work-items(work) + autonomy: unattended loop prompts the human — core git/gh verbs and out-of-tree write dirs missing from a shippable permission preflight

[kyle-sexton]

Lane: work (issue-execution loop, orchestrator dispatching per-issue subagents in out-of-tree worktrees) — also applies to source-control:babysit-prs
Category: operational

Triggering example

Running /work-items:work as an unattended /loop from a session whose cwd is the user's home directory (C:\Users\KyleSexton), not a repo clone. The orchestrator dispatched 4 implementation subagents, each of which: gh repo cloned the repo into a scratchpad temp dir, git checkout -b, git add/git commit, git push, gh pr create; the orchestrator itself ran gh issue comment / gh issue edit. Despite the session running in auto (acceptEdits) mode, the human was prompted to approve multiple operations — defeating the entire point of an unattended loop.

Observed vs expected

• Observed: unattended loop repeatedly stops for human approval. Two independent causes:
  1. cwd is not a repo → all real work happens outside the workspace root. acceptEdits auto-approves Write/Edit only inside the workspace root. Subagents clone and edit under the scratchpad temp dir (outside the workspace), and no permissions.additionalDirectories entry covers it, so every out-of-tree file write prompts.
  2. The loop's core git/gh verbs are not in permissions.allow. acceptEdits never auto-approves Bash — only the allowlist does. The current global allowlist covers git worktree add, git fetch, gh pr merge/ready, gh search *, gh label list, but not the verbs every issue-execution cycle needs: gh repo clone, git checkout/git switch, git add, git commit, git push (non-force), gh pr create, gh pr view/gh pr diff, gh issue view/list/comment/edit/create. Each prompts, per subagent.
• Expected: the autonomous work/babysit lanes ship a documented permission preflight so an operator can run them unattended without hand-approving routine git/gh operations — a canonical, security-reviewed allowlist recipe (force-push / --no-verify / destructive verbs stay denied) plus additionalDirectories guidance for the out-of-tree worktree/clone root, and ideally a loop-start self-check that detects "cwd is not a git repo" and "required grants missing" and surfaces the exact gap once, up front, instead of mid-cycle prompts.

Category

operational

Suggested fix direction

1. Ship a copy-pasteable, security-reviewed permissions.allow recipe for the autonomous lanes (the verb list above), keeping the existing deny rails (force-push, --no-verify, git clean -fdx, reset --hard, secret reads) intact.
2. Document a dedicated, trusted worktree/clone root (not the OS temp dir) and the matching permissions.additionalDirectories entry so out-of-tree edits are auto-trusted.
3. Add a loop-start preflight in work (and babysit-prs) that detects cwd-not-a-repo and missing grants and reports the precise remediation once, rather than letting the loop discover it as per-operation prompts.

Related

• quality-gate slash invocation dies silently in headless sessions when its gh preflight is denied #290 (headless gh preflight denial dies silently), source-control:babysit-prs: safety.md's 'never retry a harness permission denial' rule doesn't match auto-mode classifier's actual (retriable) behavior #455 (permission-denial retry semantics), work-items(work): absorb v4 loop-prompt execution rules into the skill #479 (absorb loop-prompt execution rules into the work skill).

---

Reference: Boris Cherny, "Steps of AI Adoption" (Google Doc)

[kyle-sexton]

Operational note discovered while remediating in-session: the assistant cannot self-apply this permission recipe. Claude Code's auto-mode classifier blocks the assistant from editing its own permissions.allow in settings.json (a self-privilege-escalation guard) — a partial edit adding gh issue * verbs landed, but the edit adding gh pr create / gh repo clone / git push etc. was denied by the classifier.

Consequence for the fix: the preflight allowlist + additionalDirectories recipe must be human-applied (or run through an interactive, human-gated setup step), never self-applied by the loop. This strengthens the case for shipping it as a documented, copy-pasteable operator recipe plus a one-time setup step, and for a loop-start preflight that detects and reports the missing grants rather than attempting to add them itself.

