source-control:babysit-prs: read-only babysit_merge.py invocation blocked by host auto-mode permission classifier

[kyle-sexton]

Lane: babysit (loop, safe tier)

Triggering example: cycle 1, 2026-07-21. After worker-132 and worker-224 reported zero-blocker, CI-green, mergeStateStatus CLEAN outcomes for melodic-software/ci-runner#132 and melodic-software/standards#224, the orchestrator tried the SKILL.md-documented read-only readiness check (no --merge flag) as a fallback since the source-control-babysit-merge bare wrapper is not on PATH (same class of gap as #484 for the resolve-thread wrapper):

python .../babysit_merge.py melodic-software/ci-runner#132 --allowed-owners kyle-sexton,melodic-software --self-logins @me

The host's own Claude Code auto-mode permission classifier denied the Bash call outright: "Permission for this action was denied by the Claude Code auto mode classifier. Reason: Blocked by classifier." No --merge, no mutation — this is the documented read-only default action SKILL.md describes as safe to run every cycle to compute the MERGE-READY: [...] terminal line (rule 6c in the babysit standing rules).

Observed: the read-only merge-readiness gate cannot be run at all under this classifier, blocking the lane's own required per-cycle deliverable (MERGE-READY list) from being gate-proven; the orchestrator had to fall back to worker-reported live gh evidence (mergeStateStatus, checks) instead, which is weaker than the guarded gate (misses dependency-author / unprotected-base / self-login checks).

Expected: either (a) the classifier recognizes babysit_merge.py invoked without --merge as a safe read-only action and allows it by default, or (b) SKILL.md documents that a Bash permission rule for the bare read-only invocation is a prerequisite for this lane and the setup/prereq check surfaces it proactively instead of failing mid-cycle.

Category: operational (permission-preflight gap, same family as #495's "shippable permission preflight" theme, but for babysit's own guarded gate script rather than core git/gh verbs).

[kyle-sexton]

This was generated by AI during triage.

Triage: verified (self-observed, reproducible in babysit cycle 1, 2026-07-21) — routed status: ready (decision-defaulted).

Category: operational (permission-preflight gap). Reporter severity: operational — degrades a required per-cycle lane deliverable (the MERGE-READY gate). Priority set medium per rule 5 (default; lane degraded-but-functional via fallback, not a hard block on a named issue); ordered high within the medium tier — merge-autonomy / babysit-throughput adjacent (rule 8 ordering weight), sibling #484 is the same wrapper family.

Problem (behavioral)

The babysit-prs lane's read-only merge-readiness gate — babysit_merge.py invoked without --merge (the SKILL.md-documented safe per-cycle action that computes the MERGE-READY: [...] line) — cannot run under the host auto-mode permission classifier: the Bash call is denied outright (Permission … denied by the Claude Code auto mode classifier. Reason: Blocked by classifier.). The bare source-control-babysit-merge wrapper is also not on PATH (same class as #484's resolve-thread wrapper), so the direct-script fallback is the only path and it is the one being blocked. Net effect: the lane cannot gate-prove merge readiness and silently falls back to weaker worker-reported gh evidence (mergeStateStatus / checks), which misses the guarded gate's dependency-author / unprotected-base / self-login checks.

Acceptance (behavioral contract)

• The babysit lane's setup / prerequisite preflight detects — before a cycle runs — that the read-only merge-readiness gate is invokable: the guarded gate script (and its bare wrapper) is reachable and the host permission rule permitting the read-only (no---merge) invocation is present. When either is missing it surfaces a specific, actionable remediation, rather than the lane failing mid-cycle and silently degrading.
• SKILL.md documents the Bash permission rule for the bare read-only gate invocation as a lane prerequisite (mirrors the closed work-items(work) + autonomy: unattended loop prompts the human — core git/gh verbs and out-of-tree write dirs missing from a shippable permission preflight #495 "shippable permission preflight" pattern; extends source-control:babysit-prs: 'source-control-babysit-resolve-thread' bare wrapper not on PATH (command not found), worker must fall back to raw GraphQL #484's wrapper-on-PATH requirement to the merge gate).
• The read-only gate stays runnable every cycle, so the MERGE-READY deliverable is gate-proven, not inferred from weaker evidence.

Decision defaulted: option (b) — extend the in-repo permission preflight + document the prereq — veto before merge

The reporter named two forks: (a) teach the host auto-mode classifier to recognize a no---merge babysit_merge.py as a safe read-only action; (b) document the Bash permission prereq and surface it via the lane's setup/prereq preflight. Recommended (b): the host auto-mode classifier is harness config the plugin cannot reliably change, and #495 already established preflight-surfacing as the sanctioned pattern for exactly this (core verbs missing from a shippable preflight). (a) is maintainer-vetoable but largely out-of-repo; a maintainer who wants the classifier taught instead can veto before merge.

Coordination (not a hard block)

Implement on the same preflight surface as #484 (babysit-wrapper-PATH, open) to avoid two workers making overlapping edits; #495 (closed) is the pattern to mirror. Not recorded as a blocked-by edge — neither strictly gates the other — but a single worker taking both is preferable.

[kyle-sexton]

Operator decision (2026-07-24 interview session)

The triage-defaulted option (b) stands, but formal ratification is deferred pending dotfiles#309's research phase (fetch of current official auto-mode/permissions docs). Two reasons:

1. The (a)-vs-(b) fork rests on a tunability premise ("classifier is out-of-repo") that current docs must confirm — the org-tunable surface has been moving (see claude-ops: tune auto-mode classifier from observed team usage (step-3 guardrail, 1→2 residue) #697's closing comment: shared allowlist + natural-language grant mechanisms).
2. The allow-rule shape (b) would document is entangled with source-control:babysit-prs: plugin bin/ not on Bash-tool PATH — guarded wrapper bare names unresolvable (blocks narrow allow-rule match) #843: plugin bin/ is not on the Bash-tool PATH, and auto mode drops wildcarded-interpreter rules like Bash(python*), so neither a bare-name rule nor a script-path rule is currently a clean fit. source-control:babysit-prs: 'source-control-babysit-resolve-thread' bare wrapper not on PATH (command not found), worker must fall back to raw GraphQL #484's fix (PR fix(source-control): invoke babysit mutation wrappers by bin/ path, not bare name (#484) #840) documented path-form invocation only; the residuals live in source-control:babysit-prs: plugin bin/ not on Bash-tool PATH — guarded wrapper bare names unresolvable (blocks narrow allow-rule match) #843.

Worker sequencing: hold implementation until dotfiles#309's research output lands (it verifies the exact permission surface). Veto-before-merge window remains open per the triage comment.

Cross-links: melodic-software/dotfiles#309 (rewrites the permission surface this issue's fix documents — carries a no-regression constraint for this gate), #843 (PATH + allow-rule residuals).

Label: needs-human → agent-ready.