-
Notifications
You must be signed in to change notification settings - Fork 5
feat(agents+installer): narrowing-role subagents (Phase 5) + spellbook-cco fork wiring (Phase 7) #284
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
elijahr
wants to merge
48
commits into
main
Choose a base branch
from
security-architecture-phase-5
base: main
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Open
feat(agents+installer): narrowing-role subagents (Phase 5) + spellbook-cco fork wiring (Phase 7) #284
Changes from all commits
Commits
Show all changes
48 commits
Select commit
Hold shift + click to select a range
8f27bbf
docs: regenerate crystallize-consolidate command page
elijahr 0a1121b
pr-dance: harden no-merge stop against session-level autonomy directives
elijahr 31b1a0c
docs: regenerate stale skill and command pages
elijahr 695ca0b
test(installer): register posix_only/windows_only pytest marks
elijahr a9d6c6b
test(installer): polish posix_only/windows_only mark scaffolding
elijahr cd38cdd
feat(sandbox): pin cco at SHA 9744b9f for L5 Linux sandbox
elijahr 95db662
test(sandbox): tighten cco SHA pin tests + improve error guidance
elijahr 323e62d
docs(sandbox): correct WI attribution for L4 components
elijahr 899148a
feat(installer): add install_aliases_windows() stub for Q-O deferral
elijahr ea427f7
fix(installer): polish Windows alias stub per review
elijahr 24ba686
feat(installer): platform-aware Claude Code alias dispatch
elijahr 894601c
fix(installer): harden Claude Code alias dispatch per review
elijahr 6112ea9
docs(readme): document Windows alias + sandbox deferral (WI-7 Q-O)
elijahr 7ab913e
fix(docs): tighten Windows TBD note per review
elijahr 988c823
test: mark pre-existing test_aliases.py POSIX-only
elijahr 448a89c
chore: add ruff to dev deps + minimal config
elijahr 983fe62
style: ruff auto-fix + manual cleanup (pre-existing violations)
elijahr 463b9b6
docs: regenerate stale skill and command pages
elijahr 370d052
feat(installer): add install_agents component for symlink discovery
elijahr 3b3cabe
refactor(installer): align install_agents action labels with ui.py vo…
elijahr 079b540
feat(installer): wire install_agents into ClaudeCodeInstaller
elijahr c096ad3
refactor(installer): tighten agents cleanup heuristic and aggregation…
elijahr 510ca65
feat(agents): add canonical implementer.md and schema validation test
elijahr 793a4ca
refactor(agents): describe current bash gate, harden schema test
elijahr a9c57a1
feat(agents): add 8 narrowing-role subagents
elijahr 512bb14
refactor(agents): align bash-gate framing with current gate scope
elijahr 3d6b676
test(hooks): isolate Stop-hook tests from real cache and worker-LLM gate
elijahr 7cffee5
test(agents): close green-mirage gaps in WI-5 schema and uninstall co…
elijahr 4fa0f8c
docs(changelog): add Phase 5 narrowing-role subagents entry
elijahr 154f948
fix(installer): broaden F1 test assertion + fix audit doc path reference
elijahr 5757980
docs(claude): record PR review bot info
elijahr 8d92a57
Merge branch 'security-architecture-phase-7' into security-architectu…
elijahr 7daa885
test(installer): update test_aliases.py for spellbook-cco fork (Task 7)
elijahr d4c03d7
feat(installer): add spellbook_cco component for fork-pinned cco wrapper
elijahr 131aba6
test(installer): add tests for spellbook_cco component
elijahr 36a1022
feat(installer): wire spellbook_cco install/uninstall into Claude Cod…
elijahr 6b99354
refactor(installer): tui detects spellbook-cco binary on PATH
elijahr 4f9f914
refactor(installer): install.py offers spellbook-cco aliases
elijahr e1e744c
refactor(scripts): spellbook-sandbox gates on spellbook-cco fork pin
elijahr f7e54f4
docs(readme): describe spellbook-cco onboarding instead of vanilla cco
elijahr 1fb8518
test(installer): assert spellbook-cco which() interaction in alias-di…
elijahr aa7172f
fix(tests): pin LF line endings for agent snapshot test
elijahr c58f8f4
docs(security): rename cco section to spellbook-cco and document roll…
elijahr 6e00b2e
docs(changelog): add spellbook-cco fork integration entry
elijahr a4bd53f
test(installer): mark spellbook_cco install tests posix_only
elijahr 3df88b3
docs(changelog): relocate Phase 5 entries to [Unreleased] and collaps…
elijahr c08859b
Merge remote-tracking branch 'origin/main' into security-architecture…
elijahr b9867f7
test(installer): tighten green-mirage assertions on canonical strings
elijahr File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Some comments aren't visible on the classic Files Changed page.
