Session Handoff [engineering]: Guard Target Reads and Bootstrap Dash-Name Refusal Released as 2.0.1074, Guard Allow Gaps Next #3166

Next steps, in priority order

1. The guard's remaining allow gaps, one lane at a time, all in gh-write-guard.py. Read the gh Write Targets the Write Guard Still Missed #3162 closed the gh-target follow-ups. What remains, grouped:
   • New since round 28: Read the Owner Flags, Issue References, and Repository Ids the Write Guard Still Skips #3158 (owner flags, issue-reference values, repositories/<id> paths, gh repo fork --org, plus the eval, dot-segment, declare -x/set -a, and subshell-export items in its comment) and Read a Run-Time Path Word Behind a Run-Time Command Word as a Possible Write in the Write Guard #3165 (a run-time path word behind a run-time command word).
   • Config and alias reads: Read Push Config a Command Rewrites Before the Push in the Write Guard #3046, Tell a Timed-Out Persisted Alias Read From No Alias in the Write Guard #3047, Deny a Hooks-Path Override on Git Commands Other Than Commit or Push in the Write Guard #3055, Read a HOME or XDG_CONFIG_HOME Override on a Git Command as an Unread Config File in the Write Guard #3057, Read Environment Config Per Git Command, Not by Index Across a Reading, in the Write Guard #3072, Read a Git Alias From the Repository Git Runs In for Rule 6 and a Wrapper's GIT_DIR in the Write Guard #3078, Read a Git Alias Expansion Past Its Leading Global Options in the Write Guard #3081.
   • Push targets: Judge a Push to Another Remote Against That Remote's Repository in the Write Guard #3048, Read a Bare Push Under push.default=matching as Updating Every Matching Branch in the Write Guard #3053, and Close the Write Guard's Remaining Push Detection Gaps Found Reviewing the #2936 Fix #2943's remaining items.
   • Directory values, tokenizer, launchers and wrapper bodies: Read Carriage Returns, Folded Lines, Eval, and Globs in a Directory Value in the Write Guard #2995, Read Commands a Quote Pair Spanning Two Comments Hides in the Write Guard #2991, Read Every Launcher in Front of a Push in the Write Guard #3050, Read a Foreign Shell Behind a Launcher the Write Guard Does Not Know #3083, Carry Environment Through an Unknown Launcher to the Git It Runs in the Write Guard #3085, Read a Command String env -S Runs in the Write Guard #3090, Fail Closed on Words xargs Appends to a Merge, Commit, or Push in the Write Guard #3074, Read a Double-Quoted Wrapper Body's Run-Time Words as Splittable in the Write Guard #3075.
   • Shells, case and encoding: Decode a PowerShell -EncodedCommand Body in the Write Guard #3056, Match push.default Case-Sensitively in the Write Guard or Say It Is Folded #3061, Read Git's Environment Variable Names Without Case on Windows in the Write Guard #3086, Read cmd and PowerShell Run-Time Words as Run-Time Words in the Write Guard #3091, Close Four Hidden-Command Allow Gaps the Promotion's Third Review Found in the Write Guard #3088.
   • Commit option clusters: Read a Commit Cluster With an Attached Value as Taking No Next Word in the Write Guard #3068, Read Short-Option Clusters Through One Primitive in the Write Guard #3071, and Deny the Remaining core.hooksPath and no-verify Bypass Routes in the Guard #2177's alias item.
     Done means a merged PR into develop, with a develop-versus-branch differential over a constructed corpus showing no new allow, and a revert proof.
2. The guard's over-denials, after step 1: Narrow Three Write-Guard Reads That Deny More Broadly Than Git Pushes #2953, Scope a Branch Pattern's Push Operations to the Branches It Can Match in the Write Guard #2964, Read Only an Eval That Runs in the Write Guard's Include Reading #2975, Keep the Write Guard's Terminal-Option Exception When a Redirection Precedes the Option #2981, Write Guard Denies Heredoc Data Inside an Unquoted Backtick Substitution #3000, Read a Commit's Exact -n as a Value Where It Follows a Value Option in the Write Guard #3070, Read a Process Substitution as One Word in the Write Guard's Commit and Merge Walks #3073, End a Merge's Words at a Comment in the Write Guard's Run-Time Check #3076, Read Quoting the Write Guard's Quote-Keeping Lex Cannot Align #3084, Leave a Literal gh Target Inside Heredoc Data Unread in the Write Guard #3134, plus what Read the gh Write Targets the Write Guard Still Missed #3162 left on purpose: Read a GH_REPO Only in the Wrapper Body It Reaches in the Write Guard #3144's and Close Three Small GH_REPO and Merge-Message Gaps in the Write Guard #3145's over-deny halves and Let a Top-Level Command-Text GH_REPO Export Override an Inherited One in the Write Guard #3163 (a command-text export can't override an inherited GH_REPO). Then Move the Write Guard's Option-Prefix, Eval-Reading, and Cluster Sites Onto One Helper Each #3008, helper consolidation, last.
3. Refer to an Enumeration Instead of Stating an Incidental Count in Prose and Comments #3160, a style rule against incidental counts in prose and comments. The maintainer asked for it this round. It is carried rule text in GOVERNANCE.md "Documentation Style Conventions", comment-and-doc-style, and CODESTYLE.md "General", so it runs at the frontier tier in a lane of its own, and it touches no guard file.
4. Small non-guard lanes, which run beside the guard lanes: Close the Docker Task Workflow Test's Five Undetected Shapes #3159 (the Docker task workflow test's undetected shapes) and Note the Dispatch Bypass Builds Nothing When enable_* Outputs Are Forwarded #3155 (a docs note that the dispatch bypass builds nothing where enable_* outputs are forwarded).

