fix: prevent landscape workers deleting shared scratch - #987

Scope

Landscape judgment workers could wildcard-delete another worker's shared scratch files. This change gives landscape-sweep-worker a native read-only tool allowlist and assigns scratch preparation/cleanup to the existing coordinator and command-only wrappers. Public GitHub GET/index/search replaces shell research in that role.

Native Skill is also excluded: a measured 2.1.296 fixture showed dynamic skill context could delete a foreign file with Bash absent. Workers read and apply installed SKILL.md research instructions; future templates, routing text and prompt digest contracts follow that route. The SubagentStart and SessionStart token-lanes hooks supply no carrier to this role because its body already provides the applicable guidance. This prevents the default carrier from directing the restricted worker to ungranted tools.

• Base commit: 9d4c00cd05d79b3fd5074df2e46bacab87ee67ff.
• Current head: 92ae28b617371aa8fe16811969e75fb69be46397, one released second correction directly on 1c9a61fea6925910ebe49e25736efb630d201fb3. The first correction and its historical receipts remain retained.
• Lane: lane:foundation.
• Owned paths: both landscape worker role copies; landscape-sweep sweep.js, templates.json, README; native-boundary and harness tests; both token-lanes startup hooks, hook tests and SHA256SUMS; the token-session handbook; the dated decision and evidence-manifest registrations.

SOTA sources

• anthropics/claude-code v2.1.296@2301018b, CHANGELOG.md, official subagent tool allowlist, SubagentStart context output, dynamic skill context, and CLI reference. Installed 2.1.296 is the mechanism under test; its binary SHA256 is 24972e3bc859fab2b46ed4c1e51f7d6130f06d3bd550811a114640de3370d0de. Bounded native source offsets are in the decision. Official hook/tool documentation was rechecked on 2026-10-11.
• mksglu/context-mode v1.0.169@589d8214, src/server.ts: retain fetch/index/search, exclude caller-code execution entry points.

Evidence-class table

Local commands run

python3 -m unittest tests.test_token_lanes_subagent_start
before correction at 4a1e5b7d: exit 1; 23 tests, 2 failures
with updated silent-role expectations before hook fix: exit 1; 23 tests, 3 failures

python3 -m unittest tests.test_token_lanes_subagent_start tests.test_landscape_sweep_worker_boundary
historical first-correction head 1c9a61fe: exit 0; 34 tests, 19.932 s; no skips
historical first-correction merged snapshot: exit 0; 34 tests, 19.966 s; no skips

python3 scripts/evidence_manifest.py --check
exit 0; 11423 registered files sorted

python3 scripts/validate.py
final head: exit 0; 70 components, 11423 hashed files, 4 profiles, 239 receipts
merged snapshot: exit 0; 70 components, 11472 hashed files, 4 profiles, 239 receipts

gitleaks git . --redact=100 --no-banner --no-color --log-opts=9d4c00cd05d79b3fd5074df2e46bacab87ee67ff..HEAD
exit 0; PR range only, 2 commits scanned, no leaks found

git diff --cached --check
exit 0

Merged checks used tree 2e3d01452186cdc17476056431e11f80b07bb52b, produced by git merge-tree --write-tree 8bffa2c41692ef483e91b68e3b15aeb331423d2c 1c9a61fea6925910ebe49e25736efb630d201fb3 and checked out in an owned detached test worktree. No rebase or landing was performed. FULL validate checks integrity and scope; the native boundary suite uses isolated loopback fixtures with no paid model or real authentication. Full unittest discovery remains with hosted CI under the CC's test policy.

Decision record

docs/decisions/2026-10-10-landscape-scratch-ownership.md records vendor sources, failing regressions, the hook correction, alternatives and the overturn condition.

The boundary controls tools available to judgment workers. Coordinator/native job wrappers retain their capabilities. Research quality and throughput with public GitHub retrieval and source-reading skills remain unbenchmarked; inaccessible facts stay unknown/pending.

Checklist

• No Actions workflow added or changed.
• Changed bytes and hook SHA256SUMS registered; FULL validate passes.
• No credential read, printed, copied or committed; no new required secret.
• No paid service or billing surface introduced.
• Peer files, frozen exports, active installed roles and existing worktrees preserved.

Follow-ups

• Research the skills-modality null-digest chain: coordinator-derived pinned skill digest versus non-null merge selection; the CC holds all skills-modality launches until a qualified path exists (research intake: skills-lifecycle, fix: prevent landscape workers deleting shared scratch #987 thread4240880947).
• Research unauthenticated GitHub capacity: 60 requests/hour per originating IP and the facts-template refuted=true versus role-body unknown conflict; compare coordinator prefetch or an authenticated read-only route (research intake: research-runtime, fix: prevent landscape workers deleting shared scratch #987 thread4240880950).
• Add a bounded documentation/role consistency regression for the accurate stack-researcher comparison.
• Add a Workflow-path carrier-silence regression. The current Workflow test passes even with the role removed from both silent sets.
• In workflow mode, --agents shadows the user-scope role copy. Drop it on the next touch.
• Wording: missing spaces at record :88 and :112 and at body :79 and :85. Also give the receipts location at record :89; body spacing is corrected in this metadata update, while record changes wait for its next touch.

Second correction — complete three-family wave

The CC’s 15:47Z release combines the sole in-scope SessionStart P2 with folded Workflow-path, hook-prerequisite and handbook corrections in ONE forward commit. SessionStart/SubagentStart share the worker silence boundary; both existing failing assertions are preserved. Hook checksums and all affected evidence registrations are refreshed. The pinned mirror anthropics/claude-code@2301018b1f61073c501a8e7a4813ef48c239163b CHANGELOG.md:7476 supplies SessionStart agent_type; :6738 supplies the general hook agent_type field and :5513 supplies print-mode tool-frontmatter behavior. Actual fail-first: SessionStart: 14 tests, two failures at 1c9a61f, green after the correction.

Native Workflow agent(prompt,{agentType}) now has local loopback coverage for refused Bash/MCP execution, preserved foreign scratch and admitted Read. The installed role is copied verbatim into an isolated test config. This is synthetic-provider local integration, not paid research or a live-provider result. Opted-in hosts explicitly refresh both held-out carriers; handbook lists both carriers’ zero-byte worker output. Skills digest and capacity mechanism choices remain research-queue items, with the skills launch hold preserved.

python3 -B -m unittest tests.test_token_lanes_session_start tests.test_token_lanes_subagent_start tests.test_install_claude_profile tests.test_evidence_manifest tests.test_landscape_sweep_worker_boundary tests.test_adoption_docs_consistency tests.test_practice_references
rc 0; 241 tests, 2 optional skips at the corrected source
sha256sum --strict --quiet --check SHA256SUMS
python3 scripts/validate.py
python3 scripts/evidence_manifest.py --check
git diff --check

After this second fix round, ONE delta micro per family. The CC adjudicates any remaining items; a reproduced defect in the fix commit gets one correction, other findings are Follow-ups unless a new P1.

Current review disposition

Claude delta micro is PASS_WITH_P3 at 92ae28b; no correction is owed. Its carrier-silence and CLI-role-shadowing findings are retained above for the next touch, with record spacing and receipt-location wording. Current source-window/binary-hash receipts are retained privately in lanes/convergence-practice-work/pr987-release-fix-20261011/, including claude-2.1.296-SessionStart-source.json and the full pinned changelog. This body edit changes no source or head. Hold for the queued GPT delta ACK over 1c9a61f..92ae28b and the CC landing cue; skills-modality launch and research Follow-up gates remain.