment 2 repair round (2026-09-27): builder base binding, pinned role bodies, probe shape

Single repair round after the GPT-6 cross-family and evidence-reviewer reviews,
before merge and before any capability probe or organic run.

- Finding 1 (HIGH): both builder task texts add the frozen <assigned-base>
  placeholder after <assigned-worktree>, because isolated-builder.md:12 at
  d022295 stops when HEAD is not the brief's base. A new frozen binding,
  worktree_bases, is recorded privately before probes. The runner requires a
  40-hex value for every worktree_required task, requires and binds the
  placeholder in the builder briefs, and refuses to start when a value is
  missing, malformed or unbound. builder_worktree_policy adds base_binding.
  This is a pre-execution input binding and changes no eligibility, lane,
  threshold or check.
- Finding 2 (LOW): README records the d022295 SHA256 of the five role
  bodies, and the RUNBOOK freeze requires every executed copy to equal them.
- Finding 3 (LOW): the B-route isolated-builder capability probe must use
  exactly the frozen brief shape (prepared path plus <assigned-base>).
- Integration: rebased onto origin/main f68d13c; manifests/evidence.json
  taken from main and re-registered with host_receipts.register_file.
- Tests: six new and one extended. Pre-repair: exit 1 (33 tests,
  failures=52). Repaired: exit 0. Amendment 2 seal recomputed.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

---------

Co-authored-by: Scout <scout@local>
Co-authored-by: Claude Opus 5.5 (1M context) <[email protected]>
seathatflowsinourveins pushed a commit that referenced this pull request Sep 28, 2026
Scout @claude
Decision records: keep the manifest prune rule, name confounds and ov…
b04cb40 
…erturn variables

Repair round for the verification-line addendum and the skills-trial
carrier-condition addendum (findings V-F1, R-F1, R-F3, R-F4, R-F5, R-F6,
R-F7, GAP-3, GAP-6, GAP-7).

Skills-trial addendum:
- The review no longer "replaces" the count-based prune rule. It adds a
  with/without comparison that varies the builder's preload for the
  skill's Claude listing; trial.prune_rule (adoption/skills/manifest.json
  L30) and tools/skill-usage/skill_usage.py L516-538 still apply, and
  Codex enablement stays under that rule. A disagreement is written into
  the manifest update the trial window end already requires.
- Other sources and role changes: the landscape-sweep templates name both
  skills from 1b0e459 (templates.json common; build_args.py L59
  TEMPLATE_SKILLS), for the Claude workers and the GPT-6 lane; the C0
  baseline counts (child-lane baseline README L128-130) match that list
  without proving cause; #398 (5483412) and #402 (d022295) change the
  sweep workers' type and model and the builder's model inside C1.
- Boundaries: the installer writes no install record (shutil.copy2 at
  install_claude_profile.py L113, L143 keeps the source mtime), and #381
  step 2 freezes hashes, not install times.

Verification-line addendum:
- The builder runs model: opus, which is Opus 5.5 on this host since
  September 22 (grand-catalog-handbook.md L242-244), so the Opus 5 advice
  reaches it through the 5.5 guide's L9; before #402 it ran sonnet.
- #381 records hashes, not an install time; a Supersedes note corrects
  the qmd addendum's L389 wording the same way.
- Overturn names what each comparison varies: default-block line 13, a
  non-Opus child set, the builder line with the preload held on, or a
  prompting-guide reversal.
- Line 13's quote, the local file:line policy, the re-read of every
  documentation quote at its cited line (2026-09-28 08:55Z), the
  installed SKILL.md hash check and the control's own returned lines.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
seathatflowsinourveins pushed a commit that referenced this pull request Sep 28, 2026
Scout @claude
Decision records: keep the manifest prune rule, name confounds and ov…
8937b06 
…erturn variables

Repair round for the verification-line addendum and the skills-trial
carrier-condition addendum (findings V-F1, R-F1, R-F3, R-F4, R-F5, R-F6,
R-F7, GAP-3, GAP-6, GAP-7).

Skills-trial addendum:
- The review no longer "replaces" the count-based prune rule. It adds a
  with/without comparison that varies the builder's preload for the
  skill's Claude listing; trial.prune_rule (adoption/skills/manifest.json
  L30) and tools/skill-usage/skill_usage.py L516-538 still apply, and
  Codex enablement stays under that rule. A disagreement is written into
  the manifest update the trial window end already requires.
- Other sources and role changes: the landscape-sweep templates name both
  skills from 1b0e459 (templates.json common; build_args.py L59
  TEMPLATE_SKILLS), for the Claude workers and the GPT-6 lane; the C0
  baseline counts (child-lane baseline README L128-130) match that list
  without proving cause; #398 (5483412) and #402 (d022295) change the
  sweep workers' type and model and the builder's model inside C1.
- Boundaries: the installer writes no install record (shutil.copy2 at
  install_claude_profile.py L113, L143 keeps the source mtime), and #381
  step 2 freezes hashes, not install times.

Verification-line addendum:
- The builder runs model: opus, which is Opus 5.5 on this host since
  September 22 (grand-catalog-handbook.md L242-244), so the Opus 5 advice
  reaches it through the 5.5 guide's L9; before #402 it ran sonnet.
- #381 records hashes, not an install time; a Supersedes note corrects
  the qmd addendum's L389 wording the same way.
- Overturn names what each comparison varies: default-block line 13, a
  non-Opus child set, the builder line with the preload held on, or a
  prompting-guide reversal.
- Line 13's quote, the local file:line policy, the re-read of every
  documentation quote at its cited line (2026-09-28 08:55Z), the
  installed SKILL.md hash check and the control's own returned lines.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
seathatflowsinourveins pushed a commit that referenced this pull request Sep 28, 2026
Scout @claude
Decision records: keep the manifest prune rule, name confounds and ov…
e6b18db 
…erturn variables

Repair round for the verification-line addendum and the skills-trial
carrier-condition addendum (findings V-F1, R-F1, R-F3, R-F4, R-F5, R-F6,
R-F7, GAP-3, GAP-6, GAP-7).

Skills-trial addendum:
- The review no longer "replaces" the count-based prune rule. It adds a
  with/without comparison that varies the builder's preload for the
  skill's Claude listing; trial.prune_rule (adoption/skills/manifest.json
  L30) and tools/skill-usage/skill_usage.py L516-538 still apply, and
  Codex enablement stays under that rule. A disagreement is written into
  the manifest update the trial window end already requires.
- Other sources and role changes: the landscape-sweep templates name both
  skills from 1b0e459 (templates.json common; build_args.py L59
  TEMPLATE_SKILLS), for the Claude workers and the GPT-6 lane; the C0
  baseline counts (child-lane baseline README L128-130) match that list
  without proving cause; #398 (5483412) and #402 (d022295) change the
  sweep workers' type and model and the builder's model inside C1.
- Boundaries: the installer writes no install record (shutil.copy2 at
  install_claude_profile.py L113, L143 keeps the source mtime), and #381
  step 2 freezes hashes, not install times.

Verification-line addendum:
- The builder runs model: opus, which is Opus 5.5 on this host since
  September 22 (grand-catalog-handbook.md L242-244), so the Opus 5 advice
  reaches it through the 5.5 guide's L9; before #402 it ran sonnet.
- #381 records hashes, not an install time; a Supersedes note corrects
  the qmd addendum's L389 wording the same way.
- Overturn names what each comparison varies: default-block line 13, a
  non-Opus child set, the builder line with the preload held on, or a
  prompting-guide reversal.
- Line 13's quote, the local file:line policy, the re-read of every
  documentation quote at its cited line (2026-09-28 08:55Z), the
  installed SKILL.md hash check and the control's own returned lines.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
seathatflowsinourveins pushed a commit that referenced this pull request Sep 28, 2026
Scout @claude
Decision records: keep the manifest prune rule, name confounds and ov…
c9ef162 
…erturn variables

Repair round for the verification-line addendum and the skills-trial
carrier-condition addendum (findings V-F1, R-F1, R-F3, R-F4, R-F5, R-F6,
R-F7, GAP-3, GAP-6, GAP-7).

