# Task 10 Report: Restore can_use_tool enforcement on the dispatch path

## Pre-fix FAIL confirmation

`uv run pytest tests/orchestrator/test_dispatch_permission_mode.py -v` with the source still containing `bypassPermissions`:

```
FAILED tests/orchestrator/test_dispatch_permission_mode.py::test_dispatch_does_not_use_bypass_permissions
AssertionError: 'permission_mode="bypassPermissions"' is contained here
1 failed, 1 passed
```

`test_callback_denies_sudo_allows_ls` passed immediately (the callback itself was already correct).

## Both permission_mode sites changed

`claw_forge/orchestrator/task_handler.py`:
- Line 1380 (primary options construction): `"bypassPermissions"` → `"default"`
- Line 1664 (rotation-retry options reconstruction): `"bypassPermissions"` → `"default"`

Verified with `grep -n "bypassPermissions\|permission_mode" task_handler.py` — zero remaining `bypassPermissions` occurrences, two `"default"` occurrences.

The `_make_sdk_sandbox_settings(isolation_active=…)` wiring at line 1370 was not touched — the nested-sandbox landmine (`memory/project_nested_sandbox_landmine.md`) is about `SandboxSettings`, not `permission_mode`, and this change is orthogonal.

## Comment fix in permissions.py

`claw_forge/agent/permissions.py` block comment above `ALWAYS_BLOCK` (lines 30-34) updated from the inaccurate "Matched as substrings of the command string" description to accurately document the post-tokenization matching rules:
- Single-token entries match as argv[0] (including dotted-suffix variants like `mkfs.ext4`)
- Multi-token entries (containing a space) match as substrings

## Test results

```
tests/orchestrator/test_dispatch_permission_mode.py  2 passed
tests/orchestrator/  (full suite)  80 passed, 1 warning
tests/agent/test_permissions.py  81 passed  (isolated run)
ruff check claw_forge/ tests/  → All checks passed!
```

## Verification

The `can_use_tool` callback's catch-all tail (`return PermissionResultAllow(behavior="allow")`) means no benign tool call stalls awaiting an interactive prompt — confirmed by 81 passing permissions tests covering allow/deny paths exhaustively.
