[finding] Four more agent-facing copies of the worktree recipe still teach the unhardened form — all four miss --no-track, two also base off unfetched local main #13729

Description

@huangyiirene

Found while implementing the hooks half (13663 / PR 13727). Aligning the two guard-main-checkout remediation strings to the prescribed form left the surrounding sweep with four more prescriptive copies that are still unhardened. Filed rather than ridden along: they are a different file surface than that card's declared one, and one of them is a published skill with its own line/token budget rules.

Measured

grep -rn "worktree add" over the tree at origin/main4f65837a, keeping only the copies that PRESCRIBE a recipe to an agent (comparison worktrees, --detach provenance recipes, and selftest fixtures are excluded — they are not instructions anyone follows to start work):

file:linerecipe as writtenmissing fetch + origin/missing --no-track
.claude/skills/checklist-author/SKILL.md:33git worktree add ../objectstack-<task> -b <branch> mainyesyes
.claude/agents/os-dev.md:33git worktree add ../<repo>-issue-<n> -b claude/issue-<n>-<slug> origin/mainnoyes
.claude/skills/dogfood-verification/SKILL.md:140git worktree add -b <branch> /tmp/pr origin/mainnoyes
skills/objectstack-pm-dispatch/SKILL.md:741git worktree add ../<repo>-issue-<n> -b claude/issue-<n>-<slug> origin/{default_branch}noyes

grep -c "no-track" over all four: 0.

(Reading this through a tool that strips tag-shaped fragments? The <task> / <branch> / <repo> placeholders may render empty — read the files at the line numbers above.)

Why it matters, per hazard

  • No --no-track (all four) — plain -b writes branch.NAME.remote / branch.NAME.merge into the .git/config that every worktree of the repo SHARES. This is the class already adjudicated in 13052 / ui 6880 and already hardened in AGENTS.md Prime Directive 11 and CLAUDE.md; these copies were not swept with it.
  • Based on local main, with no fetch (checklist-author only) — bases the new tree on a stale commit. The ui 6208 class; 11540 measured a live shared checkout 120 commits and 179 hours behind.

.claude/agents/os-dev.md:33 is the highest-traffic of the four: it is the operating template every dispatched developer agent runs under, so its recipe is executed on essentially every card.

Not one card

Three of the four are internal (.claude/**). The fourth, skills/objectstack-pm-dispatch/SKILL.md, is a customer-published skill — it is a template for OTHER repositories (note the {default_branch} interpolation), so the correct hardened spelling there is not simply a copy of this repo's line, and any edit there is subject to the published-skills budget discipline. Splitting or scoping that half is a triage call, not one this seat should make unilaterally.

Unassigned and untriaged on purpose.

Refs: 13663 (the hooks half) · PR 13727 · 13052 / ui 6880 (the --no-track adjudications) · ui 6208 and 11540 (the unfetched-main adjudication).

Generated by Claude Code

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions

      , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all
       blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
      }
      } catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
      })();
      (function(){
      try {
      var __m = "github.com";
      var __re = new RegExp('^' + "github\\.com" + '
      
      Skip to content

      [finding] Four more agent-facing copies of the worktree recipe still teach the unhardened form — all four miss --no-track, two also base off unfetched local main #13729

      Description

      @huangyiirene

      Found while implementing the hooks half (13663 / PR 13727). Aligning the two guard-main-checkout remediation strings to the prescribed form left the surrounding sweep with four more prescriptive copies that are still unhardened. Filed rather than ridden along: they are a different file surface than that card's declared one, and one of them is a published skill with its own line/token budget rules.

      Measured

      grep -rn "worktree add" over the tree at origin/main4f65837a, keeping only the copies that PRESCRIBE a recipe to an agent (comparison worktrees, --detach provenance recipes, and selftest fixtures are excluded — they are not instructions anyone follows to start work):

      file:linerecipe as writtenmissing fetch + origin/missing --no-track
      .claude/skills/checklist-author/SKILL.md:33git worktree add ../objectstack-<task> -b <branch> mainyesyes
      .claude/agents/os-dev.md:33git worktree add ../<repo>-issue-<n> -b claude/issue-<n>-<slug> origin/mainnoyes
      .claude/skills/dogfood-verification/SKILL.md:140git worktree add -b <branch> /tmp/pr origin/mainnoyes
      skills/objectstack-pm-dispatch/SKILL.md:741git worktree add ../<repo>-issue-<n> -b claude/issue-<n>-<slug> origin/{default_branch}noyes

      grep -c "no-track" over all four: 0.

