feat(security): guard-sync + PR-body HMAC grant v2 (pairs orama #260)

.agent/memory/candidates/graduated/64e972d330c2.json

@@ -0,0 +1,43 @@
+{
+  "id": "64e972d330c2",
+  "key": "manual_64e972",
+  "name": "manual_64e972",
+  "claim": "When markdownlint-cli2 v0.17.2 lints explicit file globs in CI, root .markdownlint.json filter overrides do not apply to catalog SKILL.md files outside the skills tree \u2014 add a per-directory .markdownlint-cli2.jsonc (e.g. line_length 500 for bin/orama-system/) and delete conflicting .markdownlint.json.",
+  "conditions": [
+    "CI",
+    "MD013",
+    "SKILL.md",
+    "cli2",
+    "filter",
+    "markdownlint"
+  ],
+  "evidence_ids": [
+    "2026-08-01T16:22:59.457445+00:00"
+  ],
+  "cluster_size": 1,
+  "canonical_salience": 8.0,
+  "staged_at": "2026-08-01T16:22:59.457445+00:00",
+  "status": "accepted",
+  "decisions": [
+    {
+      "ts": "2026-08-01T16:22:59.457445+00:00",
+      "action": "staged",
+      "reviewer": "learn"
+    },
+    {
+      "ts": "2026-08-01T16:22:59.533279+00:00",
+      "action": "graduated",
+      "reviewer": "learn.py",
+      "notes": "orama PR #255 CI runs 30704939323 and 30706305712 failed MD013 on bin/orama-system/SKILL.md until per-directory cli2 config landed in commits d6d3763a and 861f78ca.",
+      "provisional": false,
+      "evidence_snapshot": [
+        "2026-08-01T16:22:59.457445+00:00"
+      ],
+      "lessons_sha": "e0a0dcd77a83"
+    }
+  ],
+  "rejection_count": 0,
+  "accepted_at": "2026-08-01T16:22:59.533269+00:00",
+  "reviewer": "learn.py",
+  "rationale": "orama PR #255 CI runs 30704939323 and 30706305712 failed MD013 on bin/orama-system/SKILL.md until per-directory cli2 config landed in commits d6d3763a and 861f78ca."
+}

.agent/memory/candidates/graduated/82c94865243e.json

@@ -0,0 +1,42 @@
+{
+  "id": "82c94865243e",
+  "key": "manual_82c948",
+  "name": "manual_82c948",
+  "claim": "Guard-sync divergence checks must discover workspace siblings via git -C path rev-parse --show-toplevel (not test -d path/.git), reject surplus CLI arguments with exit 2, fail-closed when check-guard-sync-divergence.sh is missing, and scan the full outgoing pre-push commit range for scripts/git/ touches.",
+  "conditions": [
+    "divergence",
+    "fail-closed",
+    "guard-sync",
+    "pre-push",
+    "worktree"
+  ],
+  "evidence_ids": [
+    "2026-08-01T16:22:59.581970+00:00"
+  ],
+  "cluster_size": 1,
+  "canonical_salience": 8.0,
+  "staged_at": "2026-08-01T16:22:59.581970+00:00",
+  "status": "accepted",
+  "decisions": [
+    {
+      "ts": "2026-08-01T16:22:59.581970+00:00",
+      "action": "staged",
+      "reviewer": "learn"
+    },
+    {
+      "ts": "2026-08-01T16:22:59.659940+00:00",
+      "action": "graduated",
+      "reviewer": "learn.py",
+      "notes": "CodeRabbit reviews 4835024659 and 4835288649 on orama #255 \u2014 commits dd8bcba3 and 458a5ab9; linked worktree siblings were invisible to .git directory checks.",
+      "provisional": false,
+      "evidence_snapshot": [
+        "2026-08-01T16:22:59.581970+00:00"
+      ],
+      "lessons_sha": "ddf7e73da8d4"
+    }
+  ],
+  "rejection_count": 0,
+  "accepted_at": "2026-08-01T16:22:59.659928+00:00",
+  "reviewer": "learn.py",
+  "rationale": "CodeRabbit reviews 4835024659 and 4835288649 on orama #255 \u2014 commits dd8bcba3 and 458a5ab9; linked worktree siblings were invisible to .git directory checks."
+}

