Read-only investigator agents cannot settle themselves via subagent-stop #548

New issue

Open

opened 2026-09-09 21:03:24 +00:00 by jared · 0 comments

jared commented

2026-09-09 21:03:24 +00:00

Owner

Read-only investigator agents cannot settle themselves via subagent-stop [capture]

Context

ADR-0144 makes settlement agent-initiated: an agent settles by calling the subagent-stop CLI itself and relaying next_step. In implement run d233a2f7, ticket #542 implementation 6, two read-only investigator agents could not do this because their sandbox refuses the stop command.

Observed

code-probe dispatch, 14:37:44 EDT, and message-tracer dispatch, 14:39:06 EDT, both reported the same failure.

code-probe, 14:37:44 EDT / message-tracer, 14:39:06 EDT

the stop command is refused by my sandbox (read-only)

The orchestrator had to submit the subagent-stop payload by hand for each of the two dispatches, from the scratchpad.

Reproduce

Dispatch a read-only agent (code-probe or message-tracer) as a node in an os-sdlc pipeline map and let it try to settle itself by calling the subagent-stop CLI from within its own sandboxed tool allowlist.

Expected

A read-only investigator agent must be able to settle itself without hand intervention. Either:

grant the subagent-stop CLI call in the read-only sandbox profile, or
route settlement for read-only nodes through the hook path instead of an agent-initiated CLI call.

def test_read_only_investigator_agent_settles_itself_without_a_hand_subagent_stop
  # arrange: dispatch code-probe or message-tracer as a pipeline node
  # act: the agent finishes its read-only work and attempts to settle
  # assert: settlement succeeds without a hand-submitted subagent-stop payload
end

Origin

Trigger: code-probe dispatch 14:37:44 EDT and message-tracer dispatch 14:39:06 EDT, #542 implementation 6
Improvised this session: hand-submitted two subagent-stop payloads from the scratchpad
Chain: two hand subagent-stop submissions required ← "the stop command is refused by my sandbox (read-only)" ← DESIGN (ADR-0144 agent-initiated settlement) not accounting for read-only agent sandbox tool allowlists
Root candidate: this ticket is the root
Where: os-sdlc settlement / ADR-0144 subagent-stop CLI; code-probe and message-tracer agent definitions/sandbox profiles
Session: 83ad9fea-87af-476e-8a40-e8c253061473
Transcript: docs/orchestration-audit/implement-run-d233a2f7-2026-09-09/03-timeline.md ("Follow-up answers" section 1, #542 row)

# Read-only investigator agents cannot settle themselves via subagent-stop [capture] ## Context ADR-0144 makes settlement agent-initiated: an agent settles by calling the subagent-stop CLI itself and relaying `next_step`. In implement run `d233a2f7`, ticket #542 implementation 6, two read-only investigator agents could not do this because their sandbox refuses the stop command. ## Observed code-probe dispatch, 14:37:44 EDT, and message-tracer dispatch, 14:39:06 EDT, both reported the same failure. ``` code-probe, 14:37:44 EDT / message-tracer, 14:39:06 EDT ``` ``` the stop command is refused by my sandbox (read-only) ``` The orchestrator had to submit the subagent-stop payload by hand for each of the two dispatches, from the scratchpad. ## Reproduce ``` Dispatch a read-only agent (code-probe or message-tracer) as a node in an os-sdlc pipeline map and let it try to settle itself by calling the subagent-stop CLI from within its own sandboxed tool allowlist. ``` ## Expected A read-only investigator agent must be able to settle itself without hand intervention. Either: - grant the subagent-stop CLI call in the read-only sandbox profile, or - route settlement for read-only nodes through the hook path instead of an agent-initiated CLI call. ```ruby def test_read_only_investigator_agent_settles_itself_without_a_hand_subagent_stop # arrange: dispatch code-probe or message-tracer as a pipeline node # act: the agent finishes its read-only work and attempts to settle # assert: settlement succeeds without a hand-submitted subagent-stop payload end ``` ## Origin - Trigger: code-probe dispatch 14:37:44 EDT and message-tracer dispatch 14:39:06 EDT, #542 implementation 6 - Improvised this session: hand-submitted two subagent-stop payloads from the scratchpad - Chain: two hand subagent-stop submissions required ← "the stop command is refused by my sandbox (read-only)" ← DESIGN (ADR-0144 agent-initiated settlement) not accounting for read-only agent sandbox tool allowlists - Root candidate: this ticket is the root - Where: os-sdlc settlement / ADR-0144 subagent-stop CLI; code-probe and message-tracer agent definitions/sandbox profiles - Session: 83ad9fea-87af-476e-8a40-e8c253061473 - Transcript: docs/orchestration-audit/implement-run-d233a2f7-2026-09-09/03-timeline.md ("Follow-up answers" section 1, #542 row)

jared added the

plugin/os-sdlc

filed-by/user

labels

2026-09-09 21:03:24 +00:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

jared/cc-os#548

No description provided.

Rows
Columns