Record the two write-guard limits a live sweep exposed

[ptr727]

Two limits of the gh-write-guard hook, both found while driving seventeen pull requests through the review loop in one session, and neither written down anywhere. They go in the kit's own "Scope and Limits" rather than the review runbook, since they are properties of the hook rather than of the Copilot workflow.

A write inside a script file is unseen

The hook reads the command the agent runs. For bash sweep.sh that is one string, so a git push or a gh mutation inside the script reaches the server without the hook ever parsing it.

This is the wider of the two and the one worth acting on. It is a hole an agent opens by accident: collecting fifteen repetitive pushes into a loop reads as tidiness, not as switching a guard off. I nearly did exactly that in this sweep, and stopped only because the reason to script it and the reason not to were the same fact.

The rule that follows is short: issue each write as its own command. The boundary is the write and not the script, so a script that reads, computes, or prepares local commits is unaffected, which is how the sweep's fifteen commits were actually prepared.

A git push followed by a newline over-blocks

The push argument list terminates at && but not at a newline, so every token on a later line of the same command is read as a refspec. Measured against the installed hook:

'git push -u origin revendor/x'
  -> [('update', 'revendor/x')]
'git push -u origin revendor/x\ngh pr create --base develop'
  -> [('update','revendor/x'), ('update','gh'), ('update','pr'), ('update','create'), ('update','develop')]
'git push -u origin revendor/x && gh pr create --base develop'
  -> [('update', 'revendor/x')]

The push then denies as a direct push to a protected branch it never targeted. The direction is safe, since it blocks rather than admits, but the denial tells the agent it is bypassing a branch rule with admin power when it is pushing an ordinary feature branch. A guard that cries wolf is one an agent starts working around, which is the actual risk. The fix is tracked in TODO.md; this records the limit and the workaround meanwhile, which is the same one-write-per-command rule as above.

Not added, because it is already there

The same session hit gh pr edit --body failing on this host's gh 2.46.0 with a Projects-classic deprecation error. That is already documented in the review runbook, including the exact gh api -X PATCH ... -F body=@file workaround, so nothing is added for it. Checked before writing rather than after, since duplicating a rule into a rules file is a known past failure here.

Verification

• prose_lint.py: clean
• markdownlint-cli2: 0 issues
• Both behaviours measured against the installed hook, not inferred from reading it

[Copilot]

Pull request overview

Documents two newly observed limitations of the gh-write-guard hook in the agent-safety host setup docs, so future sweeps and agent sessions avoid inadvertently bypassing or being misled by the guard.

Changes:

• Add a limitation noting that writes executed inside a shell script are not visible to the hook, with a one-write-per-command workaround.
• Add a limitation noting that a git push followed by a newline can be mis-parsed and over-blocked, with the same workaround.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Suppressed comments (1)

host-setup/agent-safety/README.md:74

• In this bullet header, "never batch writes into one" is ambiguous (one what: one script, one command, one line). Since this section is documenting guard limits, tighten the wording to explicitly say "one script" (the actual limitation described).

- **A write inside a script file is unseen, so never batch writes into one.** The hook reads the command the agent runs, which for `bash deploy.sh` is that one string, so a `git push` or a `gh` mutation inside the script reaches the server without the hook ever parsing it. This is the widest hole in the kit and it is one an agent opens by accident, since collecting fifteen repetitive pushes into a loop looks like tidiness rather than like disabling a guard. Issue each write as its own command. A script that only reads, computes, or prepares local commits is fine, because the boundary is the write and not the script.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.