Document the trust boundary: a tracked HANDOFF.md is input the agent acts on

[jsirish]

What

throughline's SessionStart hook injects HANDOFF.md content directly into a fresh session's
context, and the onboard/handoff skills tell the agent to act on it (next steps, pending
items, etc.). That makes the handoff file executable input, not passive documentation: anyone
who can write to it — including anyone who can push to a repo that tracks it — writes into the
next session's context and, transitively, into what that session does.

README documents an opt-in pattern for tracking HANDOFF.md and logs/ in git (the
allowlist-style .gitignore snippet), and claude-config (this project's own dogfood repo)
actually does this. But nothing in the README, or in the handoff/onboard skill docs, says
what that implies: a tracked handoff is a prompt-injection surface for every future session that
reads it, scoped to whoever can push to that repo.

Prior art

adrrr/persistent-handoff states this plainly in docs/REFERENCE.md#the-handoff-is-input-the-agent-acts-on:

The hook feeds the handoff into a fresh session as context, and the file tells that session
what to do next. Treat it as executable input... A handoff committed to a repo means anyone who
can push there writes into your agent's context, so keep that to repos whose writers you trust.

Their demo's Claude Code trust prompt is deliberately preselected to the option that exits,
specifically because the demo carries a project hook that reads untrusted-ish content.

Fix shape

Add a short "Trust boundary" note, likely near the ## Choose your harness or ## Configuration
section of README.md: state plainly that a tracked HANDOFF.md/logs/ is read back into every
future session's context automatically, so only track it in repos where every writer is trusted
to shape agent behavior — same caution as a tracked CLAUDE.md, but less obvious because the
injection is automatic rather than something the reader opens on purpose.