fix(fleet): read-only agents run read-only commands; refusals are actionable (#6015) - #6637

Merged

8 commits merged into

mainfrom

fix/6015-readonly-shell

Sep 28, 2026

Commits on Sep 27, 2026

fix(execpolicy): judge read-only chains segment by segment and name the refusal rule (#6015)

CodeWhale Bot
and
claude
committed
8580b0e
fix(fleet): one read-only shell authority with actionable, counted refusals (#6015)

CodeWhale Bot
and
claude
committed
471d936
fix(subagent): a queued agent that never starts says so; its work clock starts at launch (#6015)

CodeWhale Bot
and
claude
committed
c60ac29
docs(fleet): read-only shell grammar, refusals and launch clock (#6015)

CodeWhale Bot
and
claude
committed
c057499
fix(execpolicy): judge gh and npm view reads after a leading cd (#6015)

CodeWhale Bot
and
claude
committed
83eba45
fix(subagent): save the launch-restarted deadline to the worker record (#6015)

CodeWhale Bot
and
claude
committed
0c4b542
test(subagent): gate the readonly_shell_6015 git helper to unix (#6015)

CodeWhale Bot
and
claude
committed
1ef3fdb
test(fleet): build the scout fixtures' credentials with with_legacy_root

CodeWhale Bot
and
claude
committed
b757b52