Session Handoff [engineering]: Six Lanes and Two Promotion Fixes Released as 2.0.1046, #3058 Promotion and Guard Gaps Next #3063

Next steps, in priority order

1. Re-run the host-safety installer, maintainer only. 2.0.1046 changed gh-write-guard.py (Read a Bare Push's Destination From Branch Config, a Persisted Mirror, and Its Own Checkout in the Write Guard #3049, Read a Timed-Out push.default Read as Unresolved in the Write Guard #3054), so install.py --report reads STALE until python3 host-setup/agent-safety/claude/install.py runs from a checkout of main. Done when its --report reads CURRENT. Read Commands Hidden in Config, Environment, Aliases, and Other Shells in the Write Guard #3058 moves the payload again once it is promoted, so this can wait for step 2's release.
2. Promote Read Commands Hidden in Config, Environment, Aliases, and Other Shells in the Write Guard #3058. develop is ahead of main by Read Commands Hidden in Config, Environment, Aliases, and Other Shells in the Write Guard #3058 alone. Its promotion closes Deny a Hook-Bypass Commit or Push Nested Past the Write Guard's Wrapper Cap #3010, Read a Config Key That Runs a Command on Any Git Command in the Write Guard #2972, Write Guard Skips Command Substitutions Inside an Unquoted-Delimiter Heredoc in a Substitution #2999 and Read Substitutions Inside a Quoted Parameter Expansion or an Unquoted Heredoc Body in the Write Guard #2989. Done at a mergeable develop -> main promotion. The merge and release need the maintainer's go-ahead.
3. The guard's remaining allow gaps, one lane at a time, all in gh-write-guard.py. Suggested grouping by the reader each touches:
   • Options: Read an Abbreviated --no-verify on a Commit or Push in the Write Guard #2978, Read a Short-Option Cluster Carrying -n on a Commit in the Write Guard #3015, Fail Closed on an --admin a Run-Time Word Spells in the Write Guard #3006, Read gh pr merge's Boolean -m Before Skipping a Value in the Write Guard's Target Check #3004, Let a Later Negated Push Option Cancel an Earlier One in the Write Guard #3025.
   • Config and alias reads: Read Push Config a Command Rewrites Before the Push in the Write Guard #3046, Tell a Timed-Out Persisted Alias Read From No Alias in the Write Guard #3047, Deny a Hooks-Path Override on Git Commands Other Than Commit or Push in the Write Guard #3055, Read a HOME or XDG_CONFIG_HOME Override on a Git Command as an Unread Config File in the Write Guard #3057.
   • Push targets: Judge a Push to Another Remote Against That Remote's Repository in the Write Guard #3048, Read a Bare Push Under push.default=matching as Updating Every Matching Branch in the Write Guard #3053, and Close the Write Guard's Remaining Push Detection Gaps Found Reviewing the #2936 Fix #2943's remaining persisted remote.<name>.push and push.default=matching items.
   • Directory values, tokenizer and launchers: Read Carriage Returns, Folded Lines, Eval, and Globs in a Directory Value in the Write Guard #2995, Read Commands a Quote Pair Spanning Two Comments Hides in the Write Guard #2991, Read Every Launcher in Front of a Push in the Write Guard #3050.
   • Shells and case: Decode a PowerShell -EncodedCommand Body in the Write Guard #3056, Match push.default Case-Sensitively in the Write Guard or Say It Is Folded #3061.
     Run each at the frontier tier, with the develop-versus-branch differential and a revert proof before every push. The lane claims both agent-safety READMEs together with the guard file.
4. The guard's over-denials, after step 3: Narrow Three Write-Guard Reads That Deny More Broadly Than Git Pushes #2953, Scope a Branch Pattern's Push Operations to the Branches It Can Match in the Write Guard #2964, Read Only an Eval That Runs in the Write Guard's Include Reading #2975, Keep the Write Guard's Terminal-Option Exception When a Redirection Precedes the Option #2981, Write Guard Denies Heredoc Data Inside an Unquoted Backtick Substitution #3000. Then Move the Write Guard's Option-Prefix, Eval-Reading, and Cluster Sites Onto One Helper Each #3008, helper consolidation, last.
5. Non-guard lane, runs beside the guard lanes: Align the Linux and Windows Agents List Parsing in the Bootstrap Loaders #3043, bootstrap.sh passing --agents all,herdr and empty list names through where bootstrap.ps1 refuses or drops them.

