Subagent-public floor: the no-entitlement spawn+dispatch fixture + entitlement-freedom guards (ADR-0004 decision 1)

[aarontrowbridge]

Important

Problem — The subagent surface is public by boundary ruling (ADR-0004: the amico_session spawn tool + subagent dispatch infra are pre-pay product, never premium), and the audit of its staging confirms the path is clean today: the tool registers unconditionally in the opencode plugin, the spawn policy is pure, base cards stage complete with no entitlement, and the issimo entitlement gates only the HP solver tier + premium overlays. But nothing MECHANICALLY pins this: a future change could quietly hang an entitlement read on the spawn path or a premium-only role on the dispatch path, and no test would go red. The boundary ruling needs its floor.
Approach — Land the no-entitlement subagent-dispatch fixture ADR-0004 names: behavioral tests asserting spawn + dispatch fully functional with an empty entitlements config, plus source-level regression guards (the repo's existing blocklist-grep test discipline) asserting the spawn/dispatch staging path carries no entitlement reads.
Scope — in: the fixture (spawn registers + executes with no entitlement; a spawned child dispatches through a worker base card with no entitlement; the entitlement-freedom guards over the plugin's tool registration + spawn policy sources). · out: any behavioral change to the tool or the cards (the audit found none to make); the MCP harness refusal (harness-coupling, not entitlement — already honest); coordination surfaces (premium, amicissimo lane).

Acceptance Criteria

• With an empty entitlements config (no amicissimo/premium codes), the amicode_session tool registers and a spawn executes end-to-end (double/mock client, honest counts + metadata stamps) — PASS with zero entitlement presence
• With the same empty config, a spawned child dispatches through a staged worker base card (e.g. implementer) — base cards staged complete, no overlay fields, no missing-target errors (may compose with the existing base-alone staging test rather than duplicate it)
• A regression guard asserts the spawn/dispatch staging sources (tool registration + spawn policy) contain no entitlement/premium reads — the blocklist-grep discipline, so a future entitlement read in those files goes red with a message naming the boundary ruling
• The audit record lands in the PR body (what was audited, what was found clean, what the fixture pins) citing the feat(session): amicode_session tool — spawn sessions as background tabs #641 lineage

Testing Decisions

Reuse: session_spawn.test.ts's double/mock patterns, mode_cards_staging.test.ts's entitlements.toml fixture-dir pattern, the worker-card floor tests' blocklist discipline. No new suites — extend the existing files or add one focused fixture file.

Key Decisions

• The audit found the public path COMPLETE — this slice pins it, it does not change behavior. If the fixture's construction reveals a genuine residue the audit missed, STOP and surface it in the issue before fixing: the ruling's first implementation report must be honest.
• The MCP-floor refusal (spawn refuses on non-opencode harnesses) is harness-coupling, not entitlement gating — out of scope, already honest.

Constraints & Invariants

• The boundary ruling is law: subagent functionality never entitlement-gated. The fixture is its enforcement, not its justification.
• Worker cards stay complete-without-entitlement (the existing floor tests hold this; the new fixture adds the dispatch-through dimension).

Prior Art

ADR-0004 (amicissimo, decision 1 — the named harness); #641 (the tool's landing + lineage); #761 (the card staging + its base-alone test); the blocklist/proprietary-strings floor tests; session_spawn.test.ts's 20-test policy suite.

Source

Campaign slice 2 per the fleet-amicissimo-forksplit work order. ADR-0004's decision-1 harness is assigned here. Related: amicissimo#380 (fleet overlay — the OTHER premium plane), #356 M5 (coordination — premium, never in this surface).

Notes

Label hitl — human merge gate. Worktree off origin/main; the shared checkout's branch is never touched.