      (Reading this through a tool that strips tag-shaped fragments? The <task> / <branch> / <repo> placeholders may render empty — read the files at the line numbers above.)

      Why it matters, per hazard

      • No --no-track (all four) — plain -b writes branch.NAME.remote / branch.NAME.merge into the .git/config that every worktree of the repo SHARES. This is the class already adjudicated in 13052 / ui 6880 and already hardened in AGENTS.md Prime Directive 11 and CLAUDE.md; these copies were not swept with it.
      • Based on local main, with no fetch (checklist-author only) — bases the new tree on a stale commit. The ui 6208 class; 11540 measured a live shared checkout 120 commits and 179 hours behind.

      .claude/agents/os-dev.md:33 is the highest-traffic of the four: it is the operating template every dispatched developer agent runs under, so its recipe is executed on essentially every card.

      Not one card

      Three of the four are internal (.claude/**). The fourth, skills/objectstack-pm-dispatch/SKILL.md, is a customer-published skill — it is a template for OTHER repositories (note the {default_branch} interpolation), so the correct hardened spelling there is not simply a copy of this repo's line, and any edit there is subject to the published-skills budget discipline. Splitting or scoping that half is a triage call, not one this seat should make unilaterally.

      Unassigned and untriaged on purpose.

      Refs: 13663 (the hooks half) · PR 13727 · 13052 / ui 6880 (the --no-track adjudications) · ui 6208 and 11540 (the unfetched-main adjudication).

      Generated by Claude Code

      Metadata

      Metadata

      Assignees

      No one assigned

        Type

        No type

        Projects

        No projects

          Milestone

          No milestone

          Relationships

          None yet

          Development

          No branches or pull requests

          Issue actions

          , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix"); } } catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
          Skip to content

          [finding] Four more agent-facing copies of the worktree recipe still teach the unhardened form — all four miss --no-track, two also base off unfetched local main #13729

          Description

          @huangyiirene

          Found while implementing the hooks half (13663 / PR 13727). Aligning the two guard-main-checkout remediation strings to the prescribed form left the surrounding sweep with four more prescriptive copies that are still unhardened. Filed rather than ridden along: they are a different file surface than that card's declared one, and one of them is a published skill with its own line/token budget rules.

          Measured

          grep -rn "worktree add" over the tree at origin/main4f65837a, keeping only the copies that PRESCRIBE a recipe to an agent (comparison worktrees, --detach provenance recipes, and selftest fixtures are excluded — they are not instructions anyone follows to start work):

          file:linerecipe as writtenmissing fetch + origin/missing --no-track
          .claude/skills/checklist-author/SKILL.md:33git worktree add ../objectstack-<task> -b <branch> mainyesyes
          .claude/agents/os-dev.md:33git worktree add ../<repo>-issue-<n> -b claude/issue-<n>-<slug> origin/mainnoyes
          .claude/skills/dogfood-verification/SKILL.md:140git worktree add -b <branch> /tmp/pr origin/mainnoyes
          skills/objectstack-pm-dispatch/SKILL.md:741git worktree add ../<repo>-issue-<n> -b claude/issue-<n>-<slug> origin/{default_branch}noyes

          grep -c "no-track" over all four: 0.

          (Reading this through a tool that strips tag-shaped fragments? The <task> / <branch> / <repo> placeholders may render empty — read the files at the line numbers above.)

          Why it matters, per hazard

          • No --no-track (all four) — plain -b writes branch.NAME.remote / branch.NAME.merge into the .git/config that every worktree of the repo SHARES. This is the class already adjudicated in 13052 / ui 6880 and already hardened in AGENTS.md Prime Directive 11 and CLAUDE.md; these copies were not swept with it.
          • Based on local main, with no fetch (checklist-author only) — bases the new tree on a stale commit. The ui 6208 class; 11540 measured a live shared checkout 120 commits and 179 hours behind.

          .claude/agents/os-dev.md:33 is the highest-traffic of the four: it is the operating template every dispatched developer agent runs under, so its recipe is executed on essentially every card.