[kyle-sexton]

This was generated by AI during triage. · Category: operational · Priority: priority: high (blocks unattended operation of the north-star loop lanes — the whole point of running them). Routed needs-human + wayfind: design.

Why needs-human

The core ask is a security-reviewed permissions.allow recipe that auto-approves routine git/gh verbs (git commit/push, gh pr create, gh issue comment/edit/create, clone, checkout) for unattended loops. Blessing autonomous, unattended push + PR-create + issue-write is a security posture decision — a compromised or misdirected loop with those grants writes to remotes without a human in the loop. That is explicit human sign-off, not a default-and-veto: an un-vetoed too-broad allowlist ships silent risk. Hence needs-human, not ready.

What the human decides

Approve (and security-review) the auto-allow verb set for the autonomous work/babysit lanes, keeping the existing deny rails intact (force-push, --no-verify, git clean -fdx, reset --hard, secret reads). The issue's proposed verb list is a good starting point for that review.

Already-implementable once the recipe is blessed (not itself the blocker)

• The loop-start preflight self-check — detect "cwd is not a git repo" and "required grants missing" and surface the exact remediation once, up front, instead of mid-cycle prompts — is a mechanical follow-on. It can be specced/ready as soon as the allowlist + additionalDirectories guidance are decided.
• additionalDirectories guidance for a dedicated, trusted worktree/clone root (NOT the OS temp dir) so out-of-tree subagent edits are auto-trusted under acceptEdits.

Notes

• Directly observed this session: triage ran from a home-dir cwd with no clone — the same cwd-not-a-repo condition (cf. work-items: triage/work lanes have no documented no-local-checkout mode — seam assumes a project root #449).
• Related: quality-gate slash invocation dies silently in headless sessions when its gh preflight is denied #290 (headless gh preflight denial dies silently), source-control:babysit-prs: safety.md's 'never retry a harness permission denial' rule doesn't match auto-mode classifier's actual (retriable) behavior #455 (permission-denial retry semantics), work-items(work): absorb v4 loop-prompt execution rules into the skill #479 (work-skill loop-rule absorption — the dispatch posture this preflight serves).
• The allowlist recipe itself is security-sensitive shared config; per repo policy any managed permission/settings changes route through the appropriate settings/IaC owner, not a plugin edit — the human decision should name where the blessed recipe lives.

[kyle-sexton]

Durable fix filed in the dotfiles repo: melodic-software/dotfiles#233 — reasoned allow-baseline reconcile (chezmoi modify_ template union of an owned baseline + a recurring reconcile skill that promotes durable runtime allow entries with per-entry judgment; no blind overwrite, preserves the deny rails). That is the next-version fix for this autonomous-loop permission story. Interim: loop-lane git/gh verbs + ~/.claude-loop-worktrees were granted directly in the live settings.json (untracked stopgap) so the loop runs unattended now.

[kyle-sexton]

This was generated by AI during needs-human queue processing.

Re-intake: the human gate here is already answered. The security-posture approval this issue was gated on — bless the auto-allow verb set and name where the recipe lives — was given by the maintainer in the 2026-07-19 16:44 comment:

Durable fix filed in the dotfiles repo: melodic-software/dotfiles#233 — reasoned allow-baseline reconcile (chezmoi modify_ template union of an owned baseline + a recurring reconcile skill that promotes durable runtime allow entries with per-entry judgment; no blind overwrite, preserves the deny rails). That is the next-version fix for this autonomous-loop permission story. Interim: loop-lane git/gh verbs + ~/.claude-loop-worktrees were granted directly in the live settings.json (untracked stopgap) so the loop runs unattended now.

Disposition: the verb set is granted live (interim, deny rails preserved) and the durable home is decided (melodic-software/dotfiles#233, allow-baseline reconcile). What remains on this issue is agent-executable: the plugin-side loop-start permission preflight self-check, which triage already carved out as implementable once the recipe was blessed. Note the 16:15 operational comment: the assistant cannot self-apply the recipe (auto-mode classifier blocks editing its own permissions), so the preflight must detect-and-report, not self-heal. Removing needs-human, adding priority: needs-triage so the triage lane routes the executable remainder.