Skills-trial addendum:
- The review no longer "replaces" the count-based prune rule. It adds a
  with/without comparison that varies the builder's preload for the
  skill's Claude listing; trial.prune_rule (adoption/skills/manifest.json
  L30) and tools/skill-usage/skill_usage.py L516-538 still apply, and
  Codex enablement stays under that rule. A disagreement is written into
  the manifest update the trial window end already requires.
- Other sources and role changes: the landscape-sweep templates name both
  skills from 1b0e459 (templates.json common; build_args.py L59
  TEMPLATE_SKILLS), for the Claude workers and the GPT-6 lane; the C0
  baseline counts (child-lane baseline README L128-130) match that list
  without proving cause; #398 (5483412) and #402 (d022295) change the
  sweep workers' type and model and the builder's model inside C1.
- Boundaries: the installer writes no install record (shutil.copy2 at
  install_claude_profile.py L113, L143 keeps the source mtime), and #381
  step 2 freezes hashes, not install times.

Verification-line addendum:
- The builder runs model: opus, which is Opus 5.5 on this host since
  September 22 (grand-catalog-handbook.md L242-244), so the Opus 5 advice
  reaches it through the 5.5 guide's L9; before #402 it ran sonnet.
- #381 records hashes, not an install time; a Supersedes note corrects
  the qmd addendum's L389 wording the same way.
- Overturn names what each comparison varies: default-block line 13, a
  non-Opus child set, the builder line with the preload held on, or a
  prompting-guide reversal.
- Line 13's quote, the local file:line policy, the re-read of every
  documentation quote at its cited line (2026-09-28 08:55Z), the
  installed SKILL.md hash check and the control's own returned lines.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
seathatflowsinourveins added a commit that referenced this pull request Sep 28, 2026
@seathatflowsinourveins Scout @claude
Token-lanes carrier: evidence sentence replaces the verification-skil…
85a604a 
…l line (AN-15, after #447) (#456)

* Token-lanes carrier: evidence line replaces the verification-skill instruction

Default block line 13 now asks for evidence (the command and what it
returned, or the file:line read) and keeps the search-first sentence:
4,094 -> 4,088 bytes against the unchanged 4,100-byte bound (AN-15).
The builder block drops its verification sentence (2,883 -> 2,747
bytes): isolated-builder.md:7-9 preloads the skill and :12 names it.

Sources: code.claude.com/docs/en/best-practices.md L52 (show evidence);
platform.claude.com prompting-claude-opus-5.md L61, L81 (remove explicit
verification instructions), prompting-claude-opus-5-5.md L9 (carried
forward), claude-prompting-best-practices.md L780 (Opus 5 exception).

Handbook mirror: carrier line, its sources paragraph naming only
search-first, and the builder table row and variant. Tests: the default
key phrase becomes "Show evidence before a success claim", the builder
drops the skill phrase, and no block may name the withdrawn skill.
SHA256SUMS refreshed for both blocks. No installer run.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* Decision records: verification-line addendum and skills-trial carrier conditions

Token-lanes decision, addendum 2026-09-28: why the default carrier line
now asks only for evidence (Opus 5 guide L61, L81; Opus 5.5 guide L9;
prompting best practices L780; Claude Code best practices L52), why the
builder line is removed on its own merits (isolated-builder.md L5, L7-9,
L12; sub-agents reference L600), sizes, the failing-first control, the
non-Opus boundary, alternatives, #381 freeze and overturn.

Skills-trial record, addendum 2026-09-28: condition log C0-C3 (#378,
2026-10-25 review rule for verification-before-completion: a
with/without comparison on frozen builder tasks through an upstream
harness named with its pin (tokens, elapsed time, review-found defects).

