firewall: let the samplers faculty name the autolens lane tiers

[Jammy2211]

Mind-side companion to PyAutoBrain#216, which teaches the samplers faculty's SamplerSurface to scan the findings maturation lane's experiment (autolens_workspace_developer/searches_minimal) and mature (autolens_profiling) tiers — closing the "Surface gap, filed" note the faculty carried in its own AGENTS.md.

Prompt: draft/feature/pyautobrain/samplers_surface_autolens_tiers.md

Why this repo is involved at all

Naming either repo in _samplers.py / samplers.sh trips the tenant firewall. Both files are pinned in FIREWALL_ALLOWLIST to their current three tokens, and a new instance fact in an allowlisted file is drift.

Verified rather than assumed — running scripts/repos_sync.py --check before the edit flagged exactly those two files and nothing else:

✗ PyAutoBrain/agents/faculties/samplers/_samplers.py: new instance fact(s) in allowlisted file
    — 'autolens_profiling' (line 91), 'autolens_workspace_developer' (line 90)
✗ PyAutoBrain/agents/faculties/samplers/samplers.sh:  new instance fact(s) in allowlisted file
    — 'autolens_profiling' (line 33), 'autolens_workspace_developer' (line 32)

Both are clear after this change.

Why growing entries is the right form here

This grows two existing entries rather than adding new ones, which is what the surrounding comment permits — a new entry means a new file an adopting fork must rewrite, and there is none here. Brain's new tests/test_samplers_surface.py takes its tier labels from module constants precisely so it needs no entry of its own.

Also

Records PyAutoMind in the prompt's Repos: header. It listed only PyAutoBrain, which is not implementable as written — the firewall makes this a two-repo change — and adds a short note in the body explaining why, so the constraint is visible to whoever reads the prompt next.

Noted, not fixed

scripts/repos_sync.py --check also reports one pre-existing mismatch unrelated to this change: PyAutoBrain/tests/test_worktree_conflict_guard.py names 7 repos and has no allowlist entry. It landed in PyAutoBrain 13d222c (#215). The check is not wired into any CI workflow — it needs all sibling checkouts — which is how it slipped through. Left alone deliberately: adding a new file entry is the consequential form the code warns against, and that call belongs with the author of that test.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WSCA1h6cSKMNwFmWEsxuCL

---

Generated by Claude Code