External blockers

• Host-safety kit STALE on this machine until the maintainer re-runs its installer (step 1).
• CodeRabbit is rate limited and advisory. It is not worth a wait.

Internal dependencies

• Step 3's lanes run one at a time, since each edits gh-write-guard.py.
• Step 4 after step 3, since narrowing a deny while allow gaps are open has repeatedly opened a new allow in the same reader.
• Move the Write Guard's Option-Prefix, Eval-Reading, and Cluster Sites Onto One Helper Each #3008 last, because moving shared sites onto helpers rewrites lines every other guard lane edits.
• A guard lane that merges while a promotion is open moves the promotion's head. Brief it to stop at READY until the promotion merges, as this round did with Read Commands Hidden in Config, Environment, Aliases, and Other Shells in the Write Guard #3058.

State

• Merged to develop this round: Describe the Write Guard's Prune, Mirror, heads/, and Push-Target Readings #3042, Keep an Abandoned Group's Claim Until Cleanup and Name an Unused Branch in backlog-burndown #3041, Test the Bootstrap Agents Handoff and Move the Root Probe to host_capability #3044, Count the Open Findings Remain List in the Copilot Narrative Block #3045, Read a Bare Push's Destination From Branch Config, a Persisted Mirror, and Its Own Checkout in the Write Guard #3049, and the promotion fixes Read a Timed-Out push.default Read as Unresolved in the Write Guard #3054 and Describe a Timed-Out push.default Read as a Deny in the Agent-Safety READMEs #3062. Bump actions/create-github-app-token from 3.2.0 to 3.3.0 in the actions-deps group #3059, a Dependabot action bump, also merged. Read Commands Hidden in Config, Environment, Aliases, and Other Shells in the Write Guard #3058 merged after the promotion.
• Promotion Promote the Write-Guard Bare Push and Checkout Readings, pr_review.py Narrative Findings, and Bootstrap Handoff Tests to Main #3051 merged with --merge, so main is at 86e0c120. Released as 2.0.1046, and the release run succeeded.
• develop is ahead of main by Read Commands Hidden in Config, Environment, Aliases, and Other Shells in the Write Guard #3058 only (2c270158).
• Every remote feature branch from this round was deleted through pr_review.py cleanup, each confirmed by a read-back. Their worktrees and local branches are removed, and so is the skills-refresh worktree.
• The primary checkout is on develop, clean, fast-forwarded to develop's tip.
• The installed Skills snapshot is current at 86e0c120. The host-safety kit is STALE (step 1).
• Merged feature/auto-* branches from other lanes still sit on the remote and locally. This lane did not touch them.
• Other tracks' open handoffs untouched: Session Handoff [windows]: #2578 Landed for #694, Closing Through Promotion #2580, #1171 Next #2581 (windows), Session Handoff [host-instructions]: Hardening Rule and Merge Guard Released as 2.0.867 and 2.0.868, #2499 Docstring Next #2514 (host-instructions), Session Handoff [default]: Four Follow-Ups Landed and Released as 2.0.826, Downstream Adoption Next #2361 (default), Session Handoff [python-contract]: Escaped and Folded python-directories Values Refused, Released as 2.0.738 #2014 (python-contract).

The parked decision queue

There are 0 open decision issues. This round asked two questions in session. One was whether to land the README fix the auto-mode classifier refused a lane's commit of, and the answer was commit and land it. The other was whether to merge and release #3051 although #3059 merged with no review round, and the answer was merge and release.

