[sandgraal]

Ticket

Conductor docs and harness change under the ADR-0013 lane (nothing under lab/*/src/): corrections and notes from the M14-02, M14-05 and M14-06 reviews, one ticket, and the M13-68 measurements.

Acceptance — with proof

• docs/LAB_PLAN.md §16.1 and the M14-02 ticket: the doctor plan marker reads first_run.chosen, not first_run.flavor (dated correction; the merged code uses chosen).
• .claude/rules/lab-load-bearing.md, ui bullet: every --yes command is refused except through the ADR-0029 confirm step (M14-02, feat(ui): the confirm flow on snap gc and doctor --yes (M14-02) #288); the leaves not yet in the step stay refused.
• .claude/agents/pr-shepherd.md: a note that gh api graphql with $-variables is refused under worktree isolation (inline the values or -F query=@file), and that REST POSTs are blocked.
• docs/LAB_PLAN.md §16.2: dated amendment with the final CharBindsReport fields (M14-06, feat(char): wowlab_core.keymap and wowlab char binds (M14-06) #287).
• M14-03 ticket: dated notes from the M14-02 reviews (the _CONFIRM_READY seam, --expect needs the report, the decline shape exits 1, the 120 s run limit versus a guard transaction).
• New ticket M13-70 (labaddon.ActionBars admits duplicate and out-of-range slots), found 2026-10-19 in the code review of feat(char): wowlab_core.keymap and wowlab char binds (M14-06) #287, with size, dependency, provenance, checkable acceptance and a reviewer line.
• M13-68 run 2 (lab/): feat(char): wowlab char gear, and the lossless item-link parser (M14-05) #286 M14-05 at 9f79ef9 hit the 30-turn cap (36 turns, failure, no verdict; 137 KB diff); feat(ui): the confirm flow on snap gc and doctor --yes (M14-02) #288 M14-02 at d73111e CLEAN in 2 min 17 s. The raise waits for a third lab/ run.
• .claude/hooks/guard_bash.py reads a query=@<file> and applies the mutation allowlist to it; harness test added; make hooks-test 185 passed on 3.12 and 3.9
• scripts/check_frontmatter.py 0 problems; the frontier hook parses M13-70.
• luadata.py, guard.py or another parser changed? n/a
• New external-format parsing? n/a
• New runtime dependency? none
• User-facing surface: n/a (docs and harness prose)

Reviewed by: code-reviewer CLEAN (findings fixed in 70f6868, c52b308 and 69a3a8a).

session: 284d1153-c891-4b84-8e47-150842fac4ba

🤖 Generated with Claude Code

[claude]

Claude finished @sandgraal's task in 1m 10s —— View job

---

Independent review: PR #289

One finding, low, in the shell guard's new query-file check. The docs and rule changes match the code on main. CI was still running when I finished, so this verdict does not cover it.

• Read AGENTS.md and wrote down what must hold. This PR is docs and harness only; nothing under lab/*/src/ changes.
• Read .pr-review/pr.diff in full: 6 files, +78/−4, not truncated.
• Checked the claims against the code.
• Checked CI.
• Posted findings and this summary.

What should be true

• Nothing under lab/*/src/ changes. This is the ADR-0013 conductor lane: docs, harness and tests.
• L1–L8 are untouched. There is no fixture, parser, guard.py or luadata.py change.
• Every correction in the docs matches the code on main.
• The guard change only makes the hook stricter, never looser.

What I checked

• docs/LAB_PLAN.md §16.1 and the M14-02 ticket (first_run.chosen): matches the code. ui/__init__.py:626-629 reads first.get("chosen"), and the module docstring at line 40 says first_run.chosen.
• .claude/rules/lab-load-bearing.md, the ui bullet: the diff and .claude-pr/ agree.
  • The rule says --yes goes after --json and before any argument. That matches _Argv.confirmed() at ui/__init__.py:421-426 ([*head, *json, --yes, *tail]).
  • _CONFIRM_READY at line 146 holds snap gc and doctor, so the rule's "leaves not yet in the step stay refused" is accurate.
  • ui itself, looks page --out and log tail --follow are still always refused.
• M14-03 note: the names it cites are real. _CONFIRM_READY, confirmed() at line 421 and report() at line 586 all exist.
• M13-70: the anchors are accurate. class ActionBars is at labaddon.py:1176 (cited as ~1174), and the keep-the-last dict is at bindscoach.py:536. The ticket has a size, dependencies, provenance, checkable acceptance and a reviewer line.
• §16.2 CharBindsReport amendment: it is dated and additive prose. I did not check it field by field against feat(char): wowlab_core.keymap and wowlab char binds (M14-06) #287's code; feat(char): wowlab_core.keymap and wowlab char binds (M14-06) #287 is not on this branch.
• M13-68 run 2: the backlog gives run URLs, turn counts and outcomes.
  • The backlog says feat(ui): the confirm flow on snap gc and doctor --yes (M14-02) #288's run took 2 min 54 s; the PR body says 2 min 17 s. That is not a finding: the backlog entry is the record, and the PR body is not.
  • Leaving --max-turns unchanged until a third run is within the ticket's acceptance.
• pr-shepherd.md: I read the PR's copy from .claude-pr/. The -F query=@file recipe is correct: gh's -F reads @file and -f does not.
• guard_bash.py: I compared it with .claude-pr/.claude/hooks/guard_bash.py. The change is only the 20-line block. It fails closed on an unreadable file, -, or ~. It treats -f query=@x as a file too, which is harmless because it only refuses more.
• Test: test_guard_bash_reads_a_graphql_query_file_for_mutations covers a blocked mutation, an allowed mutation, a plain query and a missing file.
• L1–L8, fixtures, secrets, workflows: nothing in the diff touches them. There are no identifiers or secrets.
• User-facing surface: the PR body says n/a, which is correct; the diff has no CLI, --json output, page or addon change.
• CI: the CI run (39211096715) was in_progress when I checked, so I could not confirm make ci and make hooks-test green for this commit. The PR body reports hooks-test 183 passed.

Finding

1. Low (guard_bash.py:152): the query file is read from the wrong place, and before the command runs.
   • The path is resolved against the hook process's own directory, not the cwd that _inspect tracks through cd.
   • The file is read before any earlier segment of the same command line runs. So printf 'mutation…' > f && gh api graphql -F query=@f passes when f already holds a harmless query.
   • Either case lets a mutation outside the allowlist through. That makes pr-shepherd.md's "only the reply and resolve mutations pass" stronger than what the hook checks.
   • It is still strictly better than main, which did not read the file at all. Inline comment: docs+harness: M14-02 marker field, the ui rule's confirm step, M14-03 notes, CharBindsReport fields, M13-70, M13-68 run 2 #289 (comment)

verdict: FINDINGS(1)