          Not one card

          Three of the four are internal (.claude/**). The fourth, skills/objectstack-pm-dispatch/SKILL.md, is a customer-published skill — it is a template for OTHER repositories (note the {default_branch} interpolation), so the correct hardened spelling there is not simply a copy of this repo's line, and any edit there is subject to the published-skills budget discipline. Splitting or scoping that half is a triage call, not one this seat should make unilaterally.

          Unassigned and untriaged on purpose.

          Refs: 13663 (the hooks half) · PR 13727 · 13052 / ui 6880 (the --no-track adjudications) · ui 6208 and 11540 (the unfetched-main adjudication).

          Generated by Claude Code

          Metadata

          Metadata

          Assignees

          No one assigned

            Type

            No type

            Projects

            No projects

              Milestone

              No milestone

              Relationships

              None yet

              Development

              No branches or pull requests

              Issue actions

              , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms"); } } catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
              Skip to content

              [finding] Four more agent-facing copies of the worktree recipe still teach the unhardened form — all four miss --no-track, two also base off unfetched local main #13729

              Description

              @huangyiirene

              Found while implementing the hooks half (13663 / PR 13727). Aligning the two guard-main-checkout remediation strings to the prescribed form left the surrounding sweep with four more prescriptive copies that are still unhardened. Filed rather than ridden along: they are a different file surface than that card's declared one, and one of them is a published skill with its own line/token budget rules.

              Measured

              grep -rn "worktree add" over the tree at origin/main4f65837a, keeping only the copies that PRESCRIBE a recipe to an agent (comparison worktrees, --detach provenance recipes, and selftest fixtures are excluded — they are not instructions anyone follows to start work):

              file:linerecipe as writtenmissing fetch + origin/missing --no-track
              .claude/skills/checklist-author/SKILL.md:33git worktree add ../objectstack-<task> -b <branch> mainyesyes
              .claude/agents/os-dev.md:33git worktree add ../<repo>-issue-<n> -b claude/issue-<n>-<slug> origin/mainnoyes
              .claude/skills/dogfood-verification/SKILL.md:140git worktree add -b <branch> /tmp/pr origin/mainnoyes
              skills/objectstack-pm-dispatch/SKILL.md:741git worktree add ../<repo>-issue-<n> -b claude/issue-<n>-<slug> origin/{default_branch}noyes

              grep -c "no-track" over all four: 0.

              (Reading this through a tool that strips tag-shaped fragments? The <task> / <branch> / <repo> placeholders may render empty — read the files at the line numbers above.)

              Why it matters, per hazard

              • No --no-track (all four) — plain -b writes branch.NAME.remote / branch.NAME.merge into the .git/config that every worktree of the repo SHARES. This is the class already adjudicated in 13052 / ui 6880 and already hardened in AGENTS.md Prime Directive 11 and CLAUDE.md; these copies were not swept with it.
              • Based on local main, with no fetch (checklist-author only) — bases the new tree on a stale commit. The ui 6208 class; 11540 measured a live shared checkout 120 commits and 179 hours behind.

              .claude/agents/os-dev.md:33 is the highest-traffic of the four: it is the operating template every dispatched developer agent runs under, so its recipe is executed on essentially every card.

              Not one card

              Three of the four are internal (.claude/**). The fourth, skills/objectstack-pm-dispatch/SKILL.md, is a customer-published skill — it is a template for OTHER repositories (note the {default_branch} interpolation), so the correct hardened spelling there is not simply a copy of this repo's line, and any edit there is subject to the published-skills budget discipline. Splitting or scoping that half is a triage call, not one this seat should make unilaterally.

              Unassigned and untriaged on purpose.

              Refs: 13663 (the hooks half) · PR 13727 · 13052 / ui 6880 (the --no-track adjudications) · ui 6208 and 11540 (the unfetched-main adjudication).

              Generated by Claude Code

              Metadata

              Metadata

              Assignees

              No one assigned

                Type

                No type

                Projects

                No projects

                  Milestone

                  No milestone

                  Relationships

                  None yet

                  Development

                  No branches or pull requests

                  Issue actions

                  , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links"); } } catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); } })(); (function(){ try { var __m = "youtube.com"; var __re = new RegExp('^' + "youtube\\.com" + '
                  Skip to content

                  [finding] Four more agent-facing copies of the worktree recipe still teach the unhardened form — all four miss --no-track, two also base off unfetched local main #13729

                  Description

                  @huangyiirene

                  Found while implementing the hooks half (13663 / PR 13727). Aligning the two guard-main-checkout remediation strings to the prescribed form left the surrounding sweep with four more prescriptive copies that are still unhardened. Filed rather than ridden along: they are a different file surface than that card's declared one, and one of them is a published skill with its own line/token budget rules.

