Session Handoff [engineering]: Guard gh-Target Rewrite and Windows Loader Fixes Released as 2.0.1069, gh-Target Follow-Ups Next #3152

Next steps, in priority order

1. The guard's gh-target follow-ups, one lane in gh-write-guard.py. Read a gh Write's Subcommand and Target the Way gh Parses Them #3135 now finds gh's command and subcommand the way gh itself does. Build on that reading for Read an Inherited GH_REPO From the Session Environment in the Write Guard #3147 (an inherited GH_REPO from the session environment), Read a Run-Time Word Before gh's Command and a Bare GH_REPO export in the Write Guard #3136 (a run-time word before gh's command, a bare export GH_REPO), Read a gh Write Behind a Run-Time Command Word in the Write Guard's Target Check #3131 (a gh write behind a run-time command word), Read a GH_REPO Only in the Wrapper Body It Reaches in the Write Guard #3144 and Close Three Small GH_REPO and Merge-Message Gaps in the Write Guard #3145 (small gaps Read a gh Write's Subcommand and Target the Way gh Parses Them #3135 introduced), Read a Positional Repository and the Missing Write Subcommands in the Write Guard #3133 (a positional repository, missing write subcommands), and Read a gh api Write Target Outside a repos/ Path in the Write Guard #3132 (gh api targets outside repos/). Leave a Literal gh Target Inside Heredoc Data Unread in the Write Guard #3134 (heredoc data read as a command) is an over-deny, so it waits for step 3. Done means a merged PR into develop with a develop-versus-branch differential and a revert proof.
2. The guard's remaining allow gaps, one lane at a time, all in gh-write-guard.py. Grouping carried from Session Handoff [engineering]: Three Lanes and Two Promotions Released as 2.0.1049 and 2.0.1051, gh Write-Target Guard Lane Next #3094:
   • Config and alias reads: Read Push Config a Command Rewrites Before the Push in the Write Guard #3046, Tell a Timed-Out Persisted Alias Read From No Alias in the Write Guard #3047, Deny a Hooks-Path Override on Git Commands Other Than Commit or Push in the Write Guard #3055, Read a HOME or XDG_CONFIG_HOME Override on a Git Command as an Unread Config File in the Write Guard #3057, Read Environment Config Per Git Command, Not by Index Across a Reading, in the Write Guard #3072, Read a Git Alias From the Repository Git Runs In for Rule 6 and a Wrapper's GIT_DIR in the Write Guard #3078, Read a Git Alias Expansion Past Its Leading Global Options in the Write Guard #3081.
   • Push targets: Judge a Push to Another Remote Against That Remote's Repository in the Write Guard #3048, Read a Bare Push Under push.default=matching as Updating Every Matching Branch in the Write Guard #3053, and Close the Write Guard's Remaining Push Detection Gaps Found Reviewing the #2936 Fix #2943's remaining items.
   • Directory values, tokenizer, launchers and wrapper bodies: Read Carriage Returns, Folded Lines, Eval, and Globs in a Directory Value in the Write Guard #2995, Read Commands a Quote Pair Spanning Two Comments Hides in the Write Guard #2991, Read Every Launcher in Front of a Push in the Write Guard #3050, Read a Foreign Shell Behind a Launcher the Write Guard Does Not Know #3083, Carry Environment Through an Unknown Launcher to the Git It Runs in the Write Guard #3085, Read a Command String env -S Runs in the Write Guard #3090, Fail Closed on Words xargs Appends to a Merge, Commit, or Push in the Write Guard #3074, Read a Double-Quoted Wrapper Body's Run-Time Words as Splittable in the Write Guard #3075.
   • Shells, case and encoding: Decode a PowerShell -EncodedCommand Body in the Write Guard #3056, Match push.default Case-Sensitively in the Write Guard or Say It Is Folded #3061, Read Git's Environment Variable Names Without Case on Windows in the Write Guard #3086, Read cmd and PowerShell Run-Time Words as Run-Time Words in the Write Guard #3091, Close Four Hidden-Command Allow Gaps the Promotion's Third Review Found in the Write Guard #3088.
   • Commit option clusters: Read a Commit Cluster With an Attached Value as Taking No Next Word in the Write Guard #3068, Read Short-Option Clusters Through One Primitive in the Write Guard #3071 (the new cluster reader from Read a gh Write's Subcommand and Target the Way gh Parses Them #3135 is named on Read Short-Option Clusters Through One Primitive in the Write Guard #3071 as a site for its shared primitive), and Deny the Remaining core.hooksPath and no-verify Bypass Routes in the Guard #2177's alias item.
3. The guard's over-denials, after step 2: Narrow Three Write-Guard Reads That Deny More Broadly Than Git Pushes #2953, Scope a Branch Pattern's Push Operations to the Branches It Can Match in the Write Guard #2964, Read Only an Eval That Runs in the Write Guard's Include Reading #2975, Keep the Write Guard's Terminal-Option Exception When a Redirection Precedes the Option #2981, Write Guard Denies Heredoc Data Inside an Unquoted Backtick Substitution #3000, Read a Commit's Exact -n as a Value Where It Follows a Value Option in the Write Guard #3070, Read a Process Substitution as One Word in the Write Guard's Commit and Merge Walks #3073, End a Merge's Words at a Comment in the Write Guard's Run-Time Check #3076, Read Quoting the Write Guard's Quote-Keeping Lex Cannot Align #3084, Leave a Literal gh Target Inside Heredoc Data Unread in the Write Guard #3134. Then Move the Write Guard's Option-Prefix, Eval-Reading, and Cluster Sites Onto One Helper Each #3008, helper consolidation, last.
4. Non-guard lanes, which run beside the guard lanes: Reject a Dash-Prefixed Agents Name Before the Handoff to Install-Agents #3129 (a dash-prefixed -Agents name binds install-agents' -All switch, on both loaders), Test the Docker Task Workflow's Credential Check, Login, and Hook Inputs #3148 (test the Docker task workflow's credential check, login, and hook inputs), and Smoke-Build a Dispatched Run of the Smoke Caller Snippet Past Its Paths Filter #3149 once its question is answered (see the parked queue).

