Skip to content

[self-audit] Phase 4's anchor-cannot-run guidance doesn't name session-sandbox path restriction as a trigger #90

Description

@dmccoystephenson

Gap found during Phase 9 self-audit (create-dev-loop-dev-loop cycle, PR #89)

Filed here instead of dmccoystephenson/create-dev-loop-dev-loop per #87 — that tracker repo still doesn't exist, so this is the best available substitute audit trail until #87 is resolved.

What happened

PR #89 (fixing #88) only changed create-dev-loop.md's Edge cases prose — no new placeholder, no template logic change. Per Phase 4's anchor-cannot-run gating, since the PR touches template surface, full /create-dev-loop fixture regeneration was still required. Attempting it failed not because a tool/interpreter was absent or broken (the case the guidance names), but because this session's harness sandbox denies filesystem access (ls, etc.) outside the gardener-managed checkout's own working directory:

$ ls ~/local-skills/
ls in '/root/local-skills' was blocked. For security, Claude Code may only list files in the allowed
working directories for this session: '/root/.cache/gardener/repos/dmccoystephenson__create-dev-loop'.

This is a distinct failure mode from the ones create-dev-loop.md's Edge cases entry and this skill's own Phase 4 currently name ("tool/interpreter absent or broken", "docker not installed", "bare python resolving to 2.7"). It's specific to gardener-dispatched sessions, which restrict tool access to the single target repo's checkout by design — the same category of gardener-specific constraint that produced #88.

The UNVERIFIED + do-not-auto-merge + hand-to-human fallback in the existing gating logic worked correctly once I recognized the situation, so this is a wording/recognition gap, not a missing fallback.

Suggested action

Add "the session sandbox restricts filesystem/tool access to the target repo's own working directory (common in gardener-dispatched sessions)" as a named trigger alongside "tool/interpreter absent or broken" in:

  • create-dev-loop.md's Phase 4 anchor-cannot-run paragraph and Edge cases entry (generic template — every generated skill inherits this wording)
  • Existing generated skills' Phase 4 (via the standard retrofit-PR process this project already uses for template-rule promotions)

Provenance

Found during the 2026-07-31 gardener-dispatched cycle that produced PR #89 in dmccoystephenson/create-dev-loop.

Metadata

Metadata

Assignees

No one assigned

    Labels

    template-ruleShould be promoted into create-dev-loop.md

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions