### Task 12: Documentation reconciliation

**Rationale:** CLAUDE.md's "six-layer defense" section presents Layers 1–2 as active; they were dead. After Tasks 9–11 they are live again — but the docs and any memory note should reflect the fix's provenance (per `memory/` conventions and `feedback_plans_must_include_docs.md`, doc updates ship *with* the change, not deferred).

**Files:**
- Modify: `CLAUDE.md` (the "Worktree-Leakage Defenses" / permission-mode note, if it references the mode)
- Create: `memory/project_dispatch_permission_mode_restored.md` + index line in `MEMORY.md`

- [ ] **Step 1: Update CLAUDE.md** — if any line states or implies the dispatch path uses `bypassPermissions`, correct it to `"default"` and note that `can_use_tool` (Layers 1–2) is enforced. Do not restate git-history forensics in CLAUDE.md (that belongs in memory/).

- [ ] **Step 2: Write the memory note**

```markdown
---
name: project_dispatch_permission_mode_restored
description: Dispatch path enforces can_use_tool via permission_mode=default; bypassPermissions disabled Layers 1-2 for many releases
metadata:
  type: project
---

The dispatcher (`task_handler.py`) used `permission_mode="bypassPermissions"` at
the two ClaudeAgentOptions sites, under which the SDK never invokes
`can_use_tool` — silently disabling Layers 1–2 of the six-layer worktree-leak
defense (file-tool path sandbox, Bash path checks, exempt-command jail check,
ALWAYS_BLOCK dangerous-command blocklist). OS sandbox (Layer 4) still blocked
writes, so the gap was write-safe but allowed dangerous non-write commands
(`sudo`, `curl --upload-file` exfil).

**Fix (2026-07):** tokenized `ALWAYS_BLOCK` matching first ([[...]]) so single-token
patterns match only as argv0 (else `mkdir subdir` → blocked on `su`), then flipped
both sites to `permission_mode="default"`. A source-level regression test now
guards against reintroducing `bypassPermissions`.

**How to apply:** any new dispatch-path ClaudeAgentOptions must use `"default"`,
not `"bypassPermissions"`. See CLAUDE.md "Cross-layer rule — nested sandbox";
this change does not touch SandboxSettings, so the nesting matrix is unaffected.
```

Add to `MEMORY.md`: `- [Dispatch path enforces can_use_tool (not bypassPermissions)](project_dispatch_permission_mode_restored.md) — Layers 1-2 were dead for releases; default mode restored 2026-07`

- [ ] **Step 3: Commit**

```bash
git add CLAUDE.md memory/project_dispatch_permission_mode_restored.md memory/MEMORY.md
git commit -m "docs: reconcile six-layer defense docs with restored can_use_tool enforcement"
```

---

## Self-Review

**Spec coverage:** Phase A covers the audit's top-3 correctness fixes (Tasks 1–3) + all five quick wins (Tasks 4–8: rotation guard, slug uniqueness, Ollama alias, UI host, gate killpg). Phase B covers security restoration (Tasks 9–12: ALWAYS_BLOCK tokenization → default mode → regression guard → docs). The cost/token/circuit wiring (audit #5) and per-task ceilings (#7), SDK session resume (#8), migration reconciler (#9), and egress default-deny (#10) are **intentionally deferred** — they are medium/large and warrant their own plan; this plan is the "stop the bleeding" batch. Flag to the human: schedule a follow-up plan for those.

**Placeholder scan:** every code step shows concrete code; test steps show full test bodies; commands are exact `uv run …` invocations. One soft spot: Task 5 Step 4 and Task 3 Step 1 tell the implementer to *read* the neighbouring file (`cleanup.py:430-440`, `tests/orchestrator/test_dispatcher.py`) for the exact row-variable / fixture names — this is deliberate (those names weren't captured at plan time) and bounded to a single read.

**Type consistency:** `make_branch_name` gains `task_id: str | None = None` (Task 5) consistently across `slug.py`, `task_handler.py:750`, `cleanup.py:437`. `Dispatcher.pause(reason=None)` and `pause_reason` (Task 2) are used consistently in `dispatcher.py` and read in `run_cli.py`. `_command_is_blocked` (Task 9) has one signature, called from both permission callbacks. `permission_mode="default"` is the single literal both dispatch sites (Task 10) and the regression guard (Task 11) reference.