External blockers

• None. CodeRabbit is rate limited and advisory, so it isn't worth waiting on.

Internal dependencies

• Steps 1 and 2 run one lane at a time, since each edits gh-write-guard.py. Each lane claims both agent-safety READMEs along with the guard. Brief the claim to cover every file the fix needs, because a commit outside the claim gets refused as "Modify Shared Resources".
• Step 3 runs after step 2, because narrowing a deny while allow gaps are still open has repeatedly opened a new allow in the same reader.
• Move the Write Guard's Option-Prefix, Eval-Reading, and Cluster Sites Onto One Helper Each #3008 goes last, because moving shared sites onto helpers rewrites lines every other guard lane edits.
• Start a guard lane after any promotion it would wait behind has merged. A lane held at READY beside a promotion that draws guard fixes goes CONFLICTING.

State

• Promotion Promote the Write Guard's gh Target Reading and the Windows Bootstrap Fixes to Main #3146 merged with --merge (main 908b4a8a). Released as 2.0.1069 (run 38939137665, success).
• The installed Skills snapshot is current at 908b4a8a. The agent-safety kit on this machine reads STALE against the promoted guard. Its installer rewrites hooks and settings, so it was reported to the maintainer rather than run (see the comment).
• No open pull requests from this lane. Match Tool Names and the all Keyword by Case in the Windows Agents Loaders #3130 and Read a gh Write's Subcommand and Target the Way gh Parses Them #3135 merged into develop and were promoted. Their remote branches were deleted through pr_review.py cleanup, each confirmed by reading the ref back, and their worktrees and local branches were removed.
• The maintainer's Windows agent landed Release the Bootstrap Lock When a bootstrap.ps1 Run Ends #3139 (fixes Release the Bootstrap Lock When a bootstrap.ps1 Run Ends, Not When Its Process Does #3137) and closed Run the Windows-Native Check for the Case-Sensitive Agents Keyword From #3130 #3138 with native results. Both were promoted in Promote the Write Guard's gh Target Reading and the Windows Bootstrap Fixes to Main #3146.
• The primary checkout is on develop, clean, fast-forwarded.
• Merged feature/auto-* worktrees from other lanes still sit locally. This lane did not touch them.
• Other tracks' open handoffs are untouched: Session Handoff [windows]: #2578 Landed for #694, Closing Through Promotion #2580, #1171 Next #2581 (windows), Session Handoff [host-instructions]: Hardening Rule and Merge Guard Released as 2.0.867 and 2.0.868, #2499 Docstring Next #2514 (host-instructions), Session Handoff [default]: Four Follow-Ups Landed and Released as 2.0.826, Downstream Adoption Next #2361 (default), Session Handoff [python-contract]: Escaped and Folded python-directories Values Refused, Released as 2.0.738 #2014 (python-contract).

The parked decision queue

There are 0 open decision issues. This round asked three questions in session, all answered with the recommendation: squash-merge #3135 after the classifier refused it as "Merge Without Review" (merged), how #3079 treats a run-time repository value (fail closed only when the owner is run-time, recorded on #3079), and merge and release #3146 (merged and dispatched). #3149 carries an open question with no decision label. It is put to the maintainer at this close, and the answer is recorded in a comment.