.agent/memory/candidates/graduated/8c5f6349aa87.json

@@ -0,0 +1,43 @@
+{
+  "id": "8c5f6349aa87",
+  "key": "manual_8c5f63",
+  "name": "manual_8c5f63",
+  "claim": "PR body Layer 0: Cursor agents comment only (post_comment or gh pr comment). Body writes require an operator TTY grant via grant-pr-body-human-override.sh; only append-pr-body.sh is allowed after grant \u2014 never update_pr body=, gh pr edit, gh api body mutations, or agent-forgeable env exports.",
+  "conditions": [
+    "Layer0",
+    "TTY",
+    "append-only",
+    "grant",
+    "operator",
+    "pr-body"
+  ],
+  "evidence_ids": [
+    "2026-08-01T16:22:59.706278+00:00"
+  ],
+  "cluster_size": 1,
+  "canonical_salience": 8.0,
+  "staged_at": "2026-08-01T16:22:59.706278+00:00",
+  "status": "accepted",
+  "decisions": [
+    {
+      "ts": "2026-08-01T16:22:59.706278+00:00",
+      "action": "staged",
+      "reviewer": "learn"
+    },
+    {
+      "ts": "2026-08-01T16:22:59.775197+00:00",
+      "action": "graduated",
+      "reviewer": "learn.py",
+      "notes": "CodeRabbit 4835288649 commit 88783688 closed the override bypass chain after agents clobbered PT #319 description with delta-only update_pr.",
+      "provisional": false,
+      "evidence_snapshot": [
+        "2026-08-01T16:22:59.706278+00:00"
+      ],
+      "lessons_sha": "b37edefc9917"
+    }
+  ],
+  "rejection_count": 0,
+  "accepted_at": "2026-08-01T16:22:59.775187+00:00",
+  "reviewer": "learn.py",
+  "rationale": "CodeRabbit 4835288649 commit 88783688 closed the override bypass chain after agents clobbered PT #319 description with delta-only update_pr."
+}

.agent/memory/episodic/AGENT_LEARNINGS.jsonl

@@ -489,3 +489,6 @@
 {"timestamp": "2026-08-01T15:24:25.426517+00:00", "skill": "learn", "action": "manual-stage:4c914783ec46", "result": "success", "detail": "Manually staged lesson 4c914783ec46 via .agent/tools/learn.py: 'When a human explicitly authorizes a PR body edit, set CURSOR_PR_BODY_HUMAN_OVERRIDE_ACK=1 then follow append-only Layers 1-6 (READ backup MERGE full body via append-pr-body.sh); delta-only writes remain forbidden'", "pain_score": 1, "importance": 6, "reflection": "", "confidence": 0.9, "source": {"skill": "learn", "profile": "manual", "run_id": "manual_4c9147"}, "evidence_ids": ["2026-08-01T15:24:25.426517+00:00"]}
 {"timestamp": "2026-08-01T15:24:25.558868+00:00", "skill": "learn", "action": "manual-stage:e8ae3f3b9fa6", "result": "success", "detail": "Manually staged lesson e8ae3f3b9fa6 via .agent/tools/learn.py: 'Guard-sync waves use one open PR per repo (PT then orama then AlphaClaw); run check-guard-sync-divergence.sh --workspace before sync-attribution-guard-scripts.sh; never open parallel one-file guard PRs'", "pain_score": 1, "importance": 6, "reflection": "", "confidence": 0.9, "source": {"skill": "learn", "profile": "manual", "run_id": "manual_e8ae3f"}, "evidence_ids": ["2026-08-01T15:24:25.558868+00:00"]}
 {"timestamp": "2026-08-01T15:24:25.675068+00:00", "skill": "learn", "action": "manual-stage:c9ff6cc2625d", "result": "success", "detail": "Manually staged lesson c9ff6cc2625d via .agent/tools/learn.py: 'Cloud turn-end update PR must mean post_comment not update_pr body \u2014 treating description field as a scratch pad erases Summary template sections and CodeRabbit tails'", "pain_score": 1, "importance": 6, "reflection": "", "confidence": 0.9, "source": {"skill": "learn", "profile": "manual", "run_id": "manual_c9ff6c"}, "evidence_ids": ["2026-08-01T15:24:25.675068+00:00"]}
+{"timestamp": "2026-08-01T16:22:59.457445+00:00", "skill": "learn", "action": "manual-stage:64e972d330c2", "result": "success", "detail": "Manually staged lesson 64e972d330c2 via .agent/tools/learn.py: 'When markdownlint-cli2 v0.17.2 lints explicit file globs in CI, root .markdownlint.json filter overrides do not apply to catalog SKILL.md files outside the skills tree \u2014 add a per-directory .markdownlint-cli2.jsonc (e.g. line_length 500 for bin/orama-system/) and delete conflicting .markdownlint.json.'", "pain_score": 1, "importance": 6, "reflection": "", "confidence": 0.9, "source": {"skill": "learn", "profile": "manual", "run_id": "manual_64e972"}, "evidence_ids": ["2026-08-01T16:22:59.457445+00:00"]}
+{"timestamp": "2026-08-01T16:22:59.581970+00:00", "skill": "learn", "action": "manual-stage:82c94865243e", "result": "success", "detail": "Manually staged lesson 82c94865243e via .agent/tools/learn.py: 'Guard-sync divergence checks must discover workspace siblings via git -C path rev-parse --show-toplevel (not test -d path/.git), reject surplus CLI arguments with exit 2, fail-closed when check-guard-sync-divergence.sh is missing, and scan the full outgoing pre-push commit range for scripts/git/ touches.'", "pain_score": 1, "importance": 6, "reflection": "", "confidence": 0.9, "source": {"skill": "learn", "profile": "manual", "run_id": "manual_82c948"}, "evidence_ids": ["2026-08-01T16:22:59.581970+00:00"]}
+{"timestamp": "2026-08-01T16:22:59.706278+00:00", "skill": "learn", "action": "manual-stage:8c5f6349aa87", "result": "success", "detail": "Manually staged lesson 8c5f6349aa87 via .agent/tools/learn.py: 'PR body Layer 0: Cursor agents comment only (post_comment or gh pr comment). Body writes require an operator TTY grant via grant-pr-body-human-override.sh; only append-pr-body.sh is allowed after grant \u2014 never update_pr body=, gh pr edit, gh api body mutations, or agent-forgeable env exports.'", "pain_score": 1, "importance": 6, "reflection": "", "confidence": 0.9, "source": {"skill": "learn", "profile": "manual", "run_id": "manual_8c5f63"}, "evidence_ids": ["2026-08-01T16:22:59.706278+00:00"]}

