autonomy: decide whether to build a mod that approves babysit-lane actions through tool.check #6154

Problem

Decide whether to build a mod that hooks tool.check and approves the babysit lane's own actions (merge, comment, resolve review threads), so auto-mode loop lanes can carry a PR to merge without a person, and if so how. This is a request for a decision with the security trade-off stated. It is not an instruction to build it.

This follows from #6152 (draft), which left this mod out of scope on purpose. Line references below are on that PR's branch, feat/5778-mod-conventions, until it merges.

Today, a lane whose action the auto-mode classifier denies records the denial in its lane telemetry and moves on (AGENTS.md, "When to stop and when to keep going"). A tool.check approval would stop that denial from happening for the approved calls. The same property is the risk.

What upstream says a tool.check approval does

Fetched 2026-10-03.

• tool.check fires after the permission rules and settings hooks have decided. The mod's hook receives their decision (allow, ask or deny) and can return a different one (events: approve or refuse a tool call before the user is asked).
• A mod's approval can replace an ask rule's prompt and a block from a PreToolUse hook outside managed settings. In auto mode, a call the mod approves runs without a classifier check. Deny rules hold over the mod only on a machine with managed settings or when signed in with a Team or Enterprise plan; anywhere else the mod can approve a call a deny rule refuses (permissions: extend permissions with hooks).
• The built-in guard sec-default, which enforces that deny precedence, loads only on a machine with managed settings or for a Team or Enterprise sign-in. An administrator can switch the precedence off with allowModsToOverrideDenyRules (admin: know what happens by default). The mods overview page lists "approve a tool call before you're asked" among what a loaded mod can do (overview: what a mod can reach).
• ADR 0049 accepted this consequence for mods in general and recorded that the owner's Max machines have no managed settings, so the guard does not load there. It also records that this repository's two guard mods use no tool.check (docs/adr/0049-adopt-claude-code-mods.md:37-44).

Why this needs a decision, not a build

• Lanes read untrusted issue and PR text while holding push credentials (AGENTS.md, "When to stop and when to keep going"). A lane approval mod removes the classifier from the path that handles that text.
• On 2026-10-03, during the feat(mods)!: adopt Claude Code mods and move context-guard and rate-limit-guard onto them #6152 work, the auto-mode classifier refused a probe dispatch of a tool.check deny-override as "Auto-Mode Bypass". Overriding a deny rule is what the built-in guard blocks where it loads, so a design that does it is not one to build, and probing it in a lane-shaped session needs the owner's explicit approval.
• Where the guard loads, deny rules hold over the mod by default, but the other gaps stay open: an ask rule, a block from a PreToolUse hook outside managed settings, and the classifier. Under allowManagedModsOnly the mod does not load at all, because a plugin Claude Code copies into its cache from a GitHub source, as this marketplace's are, does not count as the organization's (docs/adr/0049-adopt-claude-code-mods.md, "Packaging and loading").
• The babysit lane's merge decision lives in its own deterministic gate (plugins/source-control/skills/babysit-loop/SKILL.md, the rung and gate sections). A mod sees only the call, not why the lane made it, so it must not become a second merge authority. Merge authority is a separate track (babysit-loop: wire inline promotion evidence into the CI pr-merge lane #4588; feat(autonomy): cut permission prompts and guard denials that interrupt autonomous lanes #5993 step 3).

Options

No option is recommended here. This is a security decision for every lane that holds push credentials, and the open questions below name the evidence that would settle it.

Open questions

1. Is the classifier skipped for a call the mod only moves from ask to allow, as the permissions page says? Evidence that settles it: a probe in a lane-shaped session on an unmanaged machine, which needs the owner's explicit approval because the classifier refused the deny-override probe.
2. Which exact calls would the allowlist hold (merge, comment, resolve thread), and can each be matched by tool and argument shape tightly enough that a prompt-injected lane cannot reuse the approval for something else? Evidence: the lane's real call shapes from lane telemetry (/harness-ops:observability), which feat(autonomy): cut permission prompts and guard denials that interrupt autonomous lanes #5993's measuring step also needs.
3. Can a mod tell a lane session from a person session reliably, including --bg, /loop and scheduled turns? Evidence: the turn-origin kinds in the per-build types (upstream "create: get the types for your build").
4. Does the benefit exist after feat(autonomy): cut permission prompts and guard denials that interrupt autonomous lanes #5993's allow-rule and exemption work? If that clears most denials, option A may be enough.

Done when

• The decision (build or not, and why) is recorded in an ADR or in this issue.
• If build: the allowlist, the lane-detection rule, the machines it may load on, a test plan the classifier will not refuse, and a statement of what the mod must never approve (anything a deny rule refuses, anything outside the allowlist).
• If not build: the issue is closed as not planned with the reason, and lanes' permission friction continues under feat(autonomy): cut permission prompts and guard denials that interrupt autonomous lanes #5993.

Related

• feat(mods)!: adopt Claude Code mods and move context-guard and rate-limit-guard onto them #6152: the draft PR this follows from.
• feat(autonomy): cut permission prompts and guard denials that interrupt autonomous lanes #5993: nearest open issue; it cuts lane permission prompts and denials with allow rules, exemptions and guard messages, and does not consider a tool.check mod.
• babysit-loop: wire inline promotion evidence into the CI pr-merge lane #4588: merge authority for lanes, tracked separately.
• docs/adr/0049-adopt-claude-code-mods.md: the accepted consequence and the managed-settings behavior.

🤖 Generated with Claude Code