[kyle-sexton]

Decision brief (2-minute read)

Problem. Unattended /loop lanes still prompt the human, because acceptEdits never auto-approves Bash and never auto-approves writes outside the workspace root, while the loop's core git/gh verbs and a trusted out-of-tree write root are not pre-granted. The ask is a security-reviewed permission preflight (blessed allowlist + additionalDirectories + a loop-start self-check) — but that ask collides with a locked guardrail-matrix decision, so what remains is a posture call, not just a verb list to bless.

Today (verified in the checkout).

• The shipped work skill does not clone repos, create worktrees, or dispatch subagents. It runs inline in the current checkout and emits git checkout -b … "for the user; never executes itself" (plugins/work-items/skills/work/SKILL.md:140; its only "preflight" is an unrelated role-label check at :63). So the triggering example's "orchestrator dispatching subagents that clone into a scratchpad temp dir" is not the shipped work skill — that out-of-tree-clone shape matches the babysit lane (babysit_worktree_root, default ${CLAUDE_PLUGIN_DATA}/worktrees; plugins/source-control/skills/babysit-prs/SKILL.md:296) and/or the operator's external standing loop prompt. The permission gap is real either way; the premise's attribution is off.
• The authoritative allowlist convention already exists: docs/conventions/permission-rule-hygiene/README.md — operative allow-rules "must be a narrow, machine-independent, bare-command rule that the operator adds to user-global settings … never a self-granted rule a skill or plugin ships." A plugin settings.json honors "only the agent and subagentStatusLine keys"; a permissions block there is inert. This is the repo's own confirmation of the issue's operational note — the assistant cannot self-apply the recipe, both because the classifier blocks self-escalation and because plugin self-grants do nothing.
• Auto mode drops broad arbitrary-execution allow rules (Bash(*), wildcarded interpreters, package-runners) and keeps only narrow rules like Bash(git commit) — so a blessed verb set must be narrow bare-command forms, not Bash(git *).
• Deny rails already ship, enforced two ways: guardrails hooks (plugins/guardrails/hooks/block-dangerous-git.sh — force-push / reset --hard / clean -f / checkout .; block-no-verify.sh — --no-verify / hooksPath / LEFTHOOK) and the audit baseline floor plugins/claude-config/skills/audit/reference/required-permissions.md (deny force-push/reset --hard/clean -fd/secret reads; ask on git push).
• A report-only auditor already exists — plugins/claude-config/skills/audit-permission-grants/ (scans allow-lists for the anti-patterns, no --fix, remediation operator-manual). This is the natural pattern for a loop-start self-check.
• Locked decision that reframes the ask — docs/topics/ai-ladder-wp5-guardrails/PLAN.md D8 (line 30): "safe-command allowlist distribution is NOT a matrix column — unattended runs replace per-action prompts with the whole-process boundary … L1 = attended ergonomics tier, L2+ = the boundary is the control. Classifier tuning + allowlist distribution = backlog seeds with trigger." So a blessed allowlist is the L1 attended-ergonomics answer; the locked posture for unattended is an isolation boundary, and allowlist distribution is explicitly deferred backlog. (WP5 itself is TODO/unbuilt.)
• Interim state (this issue's comments): loop verbs + ~/.claude-loop-worktrees were granted directly in the live settings.json (untracked stopgap); durable fix filed as dotfiles#233 (chezmoi modify_ union of an owned baseline + a reconcile skill). Two divergences to note: the stopgap's ~/.claude-loop-worktrees root differs from the repo's own out-of-tree convention (${CLAUDE_PLUGIN_DATA}/worktrees), and additionalDirectories is not currently a repo convention (it appears only in vendored Boris playbook content).

External facts (verified, code.claude.com). On entering auto mode, broad allow rules granting arbitrary execution are dropped; narrow bare-command rules carry over (permission-modes). Never-self-retry on a classifier denial is the correct posture (hooks reference — a PermissionDenied/retry channel is operator-granted, not agent-seized).