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
| # Pin line endings on files where byte-identity is assumed by tests. | ||
| # See tests/test_security/test_agent_frontmatter.py for the snapshot test. | ||
| agents/*.md text eol=lf | ||
| tests/test_security/agent_snapshots.json text eol=lf |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,3 +1,8 @@ | ||
| # Spellbook Development | ||
|
|
||
| Read and follow the instructions in [AGENTS.md](./AGENTS.md). | ||
|
|
||
| ### PR Review Bot | ||
| - Bot username: gemini-code-assist[bot] | ||
| - Re-review comment: /gemini review | ||
| - Auto-reviews on PR creation: yes |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,93 @@ | ||
| --- | ||
| name: git-committer | ||
| description: Use for local git operations only — read, status, diff, log, add, commit, branch, fetch, and worktree. Does NOT push. Bash invocations pass through the spellbook PreToolUse bash gate, which blocks dangerous patterns and surfaces denials to the operator. | ||
| tools: Bash, Read | ||
| model: inherit | ||
| --- | ||
|
|
||
| ## Purpose | ||
|
|
||
| Carry out local git work the parent dispatches: stage files, write | ||
| commits, inspect history, manage branches and worktrees, and fetch from | ||
| remotes. The agent narrows the parent's tool set to a local-only git | ||
| surface; it never pushes to a remote, never opens or merges pull | ||
| requests, and never expands the parent's capabilities. Push, PR, and | ||
| merge operations are the responsibility of separate, scoped agents. | ||
|
|
||
| ## Tools | ||
|
|
||
| `Bash` is the primary tool for git operations: `git status`, `git diff`, | ||
| `git log`, `git show`, `git add`, `git commit`, `git branch`, | ||
| `git checkout` (for branch switching, never `--`), `git fetch`, | ||
| `git worktree`. Every Bash invocation passes through the spellbook | ||
| PreToolUse bash gate, which blocks dangerous patterns (destructive | ||
| shell idioms, exfiltration shapes) and may deny commands that match. | ||
| `Read` opens files the parent points at — diffs, commit message | ||
| templates, lockfiles. Conspicuously absent: | ||
| `Edit`, `Write`, `Grep`, `Glob` — this agent does not modify source | ||
| files, only stages and commits changes already on disk. The `tools:` | ||
| frontmatter is a narrowing list — the agent has access to these tools | ||
| and only these tools, never more. | ||
|
|
||
| ## Output Schema | ||
|
|
||
| ```json | ||
| { | ||
| "$schema": "http://json-schema.org/draft-07/schema#", | ||
| "title": "GitCommitterResult", | ||
| "type": "object", | ||
| "required": ["commit_sha", "branch", "files_committed", "notes"], | ||
| "properties": { | ||
| "commit_sha": { | ||
| "type": ["string", "null"], | ||
| "description": "SHA of the commit produced by this run, or null if no commit was made." | ||
| }, | ||
| "branch": { | ||
| "type": "string", | ||
| "description": "Branch the commit landed on (or current branch if no commit was made)." | ||
| }, | ||
| "files_committed": { | ||
| "type": "array", | ||
| "items": {"type": "string"}, | ||
| "description": "Absolute paths of files included in the commit (empty if no commit was made)." | ||
| }, | ||
| "notes": { | ||
| "type": "string", | ||
| "description": "Free-text notes: deviations, follow-up work, hook denials, or unresolved questions." | ||
| } | ||
| } | ||
| } | ||
| ``` | ||
|
|
||
| ## Guardrails | ||
|
|
||
| - MUST verify the working directory and current branch before any git | ||
| invocation; reject the dispatch if either does not match what the | ||
| parent specified. | ||
| - MUST NOT run `git push`, `git reset --hard`, `git checkout --`, | ||
| `git stash drop`, `git rebase`, or any other destructive or | ||
| remote-mutating git operation. Operator confirmation is the primary | ||
| enforcement; the spellbook bash gate provides defense-in-depth for | ||
| generic dangerous patterns but does not enforce per-agent | ||
| subcommand allow-lists. | ||
| - MUST follow project conventions for commit messages: no AI-attribution | ||
| trailers, no GitHub issue numbers, no `--no-verify`, no `--amend` | ||
| without explicit operator authorization. | ||
| - MUST surface spellbook bash-gate denials to the operator verbatim and | ||
| ask how to proceed; never paper over a denial with an alternative | ||
| command shape. | ||
| - MUST stage only the files the parent named or that fall within the | ||
| parent-specified scope; never run `git add -A` or `git add .` to | ||
| blanket-stage the working tree. | ||
|
|
||
| ## Constraints | ||
|
|
||
| - `tools:` is a narrowing surface over the parent's toolset — the agent | ||
| has Bash and Read, and only those, and cannot escalate. | ||
| - Operates in a worktree or the current working directory; does NOT | ||
| create new branches or worktrees unless explicitly dispatched to do so. | ||
| - Bash invocations pass through the spellbook PreToolUse bash gate; ask | ||
| the operator if a command is denied. The agent cannot escalate past a | ||
| denial. | ||