.agent/memory/semantic/LESSONS.md

@@ -17,6 +17,9 @@
 - When a human explicitly authorizes a PR body edit, set CURSOR_PR_BODY_HUMAN_OVERRIDE_ACK=1 then follow append-only Layers 1-6 (READ backup MERGE full body via append-pr-body.sh); delta-only writes remain forbidden  <!-- status=accepted confidence=0.6 evidence=1 id=lesson_4c914783ec46 -->
 - Guard-sync waves use one open PR per repo (PT then orama then AlphaClaw); run check-guard-sync-divergence.sh --workspace before sync-attribution-guard-scripts.sh; never open parallel one-file guard PRs  <!-- status=accepted confidence=0.6 evidence=1 id=lesson_e8ae3f3b9fa6 -->
 - Cloud turn-end update PR must mean post_comment not update_pr body — treating description field as a scratch pad erases Summary template sections and CodeRabbit tails  <!-- status=accepted confidence=0.6 evidence=1 id=lesson_c9ff6cc2625d -->
+- When markdownlint-cli2 v0.17.2 lints explicit file globs in CI, root .markdownlint.json filter overrides do not apply to catalog SKILL.md files outside the skills tree — add a per-directory .markdownlint-cli2.jsonc (e.g. line_length 500 for bin/orama-system/) and delete conflicting .markdownlint.json.  <!-- status=accepted confidence=0.6 evidence=1 id=lesson_64e972d330c2 -->
+- Guard-sync divergence checks must discover workspace siblings via git -C path rev-parse --show-toplevel (not test -d path/.git), reject surplus CLI arguments with exit 2, fail-closed when check-guard-sync-divergence.sh is missing, and scan the full outgoing pre-push commit range for scripts/git/ touches.  <!-- status=accepted confidence=0.6 evidence=1 id=lesson_82c94865243e -->
+- PR body Layer 0: Cursor agents comment only (post_comment or gh pr comment). Body writes require an operator TTY grant via grant-pr-body-human-override.sh; only append-pr-body.sh is allowed after grant — never update_pr body=, gh pr edit, gh api body mutations, or agent-forgeable env exports.  <!-- status=accepted confidence=0.6 evidence=1 id=lesson_8c5f6349aa87 -->
 
 ### 2026-07
 

.agent/memory/semantic/lessons.jsonl

@@ -970,3 +970,6 @@
 {"id": "lesson_4c914783ec46", "claim": "When a human explicitly authorizes a PR body edit, set CURSOR_PR_BODY_HUMAN_OVERRIDE_ACK=1 then follow append-only Layers 1-6 (READ backup MERGE full body via append-pr-body.sh); delta-only writes remain forbidden", "conditions": ["CURSOR_PR_BODY_HUMAN_OVERRIDE_ACK", "append-only", "human-override"], "evidence_ids": ["2026-08-01T15:24:25.426517+00:00"], "status": "accepted", "accepted_at": "2026-08-01T15:24:25.477136+00:00", "reviewer": "learn.py", "rationale": "User: if prohibition overruled existing PR rules still apply; separates Layer 0 default from human-authorized integrative restore", "cluster_size": 1, "canonical_salience": 8.0, "confidence": 0.6, "support_count": 0, "contradiction_count": 0, "supersedes": null, "source_candidate": "4c914783ec46"}
 {"id": "lesson_e8ae3f3b9fa6", "claim": "Guard-sync waves use one open PR per repo (PT then orama then AlphaClaw); run check-guard-sync-divergence.sh --workspace before sync-attribution-guard-scripts.sh; never open parallel one-file guard PRs", "conditions": ["check-guard-sync", "divergence", "guard-sync", "one-PR-per-repo"], "evidence_ids": ["2026-08-01T15:24:25.558868+00:00"], "status": "accepted", "accepted_at": "2026-08-01T15:24:25.608820+00:00", "reviewer": "learn.py", "rationale": "2026-08-01 guard epic: #314 merged but nitpicks open, #315 false supersede trap, #319/#255/#26 consolidated wave, divergence guard prevents blind orama-to-PT clobber", "cluster_size": 1, "canonical_salience": 8.0, "confidence": 0.6, "support_count": 0, "contradiction_count": 0, "supersedes": null, "source_candidate": "e8ae3f3b9fa6"}
 {"id": "lesson_c9ff6cc2625d", "claim": "Cloud turn-end update PR must mean post_comment not update_pr body \u2014 treating description field as a scratch pad erases Summary template sections and CodeRabbit tails", "conditions": ["PR-summary", "cloud-agent", "turn-end", "update_pr"], "evidence_ids": ["2026-08-01T15:24:25.675068+00:00"], "status": "accepted", "accepted_at": "2026-08-01T15:24:25.751629+00:00", "reviewer": "learn.py", "rationale": "Recurring clobber pattern across PT#154 #222 #298 #314 #319; lessons and rules failed until runtime hooks; documented in PR_BODY_COMMENT_ONLY_FRUSTRATION_CHAIN_2026-08-01.md", "cluster_size": 1, "canonical_salience": 8.0, "confidence": 0.6, "support_count": 0, "contradiction_count": 0, "supersedes": null, "source_candidate": "c9ff6cc2625d"}
+{"id": "lesson_64e972d330c2", "claim": "When markdownlint-cli2 v0.17.2 lints explicit file globs in CI, root .markdownlint.json filter overrides do not apply to catalog SKILL.md files outside the skills tree \u2014 add a per-directory .markdownlint-cli2.jsonc (e.g. line_length 500 for bin/orama-system/) and delete conflicting .markdownlint.json.", "conditions": ["CI", "MD013", "SKILL.md", "cli2", "filter", "markdownlint"], "evidence_ids": ["2026-08-01T16:22:59.457445+00:00"], "status": "accepted", "accepted_at": "2026-08-01T16:22:59.512695+00:00", "reviewer": "learn.py", "rationale": "orama PR #255 CI runs 30704939323 and 30706305712 failed MD013 on bin/orama-system/SKILL.md until per-directory cli2 config landed in commits d6d3763a and 861f78ca.", "cluster_size": 1, "canonical_salience": 8.0, "confidence": 0.6, "support_count": 0, "contradiction_count": 0, "supersedes": null, "source_candidate": "64e972d330c2"}
+{"id": "lesson_82c94865243e", "claim": "Guard-sync divergence checks must discover workspace siblings via git -C path rev-parse --show-toplevel (not test -d path/.git), reject surplus CLI arguments with exit 2, fail-closed when check-guard-sync-divergence.sh is missing, and scan the full outgoing pre-push commit range for scripts/git/ touches.", "conditions": ["divergence", "fail-closed", "guard-sync", "pre-push", "worktree"], "evidence_ids": ["2026-08-01T16:22:59.581970+00:00"], "status": "accepted", "accepted_at": "2026-08-01T16:22:59.635794+00:00", "reviewer": "learn.py", "rationale": "CodeRabbit reviews 4835024659 and 4835288649 on orama #255 \u2014 commits dd8bcba3 and 458a5ab9; linked worktree siblings were invisible to .git directory checks.", "cluster_size": 1, "canonical_salience": 8.0, "confidence": 0.6, "support_count": 0, "contradiction_count": 0, "supersedes": null, "source_candidate": "82c94865243e"}
+{"id": "lesson_8c5f6349aa87", "claim": "PR body Layer 0: Cursor agents comment only (post_comment or gh pr comment). Body writes require an operator TTY grant via grant-pr-body-human-override.sh; only append-pr-body.sh is allowed after grant \u2014 never update_pr body=, gh pr edit, gh api body mutations, or agent-forgeable env exports.", "conditions": ["Layer0", "TTY", "append-only", "grant", "operator", "pr-body"], "evidence_ids": ["2026-08-01T16:22:59.706278+00:00"], "status": "accepted", "accepted_at": "2026-08-01T16:22:59.756494+00:00", "reviewer": "learn.py", "rationale": "CodeRabbit 4835288649 commit 88783688 closed the override bypass chain after agents clobbered PT #319 description with delta-only update_pr.", "cluster_size": 1, "canonical_salience": 8.0, "confidence": 0.6, "support_count": 0, "contradiction_count": 0, "supersedes": null, "source_candidate": "8c5f6349aa87"}