                  Measured

                  grep -rn "worktree add" over the tree at origin/main4f65837a, keeping only the copies that PRESCRIBE a recipe to an agent (comparison worktrees, --detach provenance recipes, and selftest fixtures are excluded — they are not instructions anyone follows to start work):

                  file:linerecipe as writtenmissing fetch + origin/missing --no-track
                  .claude/skills/checklist-author/SKILL.md:33git worktree add ../objectstack-<task> -b <branch> mainyesyes
                  .claude/agents/os-dev.md:33git worktree add ../<repo>-issue-<n> -b claude/issue-<n>-<slug> origin/mainnoyes
                  .claude/skills/dogfood-verification/SKILL.md:140git worktree add -b <branch> /tmp/pr origin/mainnoyes
                  skills/objectstack-pm-dispatch/SKILL.md:741git worktree add ../<repo>-issue-<n> -b claude/issue-<n>-<slug> origin/{default_branch}noyes

                  grep -c "no-track" over all four: 0.

                  (Reading this through a tool that strips tag-shaped fragments? The <task> / <branch> / <repo> placeholders may render empty — read the files at the line numbers above.)

                  Why it matters, per hazard

                  • No --no-track (all four) — plain -b writes branch.NAME.remote / branch.NAME.merge into the .git/config that every worktree of the repo SHARES. This is the class already adjudicated in 13052 / ui 6880 and already hardened in AGENTS.md Prime Directive 11 and CLAUDE.md; these copies were not swept with it.
                  • Based on local main, with no fetch (checklist-author only) — bases the new tree on a stale commit. The ui 6208 class; 11540 measured a live shared checkout 120 commits and 179 hours behind.

                  .claude/agents/os-dev.md:33 is the highest-traffic of the four: it is the operating template every dispatched developer agent runs under, so its recipe is executed on essentially every card.

                  Not one card

                  Three of the four are internal (.claude/**). The fourth, skills/objectstack-pm-dispatch/SKILL.md, is a customer-published skill — it is a template for OTHER repositories (note the {default_branch} interpolation), so the correct hardened spelling there is not simply a copy of this repo's line, and any edit there is subject to the published-skills budget discipline. Splitting or scoping that half is a triage call, not one this seat should make unilaterally.

                  Unassigned and untriaged on purpose.

                  Refs: 13663 (the hooks half) · PR 13727 · 13052 / ui 6880 (the --no-track adjudications) · ui 6208 and 11540 (the unfetched-main adjudication).

                  Generated by Claude Code

                  Metadata

                  Metadata

                  Assignees

                  No one assigned

                    Type

                    No type

                    Projects

                    No projects

                      Milestone

                      No milestone

                      Relationships

                      None yet

                      Development

                      No branches or pull requests

                      Issue actions

                      , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default"); } } catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
                      Skip to content

                      [finding] Four more agent-facing copies of the worktree recipe still teach the unhardened form — all four miss --no-track, two also base off unfetched local main #13729

                      Description

                      @huangyiirene

                      Found while implementing the hooks half (13663 / PR 13727). Aligning the two guard-main-checkout remediation strings to the prescribed form left the surrounding sweep with four more prescriptive copies that are still unhardened. Filed rather than ridden along: they are a different file surface than that card's declared one, and one of them is a published skill with its own line/token budget rules.

                      Measured

                      grep -rn "worktree add" over the tree at origin/main4f65837a, keeping only the copies that PRESCRIBE a recipe to an agent (comparison worktrees, --detach provenance recipes, and selftest fixtures are excluded — they are not instructions anyone follows to start work):

                      file:linerecipe as writtenmissing fetch + origin/missing --no-track
                      .claude/skills/checklist-author/SKILL.md:33git worktree add ../objectstack-<task> -b <branch> mainyesyes
                      .claude/agents/os-dev.md:33git worktree add ../<repo>-issue-<n> -b claude/issue-<n>-<slug> origin/mainnoyes
                      .claude/skills/dogfood-verification/SKILL.md:140git worktree add -b <branch> /tmp/pr origin/mainnoyes
                      skills/objectstack-pm-dispatch/SKILL.md:741git worktree add ../<repo>-issue-<n> -b claude/issue-<n>-<slug> origin/{default_branch}noyes

                      grep -c "no-track" over all four: 0.

