v0.6.1

Security fix. If you run auto on v0.6.0 or earlier, upgrade. Measurement
L-REF re-ran v0.6.0's own argv on the same machine while validating this
release: it still breached, 1 of 1.

What was wrong

auto maps a planned node onto one of your Claude Code agents. To let
--agent resolve at all, applyAgentMapping handed that node your settings
back — one line, policy.SettingSources = nil. Three consequences, all
measured on shipped code in v0.6.0 (ADR 0017 measurement (j), 18 spawns):

• The scope ceiling did not hold. An out-of-scope command ran with
  permission_denials: [], while the in-scope positive control passed — so a
  node declaring Bash(git *) could run a non-git command if your own
  settings allowed one.
• The repository being worked on could supply invocable procedure text. A
  SKILL.md committed to a fixture repo fired 3 of 3 with the prompt naming
  no skill.
• The staged corpus lost its own bare name to a settings-scoped
  definition, so the corpus the engine hashes and seals was not the one read.

v0.6.0 disclosed all three per node. This release closes them.

What changed

The matched agent's definition is copied into the run directory and supplied
through --plugin-dir, so layer 1 stays --setting-sources "" for every
planned node, mapped or not. ADR 0022. The scope ceiling is measured closed
(K-CEIL / L-CEIL: 0 breaches of 3 and of 3, with positive controls
passing), and a repository's own .claude/ no longer reaches a mapped node.

A side effect worth naming: toolsBeyondCeiling is now stronger. The
scanned bytes are pinned by hash, so the file the CLI reads is the file that
was checked — previously the agent file was re-read at spawn time, and that
window was open.

And a hole this change opened before it shipped

The first version of the staging scanned <cwd>/.claude/agents as well as
~/.claude/agents, and project shadows user. A repository could therefore
have supplied a mapped node's system prompt — and now through
oh-my-graph's own --plugin-dir, which --setting-sources "" structurally
cannot shut, unlike the CLI discovery path it replaced.

Review caught it, measurement (l) confirmed it (L-PRE: the marker carried
the repository's token, 2 of 2), and the fix is that only ~/.claude/agents
is scanned (L-FIX: user 3 of 3, repository 0 of 3). This is recorded here
rather than quietly repaired, because a reader who later finds (l) in the tree
and no mention of it in this changelog would learn the wrong thing about how
this project reports on itself.

It is injection, not escalation. Layer 1 was "" in both arms and the
declared tool list still bound — a mapped node could be given a different
system prompt, not wider permissions.

---

All 40 spawns across (j), (k) and (l) — pre-registrations, raw tool-use
records, argv captures and ceiling artifacts — are committed under
docs/measurements/.

Install: go install github.com/jitokim/oh-my-graph/cmd/oh-my-graph@v0.6.1

Full changelog: https://github.com/jitokim/oh-my-graph/blob/v0.6.1/CHANGELOG.md