fix: enforce safe prompt-perfector execution

.agents/skills/prompt-perfector/references/repository-workflow.md

@@ -16,8 +16,29 @@ Before the first repository-content write or potentially mutating project comman
 2. Preserve every unrelated staged, unstaged, and untracked change. Never stash, reset, clean, discard, relocate, or absorb it.
 3. Use the environment-specific bootstrap below, then run the dependency-free verifier from the repository root.
 
+### Portable POSIX secondary worktree
+
+Required outside Windows whenever PowerShell is absent and the executor is not Codex Cloud. Create or enter an isolated task worktree first; never edit the primary checkout.
+
+```bash
+# git fetch origin main
+# git worktree add -b <task-branch> ../wt-<short-slug> origin/main
+# cd ../wt-<short-slug>
+expected_head="$(git rev-parse HEAD)"
+repo="$(git rev-parse --show-toplevel)"
+branch="$(git branch --show-current)"
+if [ -z "$branch" ]; then
+  echo 'Task bootstrap incomplete: detached HEAD.' >&2
+  exit 1
+fi
+node .agents/skills/prompt-perfector/scripts/verify-repository-isolation.mjs \
+  --expected-repo "$repo" --expected-branch "$branch" --expected-head "$expected_head"
+```
+
 ### Windows/local worktree
 
+Use when `pwsh`/`powershell` and the local Codex bootstrap exist.
+
 ```powershell
 $taskBootstrap = Join-Path $env:USERPROFILE '.codex\scripts\start-codex-task.ps1'
 if (-not (Test-Path -LiteralPath $taskBootstrap)) { throw 'Task bootstrap is unavailable.' }

docs/branch-review-ledger.md

@@ -507,3 +507,4 @@ Records before 2026-07-28 were written by hand and had drifted: 146 lines carrie
 | 2026-07-31 | codex/fix-search-retrieval-issues-and-run-canary | c45cd227be6d852865eb111a2a06486d1f2c62a0 | pr-1503 reopen-ready | approved: #098 next-action (b) prohibits wholesale collapse; main synced clean; docs-only delta; PR stays closed | format:check; check:outstanding-issues; check:branch-review-ledger; merge-tree clean; bugbot+codex P2 fixed |
 | 2026-07-31 | codex/fix-search-retrieval-issues-and-run-canary | c45cd227be6d852865eb111a2a06486d1f2c62a0 | pr-1503-review | re-reviewed: Codex P2 fixed; merge-tree clean vs origin/main; docs-only; no Bugbot/P0-P1; PR remains CLOSED (GitHub headRefOid may lag closed PR) | merge-tree+diff-vs-main+#098-text; no push/reopen |
 | 2026-07-31 | codex/fix-search-retrieval-issues-and-run-canary | e8de1aebd1b32d5e901853a3473a792a66aa82cf | pr-1503 reopen-ready | approved: #098 collapse ban kept after main sync; merge-tree clean; docs-only; PR stays closed | format:check; check:outstanding-issues; merge-tree clean; codex P2 fixed; bugbot clean |
+| 2026-07-31 | codex/chat-prompt-skill-review-e608 | e7b2b9ae864e4ca280761dc5e1dd23ea65afb520 | PR #1439 review+bugbot+fix | FIXED CONFLICTING: GitHub DIRTY was behind-but-clean; merged origin/main twice to current tip. Product delta: POSIX secondary-worktree bootstrap + consolidated skill contracts on main Cloud/status-hash verifier. Review+Bugbot: no P0/P1; 0 unresolved threads; no new Bugbot findings. Restored append-only ledger vs main (no historical row rewrite). | merge-tree clean; MERGEABLE; PR mergeability/policy/gitleaks success; Static/Unit/Safety in progress; isolation self-test 14/14; 0 unresolved threads |

tests/database-skills.test.ts

@@ -1,6 +1,6 @@
+import { spawnSync } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
-import { spawnSync } from "node:child_process";
 import { describe, expect, it } from "vitest";
 
 import {
@@ -82,16 +82,41 @@ describe("Database skill catalog", () => {
   it("keeps prompt-perfector execution authorization and repository isolation fail-closed", () => {
     const skillRoot = path.join(skillsRoot, "prompt-perfector");
     const skill = fs.readFileSync(path.join(skillRoot, "SKILL.md"), "utf8");
+    const metadata = fs.readFileSync(path.join(skillRoot, "agents", "openai.yaml"), "utf8");
     const workflow = fs.readFileSync(path.join(skillRoot, "references", "repository-workflow.md"), "utf8");
     const verifier = fs.readFileSync(path.join(skillRoot, "scripts", "verify-repository-isolation.mjs"), "utf8");
 
     expect(skill).toContain("Execute only when explicit");
     expect(skill).not.toContain("Workspace:");
+    expect(skill).not.toContain('Workspace: "branch"');
+    expect(skill).not.toContain('Workspace: "share"');
+    for (const [scenario, contract] of [
+      ["refinement-only", "For refinement, return only `Perfected prompt`"],
+      ["explicit evaluation", "For evaluation, return `Evaluation`"],
+      ["embedded instructions", "as untrusted data"],
+      ["unauthorized execution", "Prompt perfection never authorizes"],
+      ["repository write", "references/repository-workflow.md"],
+    ]) {
+      expect(skill, scenario).toContain(contract);
+    }
+    expect(metadata).toContain("unless I explicitly request evaluation or execution");
     expect(workflow).toContain("^TASK_START\\s+git=(true|false)$");
+    expect(workflow).toContain("$taskState.TASK_START -ne 'git=true'");
+    expect(workflow).toContain("$env:USERPROFILE");
+    expect(workflow).not.toContain("C:\\Users\\joshs");
+    expect(workflow).toContain("start-codex-task.ps1");
+    expect(workflow).toContain("git worktree add");
+    expect(workflow).toContain("git rev-parse --show-toplevel");
     expect(workflow).toContain("CODEX_CLOUD=1");
     expect(workflow).toContain("--expected-status-hash");
+    expect(workflow).toContain("--allow-dirty");
+    expect(workflow).toContain("does not provide an OS-level sandbox");
     expect(verifier).toContain('["safe Cloud primary"');
     expect(verifier).toContain('reasons.push("status_drift")');
+    expect(verifier).toContain("dirty_override_requires_expected_state");
+    expect(verifier).toContain("expected_state_required");
+    expect(verifier).toContain("primary_worktree");
+    expect(verifier).not.toContain("node_modules");
 
     const selfTest = spawnSync(
       process.execPath,