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* Decision records: date the builder preload boundary; drop an unretained count

Skills-trial condition log: isolated-builder's verification-before-completion
preload and the body line that names it came from #376 (623d34f,
2026-09-27T03:38:47Z per TZ=UTC git log -S on
adoption/agents/claude/isolated-builder.md), a boundary inside C0, not a
constant across every condition. The one recorded install time is
attributed as measured-gaps.md reports it (the coordinator's local
measurement), without naming a host. Token-lanes addendum: the community
alternative keeps superpowers as the verifiable example and drops a survey
count that is not retained in the repository.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* Token-lanes carrier: tag the evidence sentence's upstream item; narrow the no-verification claim

Repair round for the verification-line change (review findings R-F2, R-F7).

- token-lanes-block.md line 13 moves "(code.claude.com best practices)" to
  follow "the command and what it returned", the item Claude Code best
  practices L52 names (https://code.claude.com/docs/en/best-practices.md,
  re-read 2026-09-28). The file:line alternative is local policy, not in
  L52. Zero-byte reorder: the block stays 4,088 bytes and line 13 295.
- SHA256SUMS lists the new block hash; `sha256sum -c SHA256SUMS` passes.
- Handbook: the mirrored line follows, and the sources paragraph records
  the file:line alternative as local policy. It now says the carrier gives
  no instruction to verify finished work and names no verification skill,
  since the codebase-memory line still checks caller lists (handbook L264).
- Test comment: WITHDRAWN_PHRASES is a literal skill-name check, not a
  check for every verification wording.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* Decision records: keep the manifest prune rule, name confounds and overturn variables

Repair round for the verification-line addendum and the skills-trial
carrier-condition addendum (findings V-F1, R-F1, R-F3, R-F4, R-F5, R-F6,
R-F7, GAP-3, GAP-6, GAP-7).

Skills-trial addendum:
- The review no longer "replaces" the count-based prune rule. It adds a
  with/without comparison that varies the builder's preload for the
  skill's Claude listing; trial.prune_rule (adoption/skills/manifest.json
  L30) and tools/skill-usage/skill_usage.py L516-538 still apply, and
  Codex enablement stays under that rule. A disagreement is written into
  the manifest update the trial window end already requires.
- Other sources and role changes: the landscape-sweep templates name both
  skills from 1b0e459 (templates.json common; build_args.py L59
  TEMPLATE_SKILLS), for the Claude workers and the GPT-6 lane; the C0
  baseline counts (child-lane baseline README L128-130) match that list
  without proving cause; #398 (5483412) and #402 (d022295) change the
  sweep workers' type and model and the builder's model inside C1.
- Boundaries: the installer writes no install record (shutil.copy2 at
  install_claude_profile.py L113, L143 keeps the source mtime), and #381
  step 2 freezes hashes, not install times.

Verification-line addendum:
- The builder runs model: opus, which is Opus 5.5 on this host since
  September 22 (grand-catalog-handbook.md L242-244), so the Opus 5 advice
  reaches it through the 5.5 guide's L9; before #402 it ran sonnet.
- #381 records hashes, not an install time; a Supersedes note corrects
  the qmd addendum's L389 wording the same way.
- Overturn names what each comparison varies: default-block line 13, a
  non-Opus child set, the builder line with the preload held on, or a
  prompting-guide reversal.
- Line 13's quote, the local file:line policy, the re-read of every
  documentation quote at its cited line (2026-09-28 08:55Z), the
  installed SKILL.md hash check and the control's own returned lines.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* Token-lanes record: the no-command-output case needs neither Bash nor ctx_execute

security-reviewer has no Bash but runs commands through Context Mode's
ctx_execute (Codex review), so the rationale is qualified to children with no
command runner.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* Evidence manifest: re-register this change's files

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

---------

Co-authored-by: Scout <scout@local>
Co-authored-by: Claude Opus 5.5 (1M context) <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

lane:foundation Foundation lane: Claude/Codex setup, hosts, memory, RAG, research, workers

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@seathatflowsinourveins