@aurorajs.dev/catalyst-cli 1.0.2 → 2.0.0

package/dist/templates/monorepo/scripts/backlog/launch.test.ts

@@ -0,0 +1,3126 @@
+/**
+ * TDD spec for `scripts/backlog/launch.ts` (tasks 3.9/3.10).
+ *
+ * Runner: `node --import tsx --test scripts/backlog/launch.test.ts`
+ *
+ * Covers: `loadLaneConfig` parsing `lanes.json`'s shape via native `JSON.parse` (the hand-rolled
+ * YAML parser was retired — a private parser is unowned complexity `JSON.parse` doesn't have);
+ * `resolveLane` — tier:complex refused on lane:local, only tier:minor accepted on
+ * lane:local, path:direct/path:sdd resolving to sonnet/opus on the frontier lane (implements
+ * `specs/backlog-task-dispatcher/spec.md` — "Per-lane launch preparation"); `buildLaunch`'s exact
+ * command/args/env/cwd/timeout per lane (design.md — Component design, Executor prompt contract);
+ * `checkLocalModelLoaded` against LM Studio's `/api/v0/models` shape (implements
+ * "Local-lane model readiness check", Phase 1 spike 1.6's finding: match on `id` AND
+ * `state === "loaded"`); and `resetInjectorCache` (Phase 1 spike 1.3's finding: the
+ * business-rules injector's cache must be reset per dispatch attempt); and `spawnWorker`'s async,
+ * line-streamed spawn (design.md — Component design, `launch` row: "spawn; stream `stream-json` to
+ * disk"), driven against a real short-lived `node` process rather than a real `claude`.
+ */
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { describe, it } from 'node:test';
+import { isDeadBashRule } from './guards.js';
+import {
+  backlogRulesForTask,
+  buildLaunch,
+  checkLocalModelLoaded,
+  composeGrantedAllow,
+  dispatchLimitsFrom,
+  loadLaneConfig,
+  loadSettingsAllowRules,
+  resetInjectorCache,
+  RESOLVE_LANE_REFUSAL,
+  resolveLane,
+  resolveOrphanInProgressThresholdMs,
+  sanitizeInheritedEnv,
+  settingsAllowRulesToDeny,
+  settingSourcesFlag,
+  settingsSourcePaths,
+  spawnWorker,
+  testCommandRuleForTask,
+  type FrontierLaneProfile,
+  type FrontierLaneSettings,
+  type Launch,
+  type LocalLaneProfile,
+  type LocalLaneSettings,
+  type SettingsSource,
+} from './launch.js';
+import {
+  EXECUTION_PATH,
+  LANE,
+  TIER,
+  type SettingsAllowRule,
+  type SlotInfo,
+  type Task,
+} from './types.js';
+
+/** Loaded allow rules as the PROJECT file contributes them — the source most tests are about. */
+const projectRules = (...rules: string[]): SettingsAllowRule[] =>
+  rules.map((rule) => ({ rule, source: 'project' as const }));
+
+/** Loaded allow rules as the USER file contributes them — the only source the LOCAL lane loads. */
+const userRules = (...rules: string[]): SettingsAllowRule[] =>
+  rules.map((rule) => ({ rule, source: 'user' as const }));
+
+const LANES_JSON_PATH = path.join(import.meta.dirname, 'lanes.json');
+
+const baseTask = (overrides: Partial<Task> = {}): Task => ({
+  id: 'T-1',
+  status: 'Queued',
+  tier: TIER.MINOR,
+  lane: LANE.LOCAL,
+  path: EXECUTION_PATH.DIRECT,
+  filesToTouch: [],
+  testCommand: null,
+  acceptanceCriteria: [],
+  definitionOfDone: [],
+  dependsOn: [],
+  attempts: 0,
+  priority: 0,
+  createdAt: 0,
+  updatedAt: 0,
+  ...overrides,
+});
+
+const slot: SlotInfo = {
+  name: 'dispatch-a',
+  path: '/slots/dispatch-a',
+  lane: LANE.LOCAL,
+  taskId: 'T-1',
+  pid: 111,
+  lockfileHash: 'abc',
+};
+
+// ── loadLaneConfig ─────────────────────────────────────────────────────────────
+
+describe('loadLaneConfig', () => {
+  it('parses the real lanes.json shape', () => {
+    const config = loadLaneConfig(LANES_JSON_PATH);
+
+    assert.equal(config.slotsRoot, '.claude/worktrees');
+    assert.deepEqual(config.slots, ['dispatch-a', 'dispatch-b', 'dispatch-c']);
+    assert.equal(config.attempts, 3);
+
+    assert.equal(config.lanes.local.settings, 'scripts/backlog/lanes/local.settings.json');
+    assert.equal(config.lanes.local.maxParallel, 1);
+    assert.equal(config.lanes.local.effort, 'medium');
+    assert.equal(config.lanes.local.maxTurns, 40);
+    assert.equal(config.lanes.local.timeoutMinutes, 60);
+    assert.equal(config.lanes.local.healthCheckUrl, 'http://localhost:1234');
+    assert.equal(config.lanes.local.reviewerModel, 'sonnet');
+    assert.equal(config.lanes.local.reviewerTimeoutMinutes, 15);
+
+    assert.equal(config.lanes.frontier.settings, 'scripts/backlog/lanes/frontier.settings.json');
+    assert.equal(config.lanes.frontier.maxParallel, 2);
+    assert.deepEqual(config.lanes.frontier.model, { direct: 'sonnet', sdd: 'opus' });
+    assert.equal(config.lanes.frontier.maxTurns, 120);
+    // This machine authenticates with a claude.ai subscription: nothing is billed per token, so the
+    // shipped lanes.json declares no maxBudgetUsd (T-3 measured a free local-lane run printing
+    // `cost=$2.40` — the estimate is real, the bill is not, and the cap only truncated the work).
+    assert.equal(config.lanes.frontier.maxBudgetUsd, undefined);
+    assert.equal(config.lanes.frontier.timeoutMinutes, 90);
+
+    // T-8 point 5: the shipped file declares 4 — `dispatch.ts` converts this to ms and passes it as
+    // `MaintenanceContext.orphanInProgressThresholdMs`, which gates the sweep's orphan-`In Progress`
+    // check (point 10).
+    assert.equal(config.orphanInProgressThresholdHours, 24);
+  });
+
+  it('parses a minimal synthetic file with the same shape', () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'backlog-lanes-'));
+    const file = path.join(dir, 'lanes.json');
+    fs.writeFileSync(
+      file,
+      JSON.stringify({
+        slotsRoot: '.claude/worktrees',
+        slots: ['dispatch-a', 'dispatch-b'],
+        attempts: 3,
+        orphanInProgressThresholdHours: 24,
+        lanes: {
+          local: {
+            settings: 'scripts/backlog/lanes/local.settings.json',
+            maxParallel: 1,
+            effort: 'medium',
+            maxTurns: 40,
+            timeoutMinutes: 30,
+            healthCheckUrl: 'http://localhost:1234',
+            reviewerModel: 'sonnet',
+            reviewerTimeoutMinutes: 15,
+          },
+          frontier: {
+            settings: 'scripts/backlog/lanes/frontier.settings.json',
+            maxParallel: 2,
+            model: { direct: 'sonnet', sdd: 'opus' },
+            maxTurns: 120,
+            maxBudgetUsd: 5,
+            timeoutMinutes: 90,
+          },
+        },
+      }),
+    );
+
+    const config = loadLaneConfig(file);
+    assert.deepEqual(config.slots, ['dispatch-a', 'dispatch-b']);
+    assert.equal(config.lanes.local.maxTurns, 40);
+    assert.deepEqual(config.lanes.frontier.model, { direct: 'sonnet', sdd: 'opus' });
+    // G1: a hung reviewer holds a slot for as long as nobody bounds it. `lanes.json` is the only
+    // source of truth for this bound — there is no code-level fallback (see the dedicated
+    // "missing entirely" test below), so the synthetic file above must declare it.
+    assert.equal(config.lanes.local.reviewerTimeoutMinutes, 15);
+    // T-8 point 5: same rule for the sweep's orphan threshold — mandatory in `lanes.json`, no
+    // code default, so the synthetic file above declares it too.
+    assert.equal(config.orphanInProgressThresholdHours, 24);
+  });
+
+  // T-8 point 5.
+  describe('orphanInProgressThresholdHours', () => {
+    it('carries a declared value through, so editing lanes.json actually changes the sweep threshold', () => {
+      const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'backlog-lanes-'));
+      const file = path.join(dir, 'lanes.json');
+      fs.writeFileSync(
+        file,
+        JSON.stringify({
+          slotsRoot: '.claude/worktrees',
+          slots: ['dispatch-a'],
+          attempts: 3,
+          orphanInProgressThresholdHours: 8,
+          lanes: {
+            local: {
+              settings: 'scripts/backlog/lanes/local.settings.json',
+              maxParallel: 1,
+              effort: 'medium',
+              maxTurns: 40,
+              timeoutMinutes: 30,
+              healthCheckUrl: 'http://localhost:1234',
+              reviewerModel: 'sonnet',
+              reviewerTimeoutMinutes: 15,
+            },
+            frontier: {
+              settings: 'scripts/backlog/lanes/frontier.settings.json',
+              maxParallel: 2,
+              model: { direct: 'sonnet', sdd: 'opus' },
+              maxTurns: 120,
+              timeoutMinutes: 90,
+            },
+          },
+        }),
+      );
+
+      assert.equal(loadLaneConfig(file).orphanInProgressThresholdHours, 8);
+    });
+
+    it('throws on a non-numeric orphanInProgressThresholdHours', () => {
+      const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'backlog-lanes-'));
+      const file = path.join(dir, 'lanes.json');
+      fs.writeFileSync(
+        file,
+        JSON.stringify({
+          slotsRoot: '.claude/worktrees',
+          slots: ['dispatch-a'],
+          attempts: 3,
+          orphanInProgressThresholdHours: 'four',
+          lanes: {
+            local: {
+              settings: 'scripts/backlog/lanes/local.settings.json',
+              maxParallel: 1,
+              effort: 'medium',
+              maxTurns: 40,
+              timeoutMinutes: 30,
+              healthCheckUrl: 'http://localhost:1234',
+              reviewerModel: 'sonnet',
+              reviewerTimeoutMinutes: 15,
+            },
+            frontier: {
+              settings: 'scripts/backlog/lanes/frontier.settings.json',
+              maxParallel: 2,
+              model: { direct: 'sonnet', sdd: 'opus' },
+              maxTurns: 120,
+              timeoutMinutes: 90,
+            },
+          },
+        }),
+      );
+
+      assert.throws(
+        () => loadLaneConfig(file),
+        /expected a number at "orphanInProgressThresholdHours"/,
+      );
+    });
+
+    it('throws when orphanInProgressThresholdHours is missing entirely — lanes.json is the only source, there is no code fallback', () => {
+      const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'backlog-lanes-'));
+      const file = path.join(dir, 'lanes.json');
+      fs.writeFileSync(
+        file,
+        JSON.stringify({
+          slotsRoot: '.claude/worktrees',
+          slots: ['dispatch-a'],
+          attempts: 3,
+          lanes: {
+            local: {
+              settings: 'scripts/backlog/lanes/local.settings.json',
+              maxParallel: 1,
+              effort: 'medium',
+              maxTurns: 40,
+              timeoutMinutes: 30,
+              healthCheckUrl: 'http://localhost:1234',
+              reviewerModel: 'sonnet',
+              reviewerTimeoutMinutes: 15,
+            },
+            frontier: {
+              settings: 'scripts/backlog/lanes/frontier.settings.json',
+              maxParallel: 2,
+              model: { direct: 'sonnet', sdd: 'opus' },
+              maxTurns: 120,
+              timeoutMinutes: 90,
+            },
+          },
+        }),
+      );
+
+      assert.throws(
+        () => loadLaneConfig(file),
+        /expected a number at "orphanInProgressThresholdHours"/,
+      );
+    });
+
+    // Defect 12 (2026-09-08): `0` is the value an operator reaches for to turn the sweep off, not
+    // an invalid one — `loadLaneConfig` must accept it (the "off" translation itself happens in
+    // `resolveOrphanInProgressThresholdMs`, tested separately below).
+    const writeLanesJsonWithOrphanThreshold = (orphanInProgressThresholdHours: number): string => {
+      const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'backlog-lanes-'));
+      const file = path.join(dir, 'lanes.json');
+      fs.writeFileSync(
+        file,
+        JSON.stringify({
+          slotsRoot: '.claude/worktrees',
+          slots: ['dispatch-a'],
+          attempts: 3,
+          orphanInProgressThresholdHours,
+          lanes: {
+            local: {
+              settings: 'scripts/backlog/lanes/local.settings.json',
+              maxParallel: 1,
+              effort: 'medium',
+              maxTurns: 40,
+              timeoutMinutes: 30,
+              healthCheckUrl: 'http://localhost:1234',
+              reviewerModel: 'sonnet',
+              reviewerTimeoutMinutes: 15,
+            },
+            frontier: {
+              settings: 'scripts/backlog/lanes/frontier.settings.json',
+              maxParallel: 2,
+              model: { direct: 'sonnet', sdd: 'opus' },
+              maxTurns: 120,
+              timeoutMinutes: 90,
+            },
+          },
+        }),
+      );
+      return file;
+    };
+
+    it('accepts 0 as a legal value — the operator turning the sweep off', () => {
+      assert.equal(
+        loadLaneConfig(writeLanesJsonWithOrphanThreshold(0)).orphanInProgressThresholdHours,
+        0,
+      );
+    });
+
+    it('rejects a negative value — a duration cannot be negative', () => {
+      assert.throws(
+        () => loadLaneConfig(writeLanesJsonWithOrphanThreshold(-1)),
+        /expected a non-negative number at "orphanInProgressThresholdHours"/,
+      );
+    });
+  });
+
+  describe('lanes.local.reviewerTimeoutMinutes', () => {
+    it('throws when reviewerTimeoutMinutes is missing entirely — lanes.json is the only source, there is no code fallback', () => {
+      const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'backlog-lanes-'));
+      const file = path.join(dir, 'lanes.json');
+      fs.writeFileSync(
+        file,
+        JSON.stringify({
+          slotsRoot: '.claude/worktrees',
+          slots: ['dispatch-a'],
+          attempts: 3,
+          orphanInProgressThresholdHours: 24,
+          lanes: {
+            local: {
+              settings: 'scripts/backlog/lanes/local.settings.json',
+              maxParallel: 1,
+              effort: 'medium',
+              maxTurns: 40,
+              timeoutMinutes: 30,
+              healthCheckUrl: 'http://localhost:1234',
+              reviewerModel: 'sonnet',
+            },
+            frontier: {
+              settings: 'scripts/backlog/lanes/frontier.settings.json',
+              maxParallel: 2,
+              model: { direct: 'sonnet', sdd: 'opus' },
+              maxTurns: 120,
+              timeoutMinutes: 90,
+            },
+          },
+        }),
+      );
+
+      assert.throws(
+        () => loadLaneConfig(file),
+        /expected a number at "lanes\.local\.reviewerTimeoutMinutes"/,
+      );
+    });
+  });
+
+  describe('resolveOrphanInProgressThresholdMs', () => {
+    it('converts 0 hours to undefined — step 3c\'s own "disabled" signal, not the most aggressive threshold', () => {
+      assert.equal(resolveOrphanInProgressThresholdMs(0), undefined);
+    });
+
+    it('converts a positive value to milliseconds as-is', () => {
+      assert.equal(resolveOrphanInProgressThresholdMs(4), 4 * 3_600_000);
+      assert.equal(resolveOrphanInProgressThresholdMs(8), 8 * 3_600_000);
+    });
+  });
+
+  it('throws a descriptive error on a malformed field type', () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'backlog-lanes-'));
+    const file = path.join(dir, 'lanes.json');
+    fs.writeFileSync(
+      file,
+      JSON.stringify({
+        slotsRoot: 123,
+        slots: [],
+        attempts: 3,
+        lanes: { local: {}, frontier: { model: {} } },
+      }),
+    );
+
+    assert.throws(() => loadLaneConfig(file), /expected a string at "slotsRoot"/);
+  });
+
+  // T-31, design.md decision 8: an optional top-level handle for the human-review mark's reviewer
+  // half. Ships UNSET — `gh pr create --reviewer <self>` fails when the reviewer is the pull
+  // request's own author, and the dispatcher opens every PR as the same account.
+  describe('harnessReviewer', () => {
+    const minimalLanesJson = (extra: Record<string, unknown>): string => {
+      const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'backlog-lanes-'));
+      const file = path.join(dir, 'lanes.json');
+      fs.writeFileSync(
+        file,
+        JSON.stringify({
+          slotsRoot: '.claude/worktrees',
+          slots: ['dispatch-a'],
+          attempts: 3,
+          orphanInProgressThresholdHours: 24,
+          ...extra,
+          lanes: {
+            local: {
+              settings: 'scripts/backlog/lanes/local.settings.json',
+              maxParallel: 1,
+              effort: 'medium',
+              maxTurns: 40,
+              timeoutMinutes: 30,
+              healthCheckUrl: 'http://localhost:1234',
+              reviewerModel: 'sonnet',
+              reviewerTimeoutMinutes: 15,
+            },
+            frontier: {
+              settings: 'scripts/backlog/lanes/frontier.settings.json',
+              maxParallel: 2,
+              model: { direct: 'sonnet', sdd: 'opus' },
+              maxTurns: 120,
+              timeoutMinutes: 90,
+            },
+          },
+        }),
+      );
+      return file;
+    };
+
+    it('yields undefined when lanes.json declares none — ships unset', () => {
+      assert.equal(loadLaneConfig(minimalLanesJson({})).harnessReviewer, undefined);
+    });
+
+    it('carries a declared handle through', () => {
+      assert.equal(
+        loadLaneConfig(minimalLanesJson({ harnessReviewer: 'octocat' })).harnessReviewer,
+        'octocat',
+      );
+    });
+
+    it('accepts an org/team slug, which is what gh --add-reviewer takes for a team', () => {
+      assert.equal(
+        loadLaneConfig(minimalLanesJson({ harnessReviewer: 'avvale/harness-reviewers' }))
+          .harnessReviewer,
+        'avvale/harness-reviewers',
+      );
+    });
+
+    // T-31 review: this value becomes an argv TOKEN in `gh pr edit … --add-reviewer <value>`. No
+    // shell is involved, so it is not injection — but `gh` parses a leading `-` as a FLAG, so a
+    // handle like `--add-label` would silently become a second option on the dispatcher's own
+    // command line. Validated at load time for its SHAPE, the way `resolveTestCommand` validates
+    // the other operator-supplied string this process spawns.
+    for (const rejected of [
+      '--add-label',
+      '-octocat',
+      'octocat-',
+      'octo cat',
+      'octocat;rm -rf /',
+      'octo/cat/team',
+      '',
+      'a'.repeat(40),
+    ]) {
+      it(`refuses ${JSON.stringify(rejected)} — not a GitHub handle`, () => {
+        assert.throws(
+          () => loadLaneConfig(minimalLanesJson({ harnessReviewer: rejected })),
+          /harnessReviewer/,
+        );
+      });
+    }
+  });
+
+  // T-3: a claude.ai subscription login is not billed per token, so `--max-budget-usd` compares a
+  // cost ESTIMATE against a cap and cuts legitimate work — `maxBudgetUsd` is therefore the one lane
+  // field that may be absent.
+  describe('maxBudgetUsd — optional (a subscription login is not billed per token)', () => {
+    const writeSyntheticLanesJson = (frontierOverrides: Record<string, unknown>): string => {
+      const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'backlog-lanes-'));
+      const file = path.join(dir, 'lanes.json');
+      fs.writeFileSync(
+        file,
+        JSON.stringify({
+          slotsRoot: '.claude/worktrees',
+          slots: ['dispatch-a'],
+          attempts: 3,
+          orphanInProgressThresholdHours: 24,
+          lanes: {
+            local: {
+              settings: 'scripts/backlog/lanes/local.settings.json',
+              maxParallel: 1,
+              effort: 'medium',
+              maxTurns: 40,
+              timeoutMinutes: 30,
+              healthCheckUrl: 'http://localhost:1234',
+              reviewerModel: 'sonnet',
+              reviewerTimeoutMinutes: 15,
+            },
+            frontier: {
+              settings: 'scripts/backlog/lanes/frontier.settings.json',
+              maxParallel: 2,
+              model: { direct: 'sonnet', sdd: 'opus' },
+              maxTurns: 120,
+              timeoutMinutes: 90,
+              ...frontierOverrides,
+            },
+          },
+        }),
+      );
+      return file;
+    };
+
+    it('parses a profile that declares no maxBudgetUsd as undefined', () => {
+      const config = loadLaneConfig(writeSyntheticLanesJson({}));
+      assert.equal(config.lanes.frontier.maxBudgetUsd, undefined);
+    });
+
+    it('parses a profile that declares a positive maxBudgetUsd', () => {
+      const config = loadLaneConfig(writeSyntheticLanesJson({ maxBudgetUsd: 5 }));
+      assert.equal(config.lanes.frontier.maxBudgetUsd, 5);
+    });
+
+    it('throws on a non-numeric maxBudgetUsd', () => {
+      assert.throws(
+        () => loadLaneConfig(writeSyntheticLanesJson({ maxBudgetUsd: 'five' })),
+        /expected a number at "lanes.frontier.maxBudgetUsd"/,
+      );
+    });
+
+    it('throws on a zero maxBudgetUsd (present but not a hard stop is worse than absent)', () => {
+      assert.throws(
+        () => loadLaneConfig(writeSyntheticLanesJson({ maxBudgetUsd: 0 })),
+        /expected a positive number at "lanes.frontier.maxBudgetUsd"/,
+      );
+    });
+
+    it('throws on a negative maxBudgetUsd', () => {
+      assert.throws(
+        () => loadLaneConfig(writeSyntheticLanesJson({ maxBudgetUsd: -1 })),
+        /expected a positive number at "lanes.frontier.maxBudgetUsd"/,
+      );
+    });
+  });
+});
+
+// ── dispatchLimitsFrom (J4: `maxParallel`/`attempts` were dead config) ─────────
+
+describe('dispatchLimitsFrom', () => {
+  it('derives the guard caps from the loaded config, not from a module constant', () => {
+    const config = loadLaneConfig(LANES_JSON_PATH);
+    assert.deepEqual(dispatchLimitsFrom(config), {
+      capacity: { local: 1, frontier: 2 },
+      maxAttempts: 3,
+    });
+  });
+
+  it('carries an edited config through, so editing lanes.json actually changes the caps', () => {
+    const config = loadLaneConfig(LANES_JSON_PATH);
+    const edited = {
+      ...config,
+      attempts: 5,
+      lanes: {
+        local: { ...config.lanes.local, maxParallel: 2 },
+        frontier: { ...config.lanes.frontier, maxParallel: 3 },
+      },
+    };
+    assert.deepEqual(dispatchLimitsFrom(edited), {
+      capacity: { local: 2, frontier: 3 },
+      maxAttempts: 5,
+    });
+  });
+});
+
+// ── resolveLane ────────────────────────────────────────────────────────────────
+
+describe('resolveLane', () => {
+  it('refuses tier:complex on lane:local', () => {
+    const result = resolveLane(baseTask({ tier: TIER.COMPLEX, lane: LANE.LOCAL }));
+    assert.deepEqual(result, { kind: 'refused', reason: RESOLVE_LANE_REFUSAL.COMPLEX_ON_LOCAL });
+  });
+
+  it('refuses tier:medium on lane:local (only tier:minor is accepted locally)', () => {
+    const result = resolveLane(baseTask({ tier: TIER.MEDIUM, lane: LANE.LOCAL }));
+    assert.deepEqual(result, { kind: 'refused', reason: RESOLVE_LANE_REFUSAL.NON_MINOR_ON_LOCAL });
+  });
+
+  it('accepts tier:minor on lane:local', () => {
+    const result = resolveLane(baseTask({ tier: TIER.MINOR, lane: LANE.LOCAL }));
+    assert.deepEqual(result, { kind: 'local' });
+  });
+
+  it('resolves path:direct to sonnet on the frontier lane', () => {
+    const result = resolveLane(
+      baseTask({ lane: LANE.FRONTIER, path: EXECUTION_PATH.DIRECT, tier: TIER.MEDIUM }),
+    );
+    assert.deepEqual(result, { kind: 'frontier', model: 'sonnet' });
+  });
+
+  it('resolves path:sdd to opus on the frontier lane', () => {
+    const result = resolveLane(
+      baseTask({ lane: LANE.FRONTIER, path: EXECUTION_PATH.SDD, tier: TIER.COMPLEX }),
+    );
+    assert.deepEqual(result, { kind: 'frontier', model: 'opus' });
+  });
+
+  it('refuses a task missing tier/lane/path triage', () => {
+    const result = resolveLane(baseTask({ tier: undefined }));
+    assert.deepEqual(result, { kind: 'refused', reason: RESOLVE_LANE_REFUSAL.MISSING_TRIAGE });
+  });
+});
+
+// ── The shipped lane settings files ───────────────────────────────────────────
+
+describe('lanes/local.settings.json — the executor permission surface', () => {
+  const settings = JSON.parse(
+    fs.readFileSync(path.join(import.meta.dirname, 'lanes', 'local.settings.json'), 'utf8'),
+  ) as { permissions: { allow: string[]; deny: string[] } };
+
+  // G14: the worker's `backlog` access is granted PER LAUNCH, scoped to its own task id
+  // (`backlogRulesForTask`), never as a standing wildcard in the file. A wildcard let a worker edit
+  // and re-status any task on the board — including moving another one to `Queued`.
+  it('declares no standing backlog wildcard: the per-task rules are added at launch', () => {
+    const backlogRules = settings.permissions.allow.filter((rule) => rule.includes('backlog'));
+    assert.deepEqual(backlogRules, []);
+  });
+
+  it('still denies the executor git push and gh outright', () => {
+    assert.ok(settings.permissions.deny.includes('Bash(git push*)'));
+    assert.ok(settings.permissions.deny.includes('Bash(gh *)'));
+  });
+
+  // H8: `Bash(pnpm --filter * test*)` was a trailing glob over every pnpm subcommand whose words
+  // happened to line up — `pnpm --filter x test-and-publish`, and anything else `test*` matched. The
+  // task's own snapshotted, allowlist-validated command is still granted per launch, never as a
+  // standing rule here. T-60 adds ONE standing pnpm rule: `exec prettier --check`, copied verbatim
+  // from `frontier.settings.json`, where it is a fixed verification tool (not a task-shaped test
+  // command) — the worker must be able to test the same Prettier condition the close judges it on.
+  it('grants no standing pnpm rule beyond the fixed prettier --check pair', () => {
+    assert.deepEqual(settings.permissions.allow.filter((rule) => rule.includes('pnpm')), [
+      'Bash(pnpm --filter * exec prettier --check)',
+      'Bash(pnpm --filter * exec prettier --check *)',
+    ]);
+  });
+
+  // H13: bare `Edit`/`Write` let the executor write anywhere the process could reach, the main
+  // checkout included. `Edit(<glob>)` is the form Phase 1 spike 1.2 verified; the slot is the cwd.
+  it('scopes Edit and Write to the slot rather than granting them bare', () => {
+    assert.ok(!settings.permissions.allow.includes('Edit'));
+    assert.ok(!settings.permissions.allow.includes('Write'));
+    assert.ok(settings.permissions.allow.includes('Edit(./**)'));
+    assert.ok(settings.permissions.allow.includes('Write(./**)'));
+  });
+
+  // H5: the dispatcher's own `git commit` runs in this slot. Without these, a worker could write
+  // `.husky/pre-commit` and have the close execute it — hence `--no-verify` AND these rules AND the
+  // close's `LOCAL_FORBIDDEN_PATHS`: three mechanisms, because a permission rule can fail to match.
+  it('denies writes to everything that governs or runs the dispatcher itself', () => {
+    for (const path of [
+      '.husky/**',
+      '.claude/**',
+      'scripts/**',
+      'package.json',
+      'pnpm-lock.yaml',
+      'node_modules/**',
+      '.git/**',
+    ]) {
+      assert.ok(settings.permissions.deny.includes(`Edit(${path})`), `missing Edit(${path})`);
+      assert.ok(settings.permissions.deny.includes(`Write(${path})`), `missing Write(${path})`);
+    }
+  });
+
+  // K6: the board is the dispatcher's own state, and the worker writes to it only through
+  // `worker-edit.ts`. An `Edit` straight into the slot's `.backlog/` copy would rewrite the very
+  // acceptance criteria the close judges the attempt against, past the wrapper entirely.
+  it('denies writes to the slot own .backlog copy: the board is the dispatcher state', () => {
+    assert.ok(settings.permissions.deny.includes('Edit(.backlog/**)'));
+    assert.ok(settings.permissions.deny.includes('Write(.backlog/**)'));
+  });
+});
+
+// T-7: measured 2026-09-07 (Claude Code 2.1.263) — a Bash rule combining a mid-rule `*` with a
+// trailing `:*` matches NOTHING, ever. Both shipped lane files are asserted against that shape so
+// a future edit cannot reintroduce the five now-fixed frontier rules' mistake, silently, in either
+// file: the rule would read as a grant in review and block/deny nothing at runtime.
+describe('lane settings — no dead Bash rule ships in either lane file', () => {
+  for (const file of ['local.settings.json', 'frontier.settings.json']) {
+    it(`ships no dead Bash rule in ${file}`, () => {
+      const loaded = JSON.parse(
+        fs.readFileSync(path.join(import.meta.dirname, 'lanes', file), 'utf8'),
+      ) as { permissions?: { allow?: string[]; deny?: string[] } };
+      const rules = [...(loaded.permissions?.allow ?? []), ...(loaded.permissions?.deny ?? [])];
+      const dead = rules.filter(isDeadBashRule);
+      assert.deepEqual(dead, [], `${file} ships a dead Bash rule: ${dead.join(', ')}`);
+    });
+  }
+});
+
+describe('lanes/frontier.settings.json', () => {
+  const settings = JSON.parse(
+    fs.readFileSync(path.join(import.meta.dirname, 'lanes', 'frontier.settings.json'), 'utf8'),
+  ) as { permissions?: { allow?: string[]; deny?: string[] } };
+
+  it('declares no model: resolveLane derives it from the task path label and always wins', () => {
+    assert.ok(!('model' in settings));
+  });
+
+  // P1 (round 9): this list is the frontier lane's WHOLE allowance, written out here. It used to be
+  // the project's own `.claude/settings.json` allowlist minus a deny-by-prefix filter, and a
+  // subtraction over a list somebody else maintains reopens with every rule they add: the filter
+  // had to be right about a command that did not exist when it was written. What SURVIVES review is
+  // the list itself — every rule below was read once and stays read.