What the last round did

• Six feature lanes, five on Opus and one on Sonnet:
  • Describe the Write Guard's Prune, Mirror, heads/, and Push-Target Readings #3042 closes Describe the Write Guard's --prune, Mirror Delete, heads/ Destination, and @{push} Readings in the Agent-Safety READMEs #3021.
  • Keep an Abandoned Group's Claim Until Cleanup and Name an Unused Branch in backlog-burndown #3041 closes Release an Abandoned Group's Claim Only After Cleanup Confirms It Is Not Stopped #3026, Say Stopped on Every backlog-burndown Path That Sends a Group to the Maintainer #3027 and Name a Branch No Pull Request Has Used in a backlog-burndown Brief #3039.
  • Test the Bootstrap Agents Handoff and Move the Root Probe to host_capability #3044, on Sonnet, closes Test bootstrap.sh's report handoff to the agent tools step #3033, Test the Bootstrap Loaders' Agents Install Handoff on Linux and Windows #3038 and Move the unprivileged-root probe into host_capability.py #3034.
  • Count the Open Findings Remain List in the Copilot Narrative Block #3045 closes Read the Open Findings Remain List in the Copilot Narrative Block in pr_review.py #3031.
  • Read a Bare Push's Destination From Branch Config, a Persisted Mirror, and Its Own Checkout in the Write Guard #3049 closes Read a Bare Push's Destination From Branch Config, Not a Remote-Tracking Ref, in the Write Guard #3019, Read a Persisted remote.<name>.mirror on a Bare Push in the Write Guard #3020, Read a Dash-Named Refspec After End-of-Options in the Write Guard #3029 and Fail Closed When the Write Guard's @{push} Read Times Out or Cannot Run #3036, plus one Close the Write Guard's Remaining Push Detection Gaps Found Reviewing the #2936 Fix #2943 item.
  • Read Commands Hidden in Config, Environment, Aliases, and Other Shells in the Write Guard #3058 closes Deny a Hook-Bypass Commit or Push Nested Past the Write Guard's Wrapper Cap #3010, Read a Config Key That Runs a Command on Any Git Command in the Write Guard #2972, Write Guard Skips Command Substitutions Inside an Unquoted-Delimiter Heredoc in a Substitution #2999 and Read Substitutions Inside a Quoted Parameter Expansion or an Unquoted Heredoc Body in the Write Guard #2989, plus four Close the Write Guard's Remaining Push Detection Gaps Found Reviewing the #2936 Fix #2943 items, on promotion.
• Promotion Promote the Write-Guard Bare Push and Checkout Readings, pr_review.py Narrative Findings, and Bootstrap Handoff Tests to Main #3051 drew a real Copilot finding: the guard read a timed-out push.default read as "both" instead of denying. It was fixed through Read a Timed-Out push.default Read as Unresolved in the Write Guard #3054. Its README drift (State the Timed-Out push.default Deny in the Agent-Safety READMEs #3052) was fixed through Describe a Timed-Out push.default Read as a Deny in the Agent-Safety READMEs #3062 from the main seat after the maintainer approved.
• One test finding was declined because the test passes, and the vague round-4 headline was answered once as not identifiable.
• Filed: Align the Linux and Windows Agents List Parsing in the Bootstrap Loaders #3043, Read Push Config a Command Rewrites Before the Push in the Write Guard #3046, Tell a Timed-Out Persisted Alias Read From No Alias in the Write Guard #3047, Judge a Push to Another Remote Against That Remote's Repository in the Write Guard #3048, Read Every Launcher in Front of a Push in the Write Guard #3050, State the Timed-Out push.default Deny in the Agent-Safety READMEs #3052, Read a Bare Push Under push.default=matching as Updating Every Matching Branch in the Write Guard #3053, Deny a Hooks-Path Override on Git Commands Other Than Commit or Push in the Write Guard #3055, Decode a PowerShell -EncodedCommand Body in the Write Guard #3056, Read a HOME or XDG_CONFIG_HOME Override on a Git Command as an Unread Config File in the Write Guard #3057, Match push.default Case-Sensitively in the Write Guard or Say It Is Folded #3061, all labelled.

What not to repeat

• Widening a fix's claim to the code alone. The ruling that let a promotion fix edit _configured_push_branches excluded the READMEs describing it, so the next Copilot round raised the drift. The lane's README commit was then refused by the auto-mode classifier as outside its claim. A claim on behavior the READMEs describe takes both READMEs in the same ruling.
• A Dependabot PR on develop during a promotion. Bump actions/create-github-app-token from 3.2.0 to 3.3.0 in the actions-deps group #3059 merged with no review round, so the promotion exception could not cover it and the merge went to the maintainer. Read gh pr list --state merged --base develop for bot merges before calling a promotion ready.
• Removing a worktree a background wait started in. The release watch shell started in a worktree removed mid-wait, so the command exited 1 after the watch itself exited 0. Start background waits from the primary checkout.
• Briefing a lane with git -C $VAR or a heredoc carrying a push word. The write guard denies both. Every lane brief now spells paths out and writes files with the Write tool.
• pr_review.py reply --path alone. It requires a non-empty --match, so pass words from the thread's opening comment, without backticks.

New learnings

• Each guard lane ran a differential of about 100,000 to 116,000 inputs and took 2 to 2.5 hours and about 400k to 490k tokens. Budget one guard lane per round beside the non-guard lanes.