[furedea]

Summary

Applies the agents/ harness review findings tracked in #148, apart from the items listed under Departures.

Hook adapters

• Moved the logic shared by the Codex, Devin, pi, and Hermes adapters into agents/hooks/lib/provider_adapter.py. Each adapter now only declares a Profile.
• Made the Devin adapter executable. It was mode 100644, so its hooks could not run.
• Fixed where the adapters had drifted apart:
  • All four now pass normalized payloads.
  • The secret-path label is renamed to guard_secret_paths.sh.
  • Hermes no longer mutates its input.
  • Devin and Hermes log session-start compaction only for compact/resume sources.
  • pi compaction events are now recorded.
• The Claude file guard and lint now cover NotebookEdit. The read guard covers Grep when its path is a single file.

Sandbox and permissions

• Claude: every sandbox escape now needs the user's approval, even in auto mode.
  • allowUnsandboxedCommands stays true, because commit signing, push credentials, and the nix daemon cannot be reached from inside the sandbox.
  • Bash(dangerouslyDisableSandbox:true) is an ask rule. With it, auto mode can no longer escape the sandbox on the classifier's approval alone. The rule reaches the installed settings through fix: protect provider files and keep source Claude permission rules agent-harness#140, and flake.lock is bumped for it.
  • The sandbox write allowance used $HOME/.cache/nix, which Claude does not expand, so it never applied. It is now ~/.cache/nix, and ~/.cache/uv is added.
  • excludedCommands entries use globs (gh *, herdr *, docker *, watchman *). An entry without a glob matches only the bare command, so the old entries never applied.
  • herdr commands that drive other panes now ask first. The earlier send rules did not match send-text or send-keys, and agent prompt had no rule, so another agent's approval dialog could be answered without asking.
  • ~/.local/state/agent-harness (verification records) and the dprint cache are writable, so verify runs inside the sandbox.
  • lefthook moves to 2.x (nixpkgs-unstable). 1.13.6 always ran hook commands under a pty, and the sandbox denies that.
• The secret read denials **/*key*, **/*token*, and .env* also matched source files and .envrc. That broke pytest and nix evaluation in the sandbox. They are now limited to credential-shaped names (*.key, *_token, *token*.json, *.pem, .env, .env.*, and so on).
• docker build moves from allow to ask.
• Codex:
  • Removed the unknown remote_connections feature.
  • Kept external_migration, because codex 0.155.1 still reads it.
  • Enabled multi_agent_v2 so its wait timeouts take effect.
• Added git to the manifest runtime_commands.

Nix

• git cc: codex exec --full-auto became -s read-only, because the flag was removed.
• Removed the unguarded opencode package.
• New contracts check both changes.

Skills

• project-setup can now be loaded implicitly.
• PRs are created with an explicit body.
• adr's triggers are now in its description.
• The Issue body, glossary, and completion rules each have a single owner.
• Removed generic or drifted content from tsdd, nix-dotfiles, python-style, rust-style, bash-style, and github-actions-style.
• verify_page.py now detects SVG image/use, embed, track, input type=image, and meta refresh loads.
• test_workflow_skill_layout.py was tied to past changes. It now runs contract tests over every skill: frontmatter, links and anchors, and handoff targets.

Verification selection

• If every changed source of a language is explicitly mapped to another language's tests, that language is no longer planned. For example, agent-harness hook_bridge.ts is embedded with include_str! and tested by Rust. Unmapped sources still require their own runner and fail closed.

Refs #148

Verification

• verification_session.py verify: pytest 1495 passed (full suite), bats 13 passed.
• nix build of the home activation package plus the home-configuration and host-configuration checks succeeded.
• lefthook pre-commit passed on every commit.

Departures

• The AGENTS.md function-size rule was reviewed with the user before it was changed, as a separate step. The 2-4 line and one-level nesting quotas become an intent-based extraction rule, with nesting kept to about two levels.
• Protecting provider files other than Claude/Codex, and isolating the pi bridge interpreter, are handled in fix: protect provider files and keep source Claude permission rules agent-harness#140 (merged). This PR bumps flake.lock to it.
• herdr-delegation was not split into references/. That item was optional.

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.