Observed in the real run's transcript (#18). CLAUDE.md describes the session as one that "may only edit files and commit", and ALLOWED_TOOLS/DENY_READS are written as if they define the whole surface. They do not — they gate Bash/Read/Edit/Write, but the headless claude -p process still carries the harness's own built-ins.
The transcript shows the worker calling ToolSearch and ScheduleWakeup, and backgrounding commands into /tmp/claude-1000/-tmp-mythings-ws-.../tasks/. ScheduleWakeup in particular is meaningless for a worker whose lifetime is bounded by --session-timeout-s: the session used it to poll a backgrounded install, spending turns on a mechanism that cannot outlive it.
Nothing here escaped the filesystem sandbox, so this is a contract/observability gap rather than a breach — but "edits and commits only" is not an accurate description of what the session can do, and the turn budget is being spent on built-ins nobody accounted for.
Acceptance criteria
CLAUDE.md describes the real surface: the allowlist governs tool invocations of the gated kinds, and the session additionally has the harness built-ins.- Built-ins that are incoherent for a bounded headless worker are disabled where the CLI supports it, or the prompt tells the session not to use them.
- The prompt steers the session away from backgrounding-and-polling, which cannot pay off inside a single bounded run.
Observed in the real run's transcript (#18).
CLAUDE.mddescribes the session as one that "may only edit files and commit", andALLOWED_TOOLS/DENY_READSare written as if they define the whole surface. They do not — they gateBash/Read/Edit/Write, but the headlessclaude -pprocess still carries the harness's own built-ins.The transcript shows the worker calling
ToolSearchandScheduleWakeup, and backgrounding commands into/tmp/claude-1000/-tmp-mythings-ws-.../tasks/.ScheduleWakeupin particular is meaningless for a worker whose lifetime is bounded by--session-timeout-s: the session used it to poll a backgrounded install, spending turns on a mechanism that cannot outlive it.Nothing here escaped the filesystem sandbox, so this is a contract/observability gap rather than a breach — but "edits and commits only" is not an accurate description of what the session can do, and the turn budget is being spent on built-ins nobody accounted for.
Acceptance criteria
CLAUDE.mddescribes the real surface: the allowlist governs tool invocations of the gated kinds, and the session additionally has the harness built-ins.