[developerz-ai]

What

.claude/settings.json permitted gh pr view, gh run list and
gh run view but not gh issue list / gh pr list. A box taking the
release-due brief hit its own "never file a second ask" rule and could
not run the read that rule needs, so it stalled or filed a duplicate.

Grant both, and name the query at .dz/briefs/release-due.md:34 so the
grant matches a command the brief actually runs. .dz/briefs/health.md
already used both commands the same way.

Acceptance

• .claude/settings.json permissions.allow contains the exact strings "Bash(gh issue list:)" and "Bash(gh pr list:)", and the file still parses as JSON (bunx biome check .claude/settings.json).
• The three pre-existing gh entries ("Bash(gh pr view:)", "Bash(gh run list:)", "Bash(gh run view:*)") and the PostToolUse biome hook block are unchanged.
• .dz/briefs/release-due.md's never-file-a-second-ask line names an explicit gh issue list query (its exact argv, with the placeholder), so a reader can run it verbatim.
• Every gh command named in .dz/briefs/release-due.md and .dz/briefs/health.md is covered by a permissions.allow entry — health.md's gh issue list and gh pr list at lines 17-18 are now permitted.
• packages/cli/src/templates/scaffold-claude.ts is untouched — the change is to the repo-root .claude/settings.json only, not the template x new writes into a new app.

Changes

• .claude/settings.json (edit) — Add "Bash(gh issue list:)" and "Bash(gh pr list:)" to permissions.allow, in the gh group after line 19's "Bash(gh run view:*)", keeping valid JSON, 2-space indent and a trailing-comma-free last entry.
• .dz/briefs/release-due.md (edit) — Rewrite the line-34 rule "Never file a second ask while one titled Release … is open" so it names the exact read the box must run — a gh issue list query over open issue titles for Release <next> — so the new grant matches a command the brief actually runs. Match the table style already used in .dz/briefs/health.md:17-18.

Verification

bun run verify passed (exit 0) in 1h 06m 04s.

Notes

Premises of the request the team disproved:

• The ask implies the dedupe lives in code that could read issues. It does not: scripts/release-due.ts never invokes gh, and openReleaseAsk (scripts/lib/release-due-rule.ts:139) is pure over titles the caller supplies — DueInput.openIssueTitles (:55) is optional, only the test passes it. So there is NO script to widen; the brief text and the permission are the whole fix.
• The advisory list implied .claude/settings.json is the only settings file. It is not: packages/cli/src/templates/scaffold-claude.ts:130 emits a second one (the x new scaffold, asserted by scaffold-claude.test.ts:38,131). Out of scope, but an editor grepping "settings.json" will find it and must not edit it.

---

🤖 Opened by developerz.ai for task tsk_ed59b9e5c6829472e14a96a722ee559a on developerz-ai/ultimate.

Raised automatically by the raw_task_triage lane.

🤖 developerz.ai, an automated agent, not a human — this PR is one slice of a stacked plan.
Dispatched automatically by the raw_task_triage lane
Model MiniMax-M3 on router.ai.developerz.ai via native, funded by account_key
Ran on box hv-dedicated-dev-marshall
Cost unknown: no list price on record for MiniMax-M3 on router.ai.developerz.ai
Run timeline run_da54cf9bee7b4b1686f47aabeb28bfb2
Part 1/1 of plan rtk_24fc246405b74295ba8e5aa45201784a

[developerz-ai]

Add gh issue list (and gh pr list) to .claude/settings.json allow list

• Picked up
• Surveying the repo — 2026-10-19 17:40 UTC
• Working — 2026-10-21 08:49 UTC
• Pull request opened — chore(dz): allow the tracker reads the briefs already name #823 — 2026-10-21 09:59 UTC
• Done

Work landed on #823 — watching it toward merge.

108h19m · 46 tool calls · 3 messages

Sessions: coding run

---

🤖 developerz.ai, an automated agent, not a human — hv-dedicated-dev-marshall (developerz-ai[bot]) · model MiniMax-M3 on router.ai.developerz.ai

[developerz-ai]

✅ Reviewed — nothing blocking

0 actionable comment(s) · grounded on your code

_{⚠️ 1 config note(s): test files were not shown to the reviewer — this diff touched no path recognised as a test, so no assertion was available to read the change against}

_{⏱ 7m 46s wall clock · gpt-6.1-sol via router · 1 model call(s) · 206 output token(s)}

_{🤖 developerz.ai — automated review, running on your model and your box.}

[developerz-ai]

Review summary — 2 file(s), 0 finding(s).

Completed review [bot]: adds tracker-read permissions and an explicit release-ask lookup. The supplied diff preserves the existing permissions and hook, keeps valid JSON, and shows no actionable defects.

Config notes

• test files were not shown to the reviewer — this diff touched no path recognised as a test, so no assertion was available to read the change against

---

🤖 developerz.ai review — automated, running on your model and your box. What is this?
Reviewed by router/gpt-6.1-sol on box hv-dedicated-ci-1 — 14.7k in / 206 out over 1 call; cost unknown: no price on record for router/gpt-6.1-sol.