+  //
+  // The commands are the ones a frontier ORCHESTRATOR needs to do its job: inspect the tree it is
+  // working in (`git status`/`diff`/`log`/`show`/`rev-parse`/`symbolic-ref` — read-only verbs, none
+  // of which stage, commit, move a branch or discard a file), run the SDD flow (`openspec`), run the
+  // generator (`catalyst`, plus the two T-48 exceptions below that build and run it FROM the slot's
+  // own sources), verify its own work in a workspace (a scoped `test`, Prettier's `--check`,
+  // `tsc --noEmit`), evolve the database schema OFFLINE (`db:generate` diffs `*.schema.ts` against
+  // the last `snapshot.json`; `db:check` is the same offline comparison — see
+  // `catalyst-schema-migrations`; neither opens a connection), and READ the live database
+  // (`db:query`). The lane's database boundary is READ-ONLY, not absent: `db:query` does open a
+  // connection, and what keeps it harmless is the dedicated non-superuser role it connects with
+  // plus two more layers, not this list — see the comment on its rules below. TWO rules here DO
+  // run a script out of the tree the worker can write to — `WRITABLE_TREE_RUNNER_EXCEPTIONS` below
+  // names them and reasons about the exposure.
+  const FRONTIER_ALLOW: readonly string[] = [
+    'Read',
+    'Grep',
+    'Glob',
+    'Edit(./**)',
+    'Write(./**)',
+    'Agent',
+    'Skill',
+    'TodoWrite',
+    'Bash(git status:*)',
+    'Bash(git diff:*)',
+    'Bash(git log:*)',
+    'Bash(git show:*)',
+    'Bash(git rev-parse:*)',
+    'Bash(git symbolic-ref:*)',
+    'Bash(openspec:*)',
+    'Bash(catalyst:*)',
+    // T-48: build and run the generator FROM THE SLOT'S OWN SOURCES. The global `catalyst` binary
+    // (line above) is a cmd-shim resolving to a globally-LINKED package that is itself a symlink to
+    // the MAIN checkout's `packages/cli` — so it can never verify a schema/template change the
+    // worker made in THIS slot, and running the main checkout's code was also a security property:
+    // that code the worker cannot edit. These two rules trade that property away on purpose — see
+    // `WRITABLE_TREE_RUNNER_EXCEPTIONS` below. `Bash(pnpm --dir packages/cli install:*)` was a third
+    // rule here and was REMOVED (round 3, S1): its `:*` suffix admits a second `--dir` after the
+    // first, and pnpm keeps the LAST one — measured, `pnpm --dir packages/cli install --dir
+    // <anywhere> --dry-run` installs at `<anywhere>`, not at `packages/cli`, anywhere on disk
+    // including the main checkout the dispatcher itself runs from. `packages/cli` stays deliberately
+    // not a workspace member (root `CLAUDE.md`, D8), so its one-time `pnpm --dir packages/cli
+    // install` stays a manual, interactive step (`scripts/worktree-link.sh` / the Worktree Gate),
+    // never a standing frontier grant.
+    'Bash(pnpm cli:build:*)',
+    'Bash(node packages/cli/bin/run.js:*)',
+    // T-7: each command is TWO rules, an exact form and a with-arguments form, never one rule with
+    // a trailing `:*`. Measured (2026-09-07, Claude Code 2.1.263): a Bash rule combining a mid-rule
+    // `*` with a trailing `:*` matches NOTHING — `Bash(pnpm --filter * test:*)` never matched
+    // `pnpm --filter aurora-back test`, and neither did its four siblings. `Bash(cmd * sub)` matches
+    // the command exactly; `Bash(cmd * sub *)` matches it with one or more extra arguments.
+    'Bash(pnpm --filter * test)',
+    'Bash(pnpm --filter * test *)',
+    'Bash(pnpm --filter * exec prettier --check)',
+    'Bash(pnpm --filter * exec prettier --check *)',
+    'Bash(pnpm --filter * exec tsc --noEmit)',
+    'Bash(pnpm --filter * exec tsc --noEmit *)',
+    // T-6: the split subtasks of a Postgres-enum-to-varchar change need to regenerate and verify
+    // a Drizzle migration — both offline (a diff against the last snapshot), never against a real
+    // database, so granting them adds no reach the "no database" boundary above did not already
+    // assume.
+    'Bash(pnpm --filter * db:generate)',
+    'Bash(pnpm --filter * db:generate *)',
+    // T-57: `catalyst-schema-migrations`'s own examples use the ROOT form (`pnpm db:check`, `pnpm
+    // db:generate --name ...`), the same gap T-9 closed for `db:query` below — a worker copying the
+    // skill literally would otherwise run a DENIED command. `db:migrate` stays UNGRANTED: it writes.
+    'Bash(pnpm db:generate)',
+    'Bash(pnpm db:generate *)',
+    'Bash(pnpm --filter * db:check)',
+    'Bash(pnpm --filter * db:check *)',
+    'Bash(pnpm db:check)',
+    'Bash(pnpm db:check *)',
+    // T-9: read-only catalog lookups via `db:query`. Unlike the offline pair above it DOES open a
+    // connection, and only ever runs a single `SELECT`/`WITH` — enforced by the connecting role
+    // (a dedicated non-superuser, the primary control), `validateReadOnlyQuery()` and a READ ONLY
+    // transaction. See `catalyst-schema-migrations`. Both forms are granted because SKILL.md's own
+    // copy-pasteable examples use the ROOT form (`pnpm db:query "<SQL>"`), not the
+    // `--filter` form: a worker following the skill literally would otherwise run a DENIED
+    // command. The root script is a proxy to the same `db:query`, so this adds no reach
+    // beyond the `--filter` form already granted.
+    'Bash(pnpm --filter * db:query)',
+    'Bash(pnpm --filter * db:query *)',
+    'Bash(pnpm db:query)',
+    'Bash(pnpm db:query *)',
+  ];
+
+  it('ships exactly the explicit allow list, in order — no inheritance, nothing implicit', () => {
+    assert.deepEqual(settings.permissions?.allow, [...FRONTIER_ALLOW]);
+  });
+
+  /**
+   * A command that RUNS something out of a tree the worker can write to is arbitrary execution as
+   * the dispatcher, however narrow its rule looks: the worker holds `Edit(./**)`/`Write(./**)` over
+   * the slot, so `node scripts/x.ts` or `pnpm test:backlog` executes a file it just authored. Same
+   * for the git verbs that stage, commit, move a branch or throw work away — the close owns those.
+   * A path-invoked or arbitrary-argument runner has no place in a list that is now hand-maintained —
+   * with the two NAMED exceptions below, each reasoned about on its own terms.