What the last round did

• Two lanes, one Windows hand-off, and a promotion:
  • Match Tool Names and the all Keyword by Case in the Windows Agents Loaders #3130 (Sonnet) closes Align the Case of all in the Linux and Windows Agents List Parsing #3065: Windows matches the all keyword and tool names case-sensitively, as Linux does.
  • Read a gh Write's Subcommand and Target the Way gh Parses Them #3135 (Opus) closes Read a Repo Flag Placed Before the gh Subcommand in the Write Guard's Target Check #3093, Read a gh Write Subcommand Past Flags Between pr and It in the Write Guard #3080, Read a gh Short-Option Cluster Ending in -R as a Target in the Write Guard #3067, Read GH_REPO as a gh Write's Target in the Write Guard #3089, Fail Closed on a Run-Time Repo Value on a gh Write in the Write Guard #3079, and Fail Closed on a Run-Time gh Command or Subcommand Word Beside --admin in the Write Guard #3069: a cobra-style reading of a gh write's command and subcommand past the flags before each, GH_REPO as a target, a run-time owner failing closed, and a run-time word in the gh, pr, or merge position failing closed. Differential over 1,821 constructed commands: 461 flips, each assigned to an issue. 55 new self-tests.
  • The maintainer ran the Windows check. ALL was refused, and a second run in the same pwsh session was refused the lock, which was filed as Release the Bootstrap Lock When a bootstrap.ps1 Run Ends, Not When Its Process Does #3137. Run the Windows-Native Check for the Case-Sensitive Agents Keyword From #3130 #3138 was filed for the remaining native check. The maintainer's Windows agent fixed Release the Bootstrap Lock When a bootstrap.ps1 Run Ends, Not When Its Process Does #3137 in Release the Bootstrap Lock When a bootstrap.ps1 Run Ends #3139 and closed Run the Windows-Native Check for the Case-Sensitive Agents Keyword From #3130 #3138 with results under both pwsh 7 and 5.1.
  • Promotion Promote the Write Guard's gh Target Reading and the Windows Bootstrap Fixes to Main #3146 needed no fix round and was released as 2.0.1069. Its findings were filed as pre-existing or declined with evidence. It closes 22 issues.
• Filed: Reject a Dash-Prefixed Agents Name Before the Handoff to Install-Agents #3129, Read a gh Write Behind a Run-Time Command Word in the Write Guard's Target Check #3131-Leave a Literal gh Target Inside Heredoc Data Unread in the Write Guard #3134, Read a Run-Time Word Before gh's Command and a Bare GH_REPO export in the Write Guard #3136, Release the Bootstrap Lock When a bootstrap.ps1 Run Ends, Not When Its Process Does #3137, Run the Windows-Native Check for the Case-Sensitive Agents Keyword From #3130 #3138, Read a GH_REPO Only in the Wrapper Body It Reaches in the Write Guard #3144, Close Three Small GH_REPO and Merge-Message Gaps in the Write Guard #3145, Read an Inherited GH_REPO From the Session Environment in the Write Guard #3147, Test the Docker Task Workflow's Credential Check, Login, and Hook Inputs #3148, Smoke-Build a Dispatched Run of the Smoke Caller Snippet Past Its Paths Filter #3149.

What not to repeat

• A paste-ready native check for a fix still on develop, written without -Ref develop. bootstrap.ps1 fetches its tooling from main by default, so Match Tool Names and the all Keyword by Case in the Windows Agents Loaders #3130's own check block would have tested the unfixed install-agents.ps1. A check block for unpromoted work names -Ref develop and runs from a develop checkout.
• Two ./bootstrap.ps1 runs in one interactive pwsh session on a host older than 2.0.1069. The second is refused the lock (Release the Bootstrap Lock When a bootstrap.ps1 Run Ends, Not When Its Process Does #3137, now fixed). Native check blocks run each command as pwsh -File so they don't depend on the fix.
• A run-time --repo $R on a gh pr merge from the main seat. The installed guard denies it, correctly. Write every word of a merge out literally.
• Receipt after an unreviewed commit. Match Tool Names and the all Keyword by Case in the Windows Agents Loaders #3130's lane recorded its local-review receipt at a digest that included a test-only commit the pass never read. The brief already says to record after the pass. Restate it at spawn as "re-run the pass after any commit that follows it".

New learnings

• A promotion lane told to file pre-existing gaps rather than fix them converged with zero fix rounds again (Promote the Write Guard's gh Target Reading and the Windows Bootstrap Fixes to Main #3146), after Promote the Write Guard's Option Readings and the Linux Agents List Check to Main #3092. The promotion brief in this round is the shape to reuse: a guard finding is probed against main's guard first, and only a develop-introduced defect gets a fix PR, with at most two fix rounds.