Best possible solution:

Land one narrow allowlist update for the existing Workboard subagent_ended registration, preferably through the issue-linked duplicate if maintainers want GitHub to close the broader regression tracker cleanly.

Do we have a high-confidence way to reproduce the issue?

Yes. Source inspection shows current main registers api.on("subagent_ended", ...) in Workboard while the contract test's explicit typed-hook allowlists omit that file and hook name; I did not run tests because this review is read-only.

Is this the best way to solve the issue?

Yes for the code change itself. Updating both explicit allowlists is the narrowest maintainable fix because the runtime hook already exists and the contract intentionally fails closed on new bundled hook registrations.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against d5371395218c.

Label changes:

• add P2: The PR fixes a deterministic repository contract/CI regression with limited runtime blast radius.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Real behavior proof is not required for this maintainer-labeled test-only contract repair; the PR body cites focused Testbox/CI proof, and the relevant contract check is visible as green in live PR checks.

Label justifications:

• P2: The PR fixes a deterministic repository contract/CI regression with limited runtime blast radius.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Real behavior proof is not required for this maintainer-labeled test-only contract repair; the PR body cites focused Testbox/CI proof, and the relevant contract check is visible as green in live PR checks.

PR surface:

Tests +2. Total +2 across 1 file.

What I checked:

• Current main contract test inventory: Current main explicitly compares all bundled plugin api.on(...) registration files and collected typed hook names against the allowlists, and the allowlists do not yet include Workboard. (src/plugins/contracts/boundary-invariants.test.ts:379, d5371395218c)
• Current main Workboard hook registration: Workboard currently registers api.on("subagent_ended", ...) in its plugin entrypoint, which is exactly the file and hook name this PR adds to the contract inventory. (extensions/workboard/index.ts:17, d5371395218c)
• Typed hook contract exists: subagent_ended is already a typed plugin hook and its handler map uses PluginHookSubagentEndedEvent, so the PR is registering an existing SDK hook rather than adding new runtime API surface. (src/plugins/hook-types.ts:159, d5371395218c)
• PR diff matches the source gap: The PR only adds the Workboard file to BUNDLED_TYPED_HOOK_REGISTRATION_FILES and subagent_ended to BUNDLED_TYPED_HOOK_REGISTRATION_GUARDS. (src/plugins/contracts/boundary-invariants.test.ts:23, e9f6bcfb3827)
• Related duplicate landing candidate: Live GitHub search and PR inspection found test(plugins): register workboard typed hook contract #100614 with the same two-line diff, explicit Closes linkage to Control UI sidebar contract breaks after managed-worktrees merge #100613, and stronger focused Testbox proof in the PR body.
• Feature history provenance: Blame and history show the Workboard hook was added by commit 0acd851 from the managed-worktrees PR, while the typed-hook contract inventory predates it in commit d2d5911. (extensions/workboard/index.ts:17, 0acd851a3b3d)

Likely related people:

• steipete: Git blame and PR history tie both the Workboard subagent_ended registration and the managed-worktrees merge that exposed the contract gap to Peter Steinberger, and the related maintainer-labeled issue/PRs are authored by the same account. (role: recent feature-area contributor and likely follow-up owner; confidence: high; commits: 0acd851a3b3d, d2d5911c3296; files: extensions/workboard/index.ts, src/plugins/contracts/boundary-invariants.test.ts)
• Vincent Koc: Commit 55a0012 fixed the sidebar-export half of the same current-main regression described by the linked issue, leaving this Workboard hook inventory update as the remaining contract half. (role: adjacent regression fixer; confidence: medium; commits: 55a0012c44b5; files: ui/src/app-navigation.ts, ui/src/app-navigation.test.ts)

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.