+   */
+  const WRITABLE_TREE_RUNNERS: readonly string[] = [
+    'pnpm test:',
+    'pnpm cli:',
+    'npm ',
+    'eslint',
+    'fd',
+    'find',
+    'npx',
+    'node ',
+    'tsx',
+    'git add',
+    'git commit',
+    'git restore',
+    'git branch',
+  ];
+
+  // T-48 (round 3): TWO named exceptions — `node ` and the new `pnpm cli:` prefix above — never a
+  // widened prefix, never a class of exception. `Bash(node packages/cli/bin/run.js:*)` runs the
+  // CLI's entry point; `Bash(pnpm cli:build:*)` runs its `tsc -b` build
+  // (`packages/cli/package.json`'s own `build` script). Both execute whatever the worker has
+  // written into `packages/cli/` by the time either runs.
+  //
+  //   (a) The global `catalyst` binary (`Bash(catalyst:*)` above) is a cmd-shim resolving to a
+  //       globally-LINKED package that is itself a symlink to the MAIN checkout's `packages/cli` —
+  //       so it can never verify a schema/template change the worker made in THIS slot; both
+  //       exceptions are anchored to files inside the slot instead. Running the main checkout's code
+  //       was ALSO a security property — that code the worker cannot edit — and these two exceptions
+  //       trade it away on purpose.
+  //   (b) The exposure is not new, but it is NARROWER than what these two rules grant — a future
+  //       reader must not over-read the precedent. `pnpm cli:test` (bare, no file argument) is an
+  //       accepted `Test command:` grammar (`ALLOWED_TEST_SCRIPT`, `guards.ts`'s
+  //       `resolveTestCommand`) that matches the project's OWN `Bash(pnpm cli:test:*)` rule exactly
+  //       — no permission conflict, unlike the WITH-an-argument form (README's "Test commands that
+  //       conflict with the project allow list") — and that grant already resolves through
+  //       `packages/cli/package.json`'s own `test` script, which this lane already lets the worker
+  //       edit. But that grant is PER LAUNCH, and only when THAT task declared it as its own test
+  //       command; these two rules are PERMANENT on every frontier launch, whatever the task
+  //       declares. Same package, not the same exposure.
+  //   (c) There is no detector for this surface, and the close's scope check is not one. The scope
+  //       check and the PR's human-review mark (`HUMAN_REVIEW_PATHS`) only see VERSIONED files —
+  //       `close.ts`'s `collectChangedFiles` runs `git diff --name-only` and `git status
+  //       --porcelain --untracked-files=all`, neither with `--ignored`. `packages/cli/dist/` is
+  //       gitignored (`packages/cli/.gitignore`), and both exceptions invoke code that loads
+  //       `dist/`, not `src/` — so a worker can write a payload there, run it through either grant,
+  //       and leave a diff with no trace of it: no scope-check hit, no review mark. The grant is
+  //       accepted anyway because the SAME leak already exists via the declared `Test command:`
+  //       (README: "the standing hole this dispatcher has always had") — not because anything here
+  //       contains it. T-49 tracks closing this gap.
+  const WRITABLE_TREE_RUNNER_EXCEPTIONS: readonly string[] = [
+    'Bash(node packages/cli/bin/run.js:*)',
+    'Bash(pnpm cli:build:*)',
+  ];
+
+  it('the writable-tree-runner exceptions are exactly these two, named', () => {
+    assert.deepEqual(WRITABLE_TREE_RUNNER_EXCEPTIONS, [
+      'Bash(node packages/cli/bin/run.js:*)',
+      'Bash(pnpm cli:build:*)',
+    ]);
+  });
+
+  /**
+   * Whether the writable-tree-runner check refuses this ALLOW rule: a Bash rule not in `exceptions`
+   * whose command matches a `WRITABLE_TREE_RUNNERS` prefix. Pulled out of the assertion below so the
+   * "no bad rule ships" test and the "the exceptions stay narrow" test exercise the SAME mechanism —
+   * comparing two literals in the narrowness test alone proved nothing about the real check (T-48
+   * round 3, T2: that version stayed green under both a widened exception list and a widened match).
+   */
+  function refusesRule(rule: string, exceptions: readonly string[]): boolean {
+    if (exceptions.includes(rule)) {
+      return false;
+    }
+    const command = /^Bash\((.*)\)$/.exec(rule)?.[1];
+    if (command === undefined) {
+      return false; // a file or MCP tool rule carries no command to judge.
+    }
+    return WRITABLE_TREE_RUNNERS.some((runner) => command.startsWith(runner));
+  }
+
+  it('grants no command that executes, stages or discards anything in the slot', () => {
+    for (const rule of settings.permissions?.allow ?? []) {
+      assert.ok(
+        !refusesRule(rule, WRITABLE_TREE_RUNNER_EXCEPTIONS),
+        `${rule} runs or rewrites the slot`,
+      );
+    }
+  });
+
+  // The exceptions above are TWO named rules, never the prefixes reopened: an unrelated rule under
+  // EITHER prefix must still fail the REAL check (`refusesRule`), not a comparison of two literals.
+  it('the exceptions are narrow: an unrelated rule under either prefix still fails the check', () => {
+    assert.equal(
+      refusesRule('Bash(node scripts/whatever-else.js:*)', WRITABLE_TREE_RUNNER_EXCEPTIONS),
+      true,
+    );
+    assert.equal(refusesRule('Bash(pnpm cli:test:*)', WRITABLE_TREE_RUNNER_EXCEPTIONS), true);
+  });
+
+  // M1: under `--permission-mode dontAsk` a tool with NO allow rule is denied, and a lane whose
+  // list held only `Bash(...)` rules gave the frontier orchestrator no way to open a file, let alone
+  // change one: every attempt on this lane would have burned its budget being denied.
+  it('grants the file tools a coding worker cannot work without: a read rule AND a write rule', () => {
+    const allow = settings.permissions?.allow ?? [];
+    assert.ok(allow.includes('Read'), 'the frontier lane must grant Read');
+    assert.ok(
+      allow.some((rule) => /^(?:Edit|Write)(?:\(|$)/.test(rule)),
+      'the frontier lane must grant a write rule (Edit/Write)',
+    );
+  });
+
+  // The frontier worker is a full orchestrator: `CLAUDE.md` has it delegate real work to
+  // sub-agents and read skills by path. Without these two it can neither.
+  it('grants the orchestrator its own tools: sub-agents and skills', () => {
+    const allow = settings.permissions?.allow ?? [];
+    assert.ok(allow.includes('Agent'));
+    assert.ok(allow.includes('Skill'));
+  });
+
+  // G4: the frontier worker's close is run by the DISPATCHER — it commits, pushes and opens the PR
+  // itself. A worker that can do those independently opens PRs nobody planned and pushes work the
+  // close never verified.
+  // J13: the local lane carries BOTH spellings of each rule, because `Bash(gh:*)` and `Bash(gh *)`
+  // match different command shapes and a rule that fails to match denies nothing. The frontier lane
+  // had the pair for `gh` and only one half of it for the push — the wider surface, guarded less.
+  it('denies git push, gh, and the network tools outright, in both rule spellings', () => {
+    const deny = settings.permissions?.deny ?? [];
+    for (const rule of [
+      'Bash(git push:*)',
+      'Bash(git push*)',
+      'Bash(gh:*)',
+      'Bash(gh *)',
+      'WebFetch',
+      'WebSearch',
+    ]) {
+      assert.ok(deny.includes(rule), `frontier deny list is missing ${rule}`);
+    }
+  });
+
+  // L7: belt and braces behind `worker-edit.ts`. The wrapper is the only granted board command, and
+  // T-24 added `--strict-mcp-config` to the frontier launch, which keeps the backlog MCP server from
+  // loading at all — but these rules stay as defence in depth, the same reasoning as the personal
+  // connector deny list below: the protection should not depend on a single flag. A raw board write
+  // reachable by either route re-statuses the task or rewrites the criteria the close judges it
+  // against.
