Skip to content

audit-instructions: lane reports are written with the Write tool or a literal scratch path; unattended runs disclose the dispatch gate #4117

Description

@kyle-sexton

Sub-issue of #4113 (environment fit). Two sentence-level fixes to plugins/claude-config/skills/audit-instructions/SKILL.md, shipped as their own small PR.

Problem

  • A lane that persisted its report through a shell redirect to a variable-carried scratchpad path (> $S/lane.md) was blocked by the guardrails block-hook-bypass guard, which fails closed on a target it cannot resolve. The Write tool and a literal absolute path under the shipped temp-tree exemption are the supported routes, and the skill body says nothing about either.
  • Phase B says "Before the total dispatch count would exceed ~20, confirm with the user." An unattended run cannot ask; the measured run crossed the gate silently and the cost line then claimed "zero new interactive gates". The skill body should state what an unattended run does instead of the question.

Change

  • Phase B: lanes that persist a report write it with the Write tool or to a literal absolute path under the host temp tree, never through a variable-carried shell redirect or inline Python.
  • Phase B: when the caller has declared the run unattended, the ~20-dispatch gate becomes a cost-line disclosure of planned and actual dispatch counts. (The explicit --unattended flag lands with the execution-model unit.)

Acceptance criteria

  • SKILL.md Phase B carries both sentences and states the current rule and its reason.
  • scripts/affected-tests.sh --run passes.

Sources

  • plugins/guardrails/hooks/block-hook-bypass.sh header (shipped temp-tree exemption, variable-carried targets fail closed)
  • code.claude.com/docs/en/sub-agents (background subagents keep Write and Bash)
  • plugins/planning/skills/interview/SKILL.md "Unattended path" (declared by the caller, never sniffed)

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions