gate: a skill that spawns subagents must state the scope contract

[EdbertChan]

Summary

The previous slice's rule is prose, and the next fan-out skill someone writes will not remember it. This adds the check: a skill whose body instructs delegation must name principle-subagent-inherits-scope, or cite the scope contract in finding-shape.md.

Three skills already spawned subagents before the rule existed — reflect, independent-judge-swarm, show-me-your-work. They are grandfathered in a shrink-only allowlist rather than rewritten, because rewriting three established skills is a different review.

Review Claim

A new skill that spawns subagents must state the scope those subagents inherit, enforced mechanically rather than by prose.

Review Lane

policy

Review Unit

engine-runtime

Safety Invariant

No skill prose changes in this slice, so no agent behavior changes from it alone. The gate is additive: preflight.py gains one command, and the allowlist preserves today's behavior for the three pre-existing spawners. Nothing the model can reach is widened.

Slice Rationale

Split from the rule it enforces because engine-runtime and corpus-lesson cannot mix. Landing the gate before the rule would fail closed on a principle that does not exist yet, so this sits on top.

The allowlist mirrors scripts/skill_test_debt_allowlist.txt exactly — the repo's established idiom for a new rule with pre-existing violations. Shrink-only: a skill graduates by stating the contract and removing its line.

Non-goals

• Does not rewrite the three grandfathered spawners.
• Does not add a hardcoded list of known fan-out skills. That needs someone to remember the next one, which is the failure being fixed.
• Does not match delegation-shaped wording in skill bodies that argues against delegating.

Test Plan

Test Plan

Fail-before / pass-after with the allowlist emptied (the state before this slice):

fail	engine/skills/reflect: instructs spawning subagents but names neither principle-subagent-inherits-scope nor the scope contract in finding-shape.md
fail	product/skills/independent-judge-swarm: ... same
fail	product/skills/show-me-your-work: ... same
exit=1

Restored:

ok	subagent scope contract
exit=0

• python3 scripts/check_subagent_scope_contract.py --list → 7 spawners; 4 state the contract, 3 grandfathered
• python3 -m unittest tests.test_subagent_scope_contract → Ran 9 tests ... OK
• python3 -m unittest discover -s engine/skills/make-pr/tests → OK

Regex iteration is recorded in the commit body: a loose pattern flagged three false positives (skills arguing against fan-out), and over-tightening then lost three real spawners. The landed version keeps broad verb patterns plus a per-line negation guard; both false positives are regression fixtures.

Revert Plan

Revert Plan

• Safe to revert? Yes
• Revert command: git revert <sha>
• Post-revert steps: none
• Data migration? No

🤖 Generated with Claude Code

https://claude.ai/code/session_01JQMWSLRArEfEm1psa7RKdD

---

Note

Low Risk
Additive policy enforcement and preflight wiring only; no skill prose changes and grandfathered skills preserve current behavior.

Overview
Adds a CI/preflight gate so any skill whose body instructs subagent fan-out must document the inherited scope—by naming principle-subagent-inherits-scope or citing the contract in finding-shape.md.

New scripts/check_subagent_scope_contract.py scans skill bodies with a narrow spawner regex plus a per-line negation guard (so “don’t fan out” / “re-spawning” prose isn’t treated as delegation). Three legacy spawners (reflect, independent-judge-swarm, show-me-your-work) are grandfathered via a shrink-only subagent_scope_debt_allowlist.txt; new spawners must comply instead of joining the list.

make-pr preflight runs this check on any skill-touching PR, with unit tests mirroring the existing trigger-policy gate wiring.

^{Reviewed by Cursor Bugbot for commit b128eff. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_034aef10-9e8c-4f74-9f6a-e24c7e91b48c)

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_398b2d58-fc0f-4009-9a6d-f04018632ed7)

[mergify]

Queued — the merge queue status continues in this comment ↓.

[EdbertChan]

Mergify repair stopped: required check failed: test. The retry cap was reached for current head f2c985f.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_a64aded7-accb-45f4-9dd0-3c9c07eafce7)

[EdbertChan]

Mergify repair stopped: missing required check lint

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_7451cbb0-c26f-4412-968a-bcd59718602c)

[EdbertChan]

@Mergifyio queue

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-09-10 04:45 UTC · Rule: admin-bypass · triggered by @EdbertChan with the @mergifyio queue command
• ✅ Checks passed · on draft merge queue: checking #307 on main (104f21f) #339
• ✅ Merged — 2026-09-10 04:49 UTC · at eccc9b15f02766d9ecd5236cddad7ffb513d7d8c · squash

This pull request spent 3 minutes 53 seconds in the queue, including 2 minutes 55 seconds running CI.

Required conditions to merge

• check-success = lint
• check-success = test