                      (Reading this through a tool that strips tag-shaped fragments? The <task> / <branch> / <repo> placeholders may render empty — read the files at the line numbers above.)

                      Why it matters, per hazard

                      • No --no-track (all four) — plain -b writes branch.NAME.remote / branch.NAME.merge into the .git/config that every worktree of the repo SHARES. This is the class already adjudicated in 13052 / ui 6880 and already hardened in AGENTS.md Prime Directive 11 and CLAUDE.md; these copies were not swept with it.
                      • Based on local main, with no fetch (checklist-author only) — bases the new tree on a stale commit. The ui 6208 class; 11540 measured a live shared checkout 120 commits and 179 hours behind.

                      .claude/agents/os-dev.md:33 is the highest-traffic of the four: it is the operating template every dispatched developer agent runs under, so its recipe is executed on essentially every card.

                      Not one card

                      Three of the four are internal (.claude/**). The fourth, skills/objectstack-pm-dispatch/SKILL.md, is a customer-published skill — it is a template for OTHER repositories (note the {default_branch} interpolation), so the correct hardened spelling there is not simply a copy of this repo's line, and any edit there is subject to the published-skills budget discipline. Splitting or scoping that half is a triage call, not one this seat should make unilaterally.

                      Unassigned and untriaged on purpose.

                      Refs: 13663 (the hooks half) · PR 13727 · 13052 / ui 6880 (the --no-track adjudications) · ui 6208 and 11540 (the unfetched-main adjudication).

                      Generated by Claude Code

                      Metadata

                      Metadata

                      Assignees

                      No one assigned

                        Type

                        No type

                        Projects

                        No projects

                          Milestone

                          No milestone

                          Relationships

                          None yet

                          Development

                          No branches or pull requests

                          Issue actions

                          , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers"); } } catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
                          Skip to content

                          [finding] Four more agent-facing copies of the worktree recipe still teach the unhardened form — all four miss --no-track, two also base off unfetched local main #13729

                          Description

                          @huangyiirene

                          Found while implementing the hooks half (13663 / PR 13727). Aligning the two guard-main-checkout remediation strings to the prescribed form left the surrounding sweep with four more prescriptive copies that are still unhardened. Filed rather than ridden along: they are a different file surface than that card's declared one, and one of them is a published skill with its own line/token budget rules.

                          Measured

                          grep -rn "worktree add" over the tree at origin/main4f65837a, keeping only the copies that PRESCRIBE a recipe to an agent (comparison worktrees, --detach provenance recipes, and selftest fixtures are excluded — they are not instructions anyone follows to start work):

                          file:linerecipe as writtenmissing fetch + origin/missing --no-track
                          .claude/skills/checklist-author/SKILL.md:33git worktree add ../objectstack-<task> -b <branch> mainyesyes
                          .claude/agents/os-dev.md:33git worktree add ../<repo>-issue-<n> -b claude/issue-<n>-<slug> origin/mainnoyes
                          .claude/skills/dogfood-verification/SKILL.md:140git worktree add -b <branch> /tmp/pr origin/mainnoyes
                          skills/objectstack-pm-dispatch/SKILL.md:741git worktree add ../<repo>-issue-<n> -b claude/issue-<n>-<slug> origin/{default_branch}noyes

                          grep -c "no-track" over all four: 0.

                          (Reading this through a tool that strips tag-shaped fragments? The <task> / <branch> / <repo> placeholders may render empty — read the files at the line numbers above.)

                          Why it matters, per hazard

                          • No --no-track (all four) — plain -b writes branch.NAME.remote / branch.NAME.merge into the .git/config that every worktree of the repo SHARES. This is the class already adjudicated in 13052 / ui 6880 and already hardened in AGENTS.md Prime Directive 11 and CLAUDE.md; these copies were not swept with it.
                          • Based on local main, with no fetch (checklist-author only) — bases the new tree on a stale commit. The ui 6208 class; 11540 measured a live shared checkout 120 commits and 179 hours behind.

                          .claude/agents/os-dev.md:33 is the highest-traffic of the four: it is the operating template every dispatched developer agent runs under, so its recipe is executed on essentially every card.