Options.

1. RECOMMENDED — Split the decision: ship the uncontested half now, escalate the posture fork.

   • (a) Ship the loop-start preflight self-check in the work/babysit lanes: detect "cwd is not a git repo" and "required grants / additionalDirectories missing," and report the exact gap once, up front — never self-apply (plugin self-grants are inert; the classifier blocks self-escalation). Reuse the existing report-only audit-permission-grants pattern and babysit safety.md's degrade-and-report posture ("Pinned-Command Degradation"). Mechanical, uncontested, already flagged implementable.
   • (b) Keep the allowlist operator-side per permission-rule-hygiene (narrow bare rules in user-global settings; dotfiles#233 is the right home) — but before blessing verbs, reconcile with D8: decide whether work-items(work) + autonomy: unattended loop prompts the human — core git/gh verbs and out-of-tree write dirs missing from a shippable permission preflight #495 is the explicit trigger that activates the deferred allowlist backlog seed as the sanctioned L1 answer, or whether unattended-loop perms sequence behind the WP5 isolation ladder (the locked L2+ posture). Keep deny rails intact.
   • Rationale/tradeoffs: separates the low-risk mechanical win (ships now) from the genuine human fork; honors "re-derive when the premise is undercut" (D8 undercuts pure verb-blessing). Reversible. Future-risk: an ever-growing bare-command allowlist is L1 ergonomics, not a security boundary — if the loops truly run unattended, the isolation boundary is the durable control, and blessing verbs without naming that is the silent-risk path triage warned of.

2. Bless the allowlist now; skip the D8 reconciliation. Ship a copy-pasteable narrow-bare-rule recipe + additionalDirectories guidance, operator-applied via dotfiles#233; ratify the interim stopgap. Faster to unattended-now. Tradeoff: contradicts the locked D8 deferral, grows unbounded (every new verb re-blessed), and treats an ergonomics allowlist as the security control — the posture the matrix deliberately rejected for unattended runs. Reversible, but sets precedent.

3. Isolation-first. Don't ship a blessed allowlist; sequence work-items(work) + autonomy: unattended loop prompts the human — core git/gh verbs and out-of-tree write dirs missing from a shippable permission preflight #495 behind WP5's isolation ladder (L2 unattended floor, fail-closed where L2 unavailable). Most aligned with locked D8; biggest effort; defers unattended-now (interim stopgap keeps the loop running meanwhile). Future-risk: lowest — the whole-process boundary is the durable control regardless of verb set.

Orthogonal cleanup (any option): standardize the trusted out-of-tree root on ${CLAUDE_PLUGIN_DATA}/worktrees (or consciously adopt and document ~/.claude-loop-worktrees), and decide whether additionalDirectories becomes a repo convention — today it is not.

Related.

• autonomy: lane runtime resilience — event-triggered cloud Routines, auto-mode verification, deterministic stop gate, STOP notifications, PostCompact re-injection #535 — member 2 (auto-mode verification) + the WP5 guardrail matrix own the isolation-vs-allowlist posture this hinges on; still open design, does not yet decide it.
• source-control:babysit-prs: safety.md's 'never retry a harness permission denial' rule doesn't match auto-mode classifier's actual (retriable) behavior #455 (answered) — never self-retry a harness/classifier denial; the preflight must detect+report, never retry into broader grants.
• source-control: no read/consume-only posture — "safe" babysit tier and pull-request monitor write to GitHub autonomously #440 (answered) — outward_write_mode: report-only default; the fail-safe posture a preflight should respect.
• quality-gate slash invocation dies silently in headless sessions when its gh preflight is denied #290 — headless gh preflight denial dies silently; the failure mode the loop-start self-check prevents.
• work-items(work): absorb v4 loop-prompt execution rules into the skill #479 — absorb loop-rules into the work skill; the home for the preflight step.
• dotfiles#233 — operator-side allowlist config home (chezmoi baseline + reconcile).