+  it('denies the raw board write on both surfaces: the CLI and the backlog MCP tools', () => {
+    const deny = settings.permissions?.deny ?? [];
+    for (const rule of [
+      'Bash(backlog task edit:*)',
+      'Bash(backlog task edit *)',
+      'mcp__backlog__task_edit',
+      'mcp__backlog__task_create',
+      'mcp__backlog__task_complete',
+      'mcp__backlog__task_archive',
+    ]) {
+      assert.ok(deny.includes(rule), `frontier deny list is missing ${rule}`);
+    }
+  });
+
+  // K6: same reason as on the local lane, and the frontier worker is the one with the wider grant.
+  it('denies writes to the slot own .backlog copy too', () => {
+    const deny = settings.permissions?.deny ?? [];
+    assert.ok(deny.includes('Edit(.backlog/**)'));
+    assert.ok(deny.includes('Write(.backlog/**)'));
+  });
+
+  // T-3: measured — the frontier worker's init event listed 152 tools, including eleven personal
+  // claude.ai connectors (Gmail, Notion, Linear, Asana, Atlassian, Box, Canva, Figma, HubSpot,
+  // Intercom, monday.com) loaded through the account login rather than through any settings file —
+  // the same way `.mcp.json` "is not a settings source and loads regardless" (see this README's
+  // Lane profiles section). A headless worker must not reach a person's mail or project tools, and
+  // a deny rule is what holds "regardless of source" (same section), so each connector's whole MCP
+  // server is denied by name.
+  describe('the personal claude.ai connector deny list (T-3)', () => {
+    const PERSONAL_CONNECTOR_SERVERS = [
+      'claude_ai_Asana',
+      'claude_ai_Atlassian',
+      'claude_ai_Box',
+      'claude_ai_Canva',
+      'claude_ai_Figma',
+      'claude_ai_Gmail',
+      'claude_ai_HubSpot',
+      'claude_ai_Intercom',
+      'claude_ai_Linear',
+      'claude_ai_Notion',
+      'claude_ai_monday_com',
+    ];
+
+    it('denies each personal connector server by its own mcp__<server>__* rule', () => {
+      const deny = settings.permissions?.deny ?? [];
+      for (const server of PERSONAL_CONNECTOR_SERVERS) {
+        assert.ok(
+          deny.includes(`mcp__${server}__*`),
+          `frontier deny list is missing mcp__${server}__*`,
+        );
+      }
+    });
+
+    // A tiny matcher using the SAME prefix semantics Claude Code documents for an MCP deny rule
+    // ending in `__*`: "MCP server-level specs (mcp__server, mcp__server__*, mcp__*) remove every
+    // tool from the named server" — i.e. the rule matches any tool name sharing the prefix up to
+    // and including that trailing `*`.
+    const matchesMcpDenyRule = (rule: string, toolName: string): boolean =>
+      rule.endsWith('*') ? toolName.startsWith(rule.slice(0, -1)) : rule === toolName;
+
+    it('the shipped Gmail rule denies a real Gmail tool name by prefix', () => {
+      const deny = settings.permissions?.deny ?? [];
+      const gmailRule = deny.find((rule) => rule.startsWith('mcp__claude_ai_Gmail'));
+      assert.ok(gmailRule, 'frontier deny list carries no rule for claude_ai_Gmail');
+      assert.ok(matchesMcpDenyRule(gmailRule!, 'mcp__claude_ai_Gmail__send_message'));
+    });
+
+    it('a connector rule does not accidentally deny an unrelated server sharing its prefix', () => {
+      const deny = settings.permissions?.deny ?? [];
+      const gmailRule = deny.find((rule) => rule.startsWith('mcp__claude_ai_Gmail'))!;
+      assert.ok(!matchesMcpDenyRule(gmailRule, 'mcp__backlog__task_view'));
+    });
+  });
+
+  // M1: the parity check used to compare only the push/`gh` rules, so the frontier lane could (and
+  // did) omit every path rule the local lane carries and still pass. It compares the FULL lists
+  // now, minus one explicit allowance set — a frontier task may legitimately edit a skill or the
+  // tooling, which is the whole reason it runs on the wider lane. `SLOT_EXECUTED_PATHS` still refuses
+  // `.claude/settings.json` against the real diff either way; `scripts/backlog/` is SOFT now (T-31)
+  // — admitted, marking the pull request for human review rather than refused.
+  // N1 narrowed what the allowance MEANS: these are the local rules the frontier lane replaces with
+  // narrower ones, never rules it simply drops. A skill under `.claude/skills/` and a tool under
+  // `scripts/` stay editable; the executable corners do not — see `FRONTIER_NARROWED_DENIALS`.
+  //
+  // P1 (round 9) re-examined the `scripts/**` half and kept it: a frontier task may legitimately
+  // edit the tooling, and nothing the WORKER is granted executes `scripts/**` — the allow list holds
+  // no `node`, `tsx`, `npx`, `pnpm test:` or bare `pnpm run` rule (see `WRITABLE_TREE_RUNNERS`). The
+  // pair is a permission to EDIT a script, never to run one.
+  //
+  // That bounds the WORKER's own session and nothing more. The CLOSE does run code from the slot's
+  // `scripts/**`: its triad spawns the task's declared `Test command:` with `cwd` = the slot, and
+  // `ALLOWED_TEST_SCRIPT` admits `test:backlog`, which the root manifest maps to a runner over
+  // `scripts/backlog/**` — the slot's copies. Nothing at the settings layer denies THAT subtree
+  // either, but the DECISION is refused, not just marked: `scripts/backlog/` is supervised-only
+  // (guard 1e, `SUPERVISED_ONLY_PATHS`) — a task that declares it never reaches a slot, and one that
+  // only discovers the need mid-attempt spends its slot for nothing, since `close.ts`'s `checkScope`
+  // refuses the real diff outright, on both lanes. The edit permission stays broad because ordinary
+  // `scripts/**` work (outside `scripts/backlog/`) is unremarkable product tooling the close simply
+  // admits, and a failed attempt's tree is pushed to `task/<id>` and restored by the retry either
+  // way, so a write there — refused or ordinary — outlives the attempt regardless. Measured in
+  // design.md decision 1.
+  const FRONTIER_ONLY_ALLOWANCES: readonly string[] = [
+    'Edit(.claude/**)',
+    'Write(.claude/**)',
+    'Edit(scripts/**)',
+    'Write(scripts/**)',
+  ];
+
+  /**
+   * The narrower rules the frontier lane carries INSTEAD of the local lane's blanket `.claude/**`
+   * deny. The project `PostToolUse` hook runs
+   * `$CLAUDE_PROJECT_DIR/.claude/hooks/format-with-prettier.ts` after every Write/Edit and
+   * `CLAUDE_PROJECT_DIR` is the SLOT, so a hook the worker writes there executes as the worker on
+   * its very next edit; `.claude/scripts/` runs the same way from `SessionStart`; and `CLAUDE.md` is
+   * the instruction file the next reader — the next worker on this slot included — treats as law.
+   */
+  // P1 (round 9) added `.claude/settings.local.json` and the two other CASINGS of `CLAUDE.md`. The
+  // overlay file is the same surface as `.claude/settings.json` — hooks and permissions — and it is
+  // the one Claude Code reads LAST, so a rule written there outranks the one it overlays; the
+  // casings matter because macOS is case-insensitive, so `claude.md` and `CLAUDE.md` are the same
+  // file on disk while a permission glob compares the spelling it was given.
+  //
+  // R1 (round 10) added `.claude/settings.json` itself. The lane's own narrowed denials covered the
+  // overlay next to it but not the file it overlays, so the only barrier in front of the permission
+  // file this launch READS to compose its deny list was the close's `SLOT_EXECUTED_PATHS` — which
+  // reviews the diff after the attempt, not before the next tool call.