                          Not one card

                          Three of the four are internal (.claude/**). The fourth, skills/objectstack-pm-dispatch/SKILL.md, is a customer-published skill — it is a template for OTHER repositories (note the {default_branch} interpolation), so the correct hardened spelling there is not simply a copy of this repo's line, and any edit there is subject to the published-skills budget discipline. Splitting or scoping that half is a triage call, not one this seat should make unilaterally.

                          Unassigned and untriaged on purpose.

                          Refs: 13663 (the hooks half) · PR 13727 · 13052 / ui 6880 (the --no-track adjudications) · ui 6208 and 11540 (the unfetched-main adjudication).

                          Generated by Claude Code

                          Metadata

                          Metadata

                          Assignees

                          No one assigned

                            Type

                            No type

                            Projects

                            No projects

                              Milestone

                              No milestone

                              Relationships

                              None yet

                              Development

                              No branches or pull requests

                              Issue actions

                              , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode"); } } catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); } })(); })();
                              Skip to content

                              [finding] Four more agent-facing copies of the worktree recipe still teach the unhardened form — all four miss --no-track, two also base off unfetched local main #13729

                              Description

                              @huangyiirene

                              Found while implementing the hooks half (13663 / PR 13727). Aligning the two guard-main-checkout remediation strings to the prescribed form left the surrounding sweep with four more prescriptive copies that are still unhardened. Filed rather than ridden along: they are a different file surface than that card's declared one, and one of them is a published skill with its own line/token budget rules.

                              Measured

                              grep -rn "worktree add" over the tree at origin/main4f65837a, keeping only the copies that PRESCRIBE a recipe to an agent (comparison worktrees, --detach provenance recipes, and selftest fixtures are excluded — they are not instructions anyone follows to start work):

                              file:linerecipe as writtenmissing fetch + origin/missing --no-track
                              .claude/skills/checklist-author/SKILL.md:33git worktree add ../objectstack-<task> -b <branch> mainyesyes
                              .claude/agents/os-dev.md:33git worktree add ../<repo>-issue-<n> -b claude/issue-<n>-<slug> origin/mainnoyes
                              .claude/skills/dogfood-verification/SKILL.md:140git worktree add -b <branch> /tmp/pr origin/mainnoyes
                              skills/objectstack-pm-dispatch/SKILL.md:741git worktree add ../<repo>-issue-<n> -b claude/issue-<n>-<slug> origin/{default_branch}noyes

                              grep -c "no-track" over all four: 0.

                              (Reading this through a tool that strips tag-shaped fragments? The <task> / <branch> / <repo> placeholders may render empty — read the files at the line numbers above.)

                              Why it matters, per hazard

                              • No --no-track (all four) — plain -b writes branch.NAME.remote / branch.NAME.merge into the .git/config that every worktree of the repo SHARES. This is the class already adjudicated in 13052 / ui 6880 and already hardened in AGENTS.md Prime Directive 11 and CLAUDE.md; these copies were not swept with it.
                              • Based on local main, with no fetch (checklist-author only) — bases the new tree on a stale commit. The ui 6208 class; 11540 measured a live shared checkout 120 commits and 179 hours behind.

                              .claude/agents/os-dev.md:33 is the highest-traffic of the four: it is the operating template every dispatched developer agent runs under, so its recipe is executed on essentially every card.

                              Not one card

                              Three of the four are internal (.claude/**). The fourth, skills/objectstack-pm-dispatch/SKILL.md, is a customer-published skill — it is a template for OTHER repositories (note the {default_branch} interpolation), so the correct hardened spelling there is not simply a copy of this repo's line, and any edit there is subject to the published-skills budget discipline. Splitting or scoping that half is a triage call, not one this seat should make unilaterally.

                              Unassigned and untriaged on purpose.

                              Refs: 13663 (the hooks half) · PR 13727 · 13052 / ui 6880 (the --no-track adjudications) · ui 6208 and 11540 (the unfetched-main adjudication).

                              Generated by Claude Code

                              Metadata

                              Metadata

                              Assignees

                              No one assigned

                                Type

                                No type

                                Projects

                                No projects

                                  Milestone

                                  No milestone

                                  Relationships

                                  None yet

                                  Development

                                  No branches or pull requests

                                  Issue actions