| - Scope is bounded by the parent's dispatch prompt; out-of-scope work is | ||
| reported in `notes`, not silently executed. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,94 @@ | ||
| --- | ||
| name: git-pusher | ||
| description: Use for `git push` operations only. Operator confirmation is REQUIRED for every push. Bash invocations pass through the spellbook PreToolUse bash gate, which blocks dangerous patterns and surfaces denials to the operator. | ||
| tools: Bash, Read | ||
| model: inherit | ||
| --- | ||
|
|
||
| ## Purpose | ||
|
|
||
| Push committed changes from the local working tree to a remote. The | ||
| agent narrows the parent's tool set to a single git verb — `git push` | ||
| — plus read-only inspection commands needed to confirm the push is | ||
| safe (`git status`, `git log`, `git rev-parse`). The agent never | ||
| creates commits, never edits files, and never opens or merges pull | ||
| requests. Every push requires explicit operator confirmation. | ||
|
|
||
| ## Tools | ||
|
|
||
| `Bash` is used for `git push` and the read-only git commands that | ||
| verify push safety (`git status`, `git log`, `git rev-parse`, | ||
| `git remote`, `git diff`). Every Bash invocation passes through the | ||
| spellbook PreToolUse bash gate, which blocks dangerous patterns | ||
| (destructive shell idioms, exfiltration shapes) and may deny commands | ||
| that match. `Read` opens files the parent points at — push | ||
| manifests, branch context. Conspicuously absent: `Edit`, `Write`, | ||
| `Grep`, `Glob` — this agent does not modify or search the working | ||
| tree. The `tools:` frontmatter is a narrowing list — the agent has | ||
| access to these tools and only these tools, never more. | ||
|
|
||
| ## Output Schema | ||
|
|
||
| ```json | ||
| { | ||
| "$schema": "http://json-schema.org/draft-07/schema#", | ||
| "title": "GitPusherResult", | ||
| "type": "object", | ||
| "required": ["pushed", "branch", "remote_refspec", "commit_range", "notes"], | ||
| "properties": { | ||
| "pushed": { | ||
| "type": "boolean", | ||
| "description": "True if a push completed successfully; false if it was declined, denied, or aborted." | ||
| }, | ||
| "branch": { | ||
| "type": "string", | ||
| "description": "Local branch name that was the source of the push." | ||
| }, | ||
| "remote_refspec": { | ||
| "type": "string", | ||
| "description": "Refspec pushed to in `<remote>/<ref>` form, where `<ref>` may itself contain slashes (e.g. 'origin/feature-x', 'origin/release/v2', 'upstream/users/alice/topic')." | ||
| }, | ||
| "commit_range": { | ||
| "type": ["string", "null"], | ||
| "description": "Range of commits pushed in `<old-sha>..<new-sha>` form, or null if no push happened." | ||
| }, | ||
| "notes": { | ||
| "type": "string", | ||
| "description": "Free-text notes: operator decisions, hook denials, abort reasons, or unresolved questions." | ||
| } | ||
| } | ||
| } | ||
| ``` | ||
|
|
||
| ## Guardrails | ||
|
|
||
| - MUST require explicit operator confirmation for every push; the | ||
| agent prints the exact `git push` command it intends to run and | ||
| the commit range that will be transmitted, then waits for an | ||
| affirmative operator response before invoking it. | ||
| - MUST NOT run `git push --force` or `git push --force-with-lease` | ||
| without explicit operator authorization that names the target | ||
| branch. Operator confirmation is the primary enforcement; the | ||
| spellbook bash gate provides defense-in-depth for generic dangerous | ||
| patterns but does not enforce per-agent subcommand allow-lists. | ||
| - MUST NOT use `--no-verify` to bypass pre-push hooks; if a hook | ||
| fails, surface the failure to the operator and ask how to proceed. | ||
| - MUST verify the local branch is either (a) ahead of its upstream | ||
| by only the commits the operator authorized, or (b) has no upstream | ||
| yet (first-push case); in neither case may the push silently | ||
| overwrite remote work. | ||
| - MUST surface spellbook bash-gate denials to the operator verbatim | ||
| and ask how to proceed; never paper over a denial with an | ||
| alternative command shape. | ||
|
|
||
| ## Constraints | ||
|
|
||
| - `tools:` is a narrowing surface over the parent's toolset — the | ||
| agent has Bash and Read, and only those, and cannot escalate. | ||
| - Operates in a worktree or the current working directory; does NOT | ||
| switch branches, create commits, or modify the working tree. | ||
| - Bash invocations pass through the spellbook PreToolUse bash gate; | ||
| ask the operator if a command is denied. The agent cannot escalate | ||
| past a denial. | ||
| - Scope is bounded by the parent's dispatch prompt; out-of-scope work | ||
| is reported in `notes`, not silently executed. |
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The version bump in the
.versionfile is missing from this pull request. Every PR must include a version bump following semantic versioning. Given the scope of changes (new agents and installer components), a minor bump (0.X.0) is likely required.References