Pipeline agents without Write cannot submit a handoff that contains the word git from a worktree session #848

New issue

Closed

opened 2026-09-30 17:22:32 +00:00 by jared · 1 comment

jared commented

2026-09-30 17:22:32 +00:00

Owner

Problem

In a worktree-isolated session, the harness guard refuses a Bash command when its inline text names git in a form the guard cannot verify. A pipeline agent submits its handoff with os-sdlc-subagent-stop --json '<json with the YAML handoff>' (plugins/os-sdlc/agents/contract-auditor.md:52). The protocol forbids heredocs, variables, and pipes (contract-auditor.md:57). An audit of git-related code names git many times, so the guard refuses the call. Read-only agents (contract-auditor, change-auditor, behavior-verifier, reviewer, test-reviewer, seam-designer) have no Write tool, so they cannot move the handoff into a file. The agent then ends without a recorded completion, and the orchestrator must submit the event, which the implement skill forbids.

Observed

#844, implementation 9, dispatch 75, 2026-09-30. The contract-auditor reported: "The worktree-isolation guard blocked the os-sdlc-subagent-stop call. It said it cannot show that the command is not git". On retry: "I have only the Read and Bash tools, and I have no Write tool."

The orchestrator wrote the verbatim handoff to a file and ran os-sdlc-subagent-stop < handoff-75.json. The Runner accepted it (completion_recorded, verdict pass).

Reproduce

From a session in a linked worktree, run the implement pipeline on a ticket that changes plugins/os/lib/worktree/.
When the contract-auditor submits a handoff that contains the word "git", the guard refuses the os-sdlc-subagent-stop --json '...' call.

Origin

Trigger: /os-sdlc:implement 844, contract-auditor dispatch 75
Improvised this session: the orchestrator wrote the handoff to a file and ran os-sdlc-subagent-stop < file.json itself
Chain: guard refuses inline git text ← stop protocol puts the handoff YAML inline in argv ← DESIGN: the agent stop protocol (contract-auditor.md:52-57)
Root candidate: this ticket
Where: plugins/os-sdlc/agents/*.md (stop protocol); plugins/os-sdlc/bin/os-sdlc-subagent-stop (input forms)
Session: f531ed01-125b-49b4-b35a-43528beff19e
Transcript: /home/jared/.claude/projects/-home-jared-dev-cc-os/f531ed01-125b-49b4-b35a-43528beff19e.jsonl

Related: #841 (a gate error ends the run without a correction round).

VERDICT: CREATE — observed failure in a full #844 run; recurs for every read-only agent that audits git code (ticket-skeptic, 2026-09-30).

## Problem In a worktree-isolated session, the harness guard refuses a Bash command when its inline text names git in a form the guard cannot verify. A pipeline agent submits its handoff with `os-sdlc-subagent-stop --json '<json with the YAML handoff>'` (`plugins/os-sdlc/agents/contract-auditor.md:52`). The protocol forbids heredocs, variables, and pipes (`contract-auditor.md:57`). An audit of git-related code names git many times, so the guard refuses the call. Read-only agents (contract-auditor, change-auditor, behavior-verifier, reviewer, test-reviewer, seam-designer) have no Write tool, so they cannot move the handoff into a file. The agent then ends without a recorded completion, and the orchestrator must submit the event, which the implement skill forbids. ## Observed #844, implementation 9, dispatch 75, 2026-09-30. The contract-auditor reported: "The worktree-isolation guard blocked the `os-sdlc-subagent-stop` call. It said it cannot show that the command is not git". On retry: "I have only the Read and Bash tools, and I have no Write tool." The orchestrator wrote the verbatim handoff to a file and ran `os-sdlc-subagent-stop < handoff-75.json`. The Runner accepted it (`completion_recorded`, verdict pass). ## Reproduce 1. From a session in a linked worktree, run the implement pipeline on a ticket that changes `plugins/os/lib/worktree/`. 2. When the contract-auditor submits a handoff that contains the word "git", the guard refuses the `os-sdlc-subagent-stop --json '...'` call. ## Origin - Trigger: `/os-sdlc:implement 844`, contract-auditor dispatch 75 - Improvised this session: the orchestrator wrote the handoff to a file and ran `os-sdlc-subagent-stop < file.json` itself - Chain: guard refuses inline git text ← stop protocol puts the handoff YAML inline in argv ← DESIGN: the agent stop protocol (`contract-auditor.md:52-57`) - Root candidate: this ticket - Where: plugins/os-sdlc/agents/*.md (stop protocol); plugins/os-sdlc/bin/os-sdlc-subagent-stop (input forms) - Session: f531ed01-125b-49b4-b35a-43528beff19e - Transcript: /home/jared/.claude/projects/-home-jared-dev-cc-os/f531ed01-125b-49b4-b35a-43528beff19e.jsonl Related: #841 (a gate error ends the run without a correction round). VERDICT: CREATE — observed failure in a full #844 run; recurs for every read-only agent that audits git code (ticket-skeptic, 2026-09-30).

jared added the

plugin/os-sdlc

filed-by/agent

labels

2026-09-30 17:22:32 +00:00

jared referenced this issue

2026-09-30 17:27:09 +00:00

implementation-open places the worktree through worktree start; payload tells the skill to enter, exit, and finish #846

jared added the

category/owner-ruling

label

2026-10-10 13:31:57 +00:00