External blockers

• None. CodeRabbit skips this repository for manual review, and it is advisory.

Internal dependencies

• Steps 1 and 2 run one lane at a time, since each edits gh-write-guard.py. Each lane claims all of host-setup/agent-safety/, READMEs included, because a commit outside the claim is refused as "Modify Shared Resources".
• Step 2 runs after step 1, because narrowing a deny while allow gaps are still open has repeatedly opened a new allow in the same reader. Let a Top-Level Command-Text GH_REPO Export Override an Inherited One in the Write Guard #3163 is the latest example: three attempts at the override each leaked.
• Move the Write Guard's Option-Prefix, Eval-Reading, and Cluster Sites Onto One Helper Each #3008 goes last, because moving shared sites onto helpers rewrites lines every other guard lane edits.
• Decide Whether a Run-Time Pull Request Selector Fails Closed in the Write Guard #3157's answer shapes part of step 1 (whether a run-time pull request selector fails closed), so a lane taking Read the Owner Flags, Issue References, and Repository Ids the Write Guard Still Skips #3158 or Read a Run-Time Path Word Behind a Run-Time Command Word as a Possible Write in the Write Guard #3165 reads Decide Whether a Run-Time Pull Request Selector Fails Closed in the Write Guard #3157 first.

State

• Promotion Promote the Write Guard's Remaining gh Target Reads and the Bootstrap Dash-Name Refusal to Main #3164 merged with --merge (main 0f1ac327). Released as 2.0.1074 (run 38961457336, success, tag on 0f1ac327).
• The installed Skills snapshot is current at 0f1ac327. The agent-safety kit on this machine reads STALE against the promoted guard. Its installer is the maintainer's to run (the release report gave the command).
• No open pull requests from this lane. Let a Manual Dispatch Bypass the Smoke Build's Paths Filter #3153, Test the Docker Task Workflow's Credential Check, Login, and Hook Inputs #3154, Reject a Dash-Prefixed Agents Name in Both Bootstrap Loaders #3156, and Read the gh Write Targets the Write Guard Still Missed #3162 merged into develop and were promoted. Their remote branches, worktrees, and local branches are removed.
• Run the Native Windows Check for the Bootstrap Dash-Name Refusal #3161 (the native Windows check for Reject a Dash-Prefixed Agents Name in Both Bootstrap Loaders #3156) passed under pwsh 7 and Windows PowerShell 5.1 and is closed.
• The primary checkout is on develop, clean, fast-forwarded.
• Merged feature/auto-* worktrees from other lanes still sit locally. This lane did not touch them.
• Other tracks' open handoffs are untouched: Session Handoff [windows]: #2578 Landed for #694, Closing Through Promotion #2580, #1171 Next #2581 (windows), Session Handoff [host-instructions]: Hardening Rule and Merge Guard Released as 2.0.867 and 2.0.868, #2499 Docstring Next #2514 (host-instructions), Session Handoff [default]: Four Follow-Ups Landed and Released as 2.0.826, Downstream Adoption Next #2361 (default), Session Handoff [python-contract]: Escaped and Folded python-directories Values Refused, Released as 2.0.738 #2014 (python-contract).

The parked decision queue

There is 1 open decision issue: #3157, which asks whether a wholly run-time pull request or issue selector fails closed in the guard. It is put to the maintainer at this close, and the answer is recorded on #3157 and in a comment on this link. This round also asked the maintainer about merging #3154 and #3153 (merged), the native Windows check (run, passed), and merging and releasing #3164 (merged and released).

What the last round did

• Four lanes and a promotion, released as 2.0.1074:
  • Read the gh Write Targets the Write Guard Still Missed #3162 (Opus) closes Read an Inherited GH_REPO From the Session Environment in the Write Guard #3147, Read a Run-Time Word Before gh's Command and a Bare GH_REPO export in the Write Guard #3136, Read a gh Write Behind a Run-Time Command Word in the Write Guard's Target Check #3131, Read a Positional Repository and the Missing Write Subcommands in the Write Guard #3133, and Read a gh api Write Target Outside a repos/ Path in the Write Guard #3132, and fixes the under-deny halves of Read a GH_REPO Only in the Wrapper Body It Reaches in the Write Guard #3144 and Close Three Small GH_REPO and Merge-Message Gaps in the Write Guard #3145. Differential over 2,840 runs: 189 flips, all allow to deny, 0 new allows. 82 new self-tests.
  • Reject a Dash-Prefixed Agents Name in Both Bootstrap Loaders #3156 (Sonnet) closes Reject a Dash-Prefixed Agents Name Before the Handoff to Install-Agents #3129: both bootstrap loaders refuse a dash-led agents name, including PowerShell's U+2013, U+2014, and U+2015 prefixes.
  • Let a Manual Dispatch Bypass the Smoke Build's Paths Filter #3153 (Sonnet) closes Smoke-Build a Dispatched Run of the Smoke Caller Snippet Past Its Paths Filter #3149 per the maintainer's decision: a manual dispatch bypasses the smoke build's paths filter.
  • Test the Docker Task Workflow's Credential Check, Login, and Hook Inputs #3154 (Sonnet) closes Test the Docker Task Workflow's Credential Check, Login, and Hook Inputs #3148 with a structural test of the Docker task workflow.
  • Promotion Promote the Write Guard's Remaining gh Target Reads and the Bootstrap Dash-Name Refusal to Main #3164 needed no fix round. Copilot's one finding exists on main too and was filed as Read a Run-Time Path Word Behind a Run-Time Command Word as a Possible Write in the Write Guard #3165.
• Filed: Note the Dispatch Bypass Builds Nothing When enable_* Outputs Are Forwarded #3155, Decide Whether a Run-Time Pull Request Selector Fails Closed in the Write Guard #3157, Read the Owner Flags, Issue References, and Repository Ids the Write Guard Still Skips #3158, Close the Docker Task Workflow Test's Five Undetected Shapes #3159, Refer to an Enumeration Instead of Stating an Incidental Count in Prose and Comments #3160, Run the Native Windows Check for the Bootstrap Dash-Name Refusal #3161, Let a Top-Level Command-Text GH_REPO Export Override an Inherited One in the Write Guard #3163, Read a Run-Time Path Word Behind a Run-Time Command Word as a Possible Write in the Write Guard #3165.

What not to repeat

• A Windows check block handed over in the terminal or in a prompt preview. The maintainer can't copy either one cleanly. Put the block in an issue's fenced code block, so the browser's copy button copies it, and ask through a prompt with numbered steps.
• A check script that echoes a raw error line. Windows PowerShell 5.1 prefixes its errors with the script's full path, so the posted results carried a local temp path. Print a fixed label for each outcome instead.
• A command-text GH_REPO export override in the guard without a bounded reader. Read the gh Write Targets the Write Guard Still Missed #3162's lane tried three times, and each round found a new leak (a subshell, a pipe, a case arm, a loop body, a quoted separator). The last attempt was also quadratic. See Let a Top-Level Command-Text GH_REPO Export Override an Inherited One in the Write Guard #3163 for the narrower shape to try.
• Lane merges into develop when only a local pass covers the head. The classifier refused that merge as "Merge Without Review" for Let a Manual Dispatch Bypass the Smoke Build's Paths Filter #3153 and Test the Docker Task Workflow's Credential Check, Login, and Hook Inputs #3154. A prompt naming the merge cleared it from the main seat. Reject a Dash-Prefixed Agents Name in Both Bootstrap Loaders #3156 and Read the gh Write Targets the Write Guard Still Missed #3162 merged from their lanes without a refusal.

New learnings

• The promotion brief shape converged with zero fix rounds a third time (Promote the Write Guard's Remaining gh Target Reads and the Bootstrap Dash-Name Refusal to Main #3164, after Promote the Write Guard's Option Readings and the Linux Agents List Check to Main #3092 and Promote the Write Guard's gh Target Reading and the Windows Bootstrap Fixes to Main #3146): probe a finding against main first, file it if it already exists there, and fix only what develop introduced.
• The maintainer's handover preference for native checks is recorded in this machine's agent memory, not in governance, since it is about one maintainer's terminal.