source-control: the review-discipline finding-extractor subagent prompt has the same worktree-cwd gap #704 fixed one level up

[kyle-sexton]

This was generated by AI on operator direction.

Lane: work (issue-execution loop) · Category: operational (correctness/safety gap)

Observation

Surfaced by review on #1299 (which closes #704). #704 anchored babysit-prs's Worker Contract and Worker Prompt Template so a dispatched worker never relies on cwd persisting across tool calls. That protects the worker itself — but not the subagent the worker is required to dispatch.

plugins/source-control/reference/review-discipline.md mandates a finding-extractor subagent whenever a single PR comment carries 3+ findings ("MANDATORY subagent dispatch for multi-finding comments"). Its verbatim dispatch prompt substitutes only <PR>, <COMMENT_ID>/<REVIEW_ID>, and <BRANCH>, and its ALLOWED scope reads:

- `Read` / `Grep` / `Glob` against the repo working tree
- `Bash` for git inspection (`git show`, `git log`, `git diff`) — NEVER state-mutating

No worktree path, no anchoring rule. So the extractor can read and grep the session's default checkout, return per-finding evidence from the wrong branch, and have that ledger consumed as the parent worker's D1–D4 result — precisely the failure #566/#702/#704 exist to prevent, one dispatch level down.

Why it was deferred rather than folded into #1299

review-discipline.md is the plugin-scope shared seam, consumed by both /source-control:babysit-prs and /source-control:pull-request's monitor phase. #704's brief is scoped to babysit-prs's Worker Contract; changing the shared seam widens blast radius into a second lane whose usage needs its own review. The gap also predates #1299 rather than being introduced by it.

Suggested direction (not yet evaluated)

Add a <WORKTREE> substitution slot to the extractor dispatch prompt carrying the absolute worktree path, and state the same anchoring rule the #704 contract now uses — absolute worktree-prefixed paths for Read/Grep/Glob, git -C <worktree> for the git-inspection commands. Verify the pull-request monitor lane, which does its own gh pr checkout rather than using a dedicated worktree, is either covered by the same wording or explicitly exempted.

Related

• source-control:babysit-prs: Worker Contract has the same worktree-cwd-persistence gap #566 fixed in implement-dispatch #704, docs(source-control): anchor babysit worker commands to the worktree path #1299 — where this surfaced; the fix one level up
• loops/work: Bash tool cwd does not persist across calls despite tool docs — caused a worker's edits to land in the canonical checkout #566, docs(implementation): require worktree-cwd clause in dispatch briefs #702 — the original implement-dispatch instance of this defect class

[kyle-sexton]

This was generated by AI during triage.

Verified

Confirmed by direct read of plugins/source-control/reference/review-discipline.md on main
(7cad5cae). Every load-bearing claim holds:

• The mandatory dispatch rule is present: "MANDATORY subagent dispatch for multi-finding comments
  (≥3 findings)".

• The verbatim dispatch prompt's substitution slots are exactly <PR>, <COMMENT_ID> /
  <REVIEW_ID>, and <BRANCH>. There is no <WORKTREE> slot.

• Its ALLOWED scope reads verbatim:

  • `Read` / `Grep` / `Glob` against the repo working tree
  • `Bash` for git inspection (`git show`, `git log`, `git diff`) — NEVER state-mutating

  Neither line carries a worktree path or any anchoring rule. <BRANCH> appears only in the
  descriptive header "ALLOWED scope (read-only on PR branch <BRANCH>)" — it names the branch the
  extractor is supposed to be reading, but binds nothing operationally.

So the failure mode is real as described: a dispatched extractor can read and grep the session's
default checkout, return per-finding evidence sourced from the wrong branch, and have that ledger
consumed as the parent worker's result. That is the same defect class as #566 / #702 / #704, one
dispatch level down.

This gap is independent of PR #1299. It predates that PR and is verifiable on main today —
nothing here is blocked on #1299 landing.

Classification

• Work class: work-class: structural (C4 — contract change). review-discipline.md is the
  plugin-scope shared seam consumed by both /source-control:babysit-prs and
  /source-control:pull-request's monitor phase. The dispatch prompt is a contract, and changing it
  changes worker behavior in two lanes at once.
• Priority: medium. priority: high is reserved here for work that blocks other work or
  carries an imminent external deadline; this blocks neither. Sub-sort signal for the
  implementer: source-control:babysit-prs: Worker Contract has the same worktree-cwd-persistence gap #566 fixed in implement-dispatch #704 — the same defect class, one level up — was carried at priority: high. Rank
  this near the top of the medium band accordingly.
• Disposition: human-gated. Two independent reasons, either sufficient:
  1. C4 structural is human-review / human-merge regardless of class confidence.
  2. The item carries an unresolved sub-decision it explicitly flags: the pull-request monitor
     lane does its own gh pr checkout rather than using a dedicated worktree, so whether it is
     covered by the same anchoring wording or needs an explicit exemption is an open call — not a
     maintainer-vetoable default.

Constraints for whoever performs the fix

Carried forward so they are not rediscovered:

• The suggested shape — add a <WORKTREE> substitution slot carrying the absolute worktree path,
  and state the anchoring rule source-control:babysit-prs: Worker Contract has the same worktree-cwd-persistence gap #566 fixed in implement-dispatch #704's contract now uses (absolute worktree-prefixed paths for
  Read/Grep/Glob; git -C <worktree> for the git-inspection commands) — is a suggestion in
  the item, not a verified design. It has not been evaluated against the pull-request lane.
• Resolve the pull-request monitor-lane question before editing the shared seam. A
  worktree-absolute rule written for the babysit-prs dispatch path may be wrong or unsatisfiable
  for a lane that operates on a plain gh pr checkout of the session's own working tree.
• The prompt is composed verbatim by callers, so any new slot must be added to every caller's
  substitution list in the same change, or the extractor receives a literal unsubstituted
  <WORKTREE>.

Role-label resolution

.work-item-tracker.json carries no config.role_labels, so the canonical roles resolved to their
documented defaults (agent-ready / needs-human / recurring). Surfacing that explicitly rather
than defaulting silently. needs-human was verified present in this repo's live label set before
application.

[kyle-sexton]

Drain: tracked by open PR #2454 fix(source-control): anchor finding-extractor reads to the PR worktree (no duplicate opened).