+  const FRONTIER_NARROWED_DENIALS: readonly string[] = [
+    'Edit(.claude/settings.json)',
+    'Write(.claude/settings.json)',
+    'Edit(.claude/hooks/**)',
+    'Write(.claude/hooks/**)',
+    'Edit(.claude/scripts/**)',
+    'Write(.claude/scripts/**)',
+    'Edit(.claude/settings.local.json)',
+    'Write(.claude/settings.local.json)',
+    'Edit(CLAUDE.md)',
+    'Write(CLAUDE.md)',
+    'Edit(**/CLAUDE.md)',
+    'Write(**/CLAUDE.md)',
+    'Edit(Claude.md)',
+    'Write(Claude.md)',
+    'Edit(**/Claude.md)',
+    'Write(**/Claude.md)',
+    'Edit(claude.md)',
+    'Write(claude.md)',
+    'Edit(**/claude.md)',
+    'Write(**/claude.md)',
+  ];
+
+  it('denies the executable corners of .claude/ and every CLAUDE.md, in every path spelling', () => {
+    const deny = settings.permissions?.deny ?? [];
+    for (const rule of FRONTIER_NARROWED_DENIALS) {
+      assert.ok(deny.includes(rule), `frontier deny list is missing ${rule}`);
+    }
+  });
+
+  // The allow list no longer contains any of these (P1: it is explicit, and none of them survived
+  // review — see `WRITABLE_TREE_RUNNERS`), so these rules are not the mechanism that stops them.
+  // They stay because a deny rule outranks any allow rule from any source: whatever else the
+  // harness loads into this worker's session — the project settings' own allowlist, a hook that
+  // answers `permissionDecision: "allow"` — cannot grant one of these back.
+  it('denies the staging, committing, branch-moving and discarding git verbs, in both spellings', () => {
+    const deny = settings.permissions?.deny ?? [];
+    for (const verb of ['git add', 'git commit', 'git restore', 'git branch', 'git clean']) {
+      assert.ok(deny.includes(`Bash(${verb}:*)`), `frontier deny list is missing Bash(${verb}:*)`);
+      assert.ok(deny.includes(`Bash(${verb}*)`), `frontier deny list is missing Bash(${verb}*)`);
+    }
+  });
+
+  // `find` reaches `-exec`, and both it and `fd` reach `--exec`/`-x`: a file finder that runs a
+  // command is a shell, and the slot is full of files this worker wrote.
+  it('denies the file finders that can execute what they find, in both spellings', () => {
+    const deny = settings.permissions?.deny ?? [];
+    for (const finder of ['find', 'fd']) {
+      assert.ok(
+        deny.includes(`Bash(${finder}:*)`),
+        `frontier deny list is missing Bash(${finder}:*)`,
+      );
+      assert.ok(
+        deny.includes(`Bash(${finder} *)`),
+        `frontier deny list is missing Bash(${finder} *)`,
+      );
+    }
+  });
+
+  // The DENY parity check survives P1 intact: the two allow lists are now unrelated (the frontier
+  // one is explicit, the local one always was), but the deny lists still describe the same repo, so
+  // the wider lane must not be guarded LESS by omission.
+  it('denies everything the local lane denies, minus a documented allowance set', () => {
+    const localDeny = (
+      JSON.parse(
+        fs.readFileSync(path.join(import.meta.dirname, 'lanes', 'local.settings.json'), 'utf8'),
+      ) as {
+        permissions: { deny: string[] };
+      }
+    ).permissions.deny;
+    const frontierDeny = settings.permissions?.deny ?? [];
+    for (const rule of localDeny.filter((entry) => !FRONTIER_ONLY_ALLOWANCES.includes(entry))) {
+      assert.ok(
+        frontierDeny.includes(rule),
+        `frontier deny list is missing the local-lane rule ${rule}`,
+      );
+    }
+  });
+
+  // The pairs that protect the DISPATCHER itself, spelled out so the allowance set above can never
+  // quietly grow to include one of them.
+  it('denies writes to the dispatcher own environment: git, husky, the tree and the manifests', () => {
+    const deny = settings.permissions?.deny ?? [];
+    for (const target of [
+      '.git/**',
+      '.husky/**',
+      'node_modules/**',
+      'package.json',
+      'pnpm-lock.yaml',
+    ]) {
+      assert.ok(deny.includes(`Edit(${target})`), `missing Edit(${target})`);
+      assert.ok(deny.includes(`Write(${target})`), `missing Write(${target})`);
+    }
+  });
+});
+
+// ── The settings sources the frontier worker ALSO loads ──────────────────────────
+//
+// Q1: the frontier launch passes `--setting-sources user,project`, on purpose — that worker runs the
+// full harness and needs what those two files carry (the project hooks, the user file's MCP setup).
+// The click-approval overlay is NOT among them: `.claude/settings.local.json` is where a person's
+// ad-hoc "yes, allow that" answers pile up, and a worktree reads the MAIN checkout's copy since
+// Claude Code 2.1.211. The cost of the two that DO load is that `--allowedTools` ADDS to what they
+// grant rather than replacing it: the lane's explicit allow list bounds only what the LAUNCH grants.
+// A deny rule is the only thing that removes an allow from another source, so the launch composes
+// one deny per rule those two sources contribute and the lane does not grant.
+
+describe('loadSettingsAllowRules', () => {
+  const writeSettings = (contents: string, name = 'settings.json'): string => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'backlog-settings-'));
+    const file = path.join(dir, name);
+    fs.writeFileSync(file, contents);
+    return file;
+  };
+  /** One PROJECT-file source holding these rules — the default in tests that are not about sources. */
+  const withAllow = (...rules: string[]): SettingsSource => ({
+    source: 'project',
+    path: writeSettings(JSON.stringify({ permissions: { allow: rules } })),
+  });
+  const rulesOf = (sources: readonly SettingsSource[]): string[] =>
+    loadSettingsAllowRules(sources).map((entry) => entry.rule);
+
+  // R11: a path glob is resolved relative to the file that declares it, so `Edit(**)` in the USER
+  // file is the home directory and the same rule in the project file is the checkout. Guard 1b needs
+  // to tell those apart — the lane's slot-scoped `Edit(./**)` covers only the second.
+  it('tags each rule with the source file it came from', () => {
+    const user: SettingsSource = { source: 'user', path: withAllow('Bash(brew install *)').path };
+    assert.deepEqual(loadSettingsAllowRules([user, withAllow('Bash(eslint:*)')]), [
+      { rule: 'Bash(brew install *)', source: 'user' },
+      { rule: 'Bash(eslint:*)', source: 'project' },
+    ]);
+  });
+
+  // Kept as the FIRST source's rule: the user file loads first, and a home-relative reading of a
+  // rule is the stricter of the two — the one guard 1b must not lose.
+  it('keeps a rule two sources both declare exactly once, tagged with the first of them', () => {
+    const user: SettingsSource = { source: 'user', path: withAllow('Bash(fd:*)').path };
+    assert.deepEqual(loadSettingsAllowRules([user, withAllow('Bash(fd:*)')]), [
+      { rule: 'Bash(fd:*)', source: 'user' },
+    ]);
+  });
+
+  it('reads permissions.allow out of a settings file', () => {
+    assert.deepEqual(rulesOf([withAllow('Bash(fd:*)', 'Bash(git status:*)')]), [
+      'Bash(fd:*)',
+      'Bash(git status:*)',
+    ]);
+  });
+
+  // The two sources this lane loads, in the order Claude Code reads them.
+  it('unions the sources in load order: user file, then project file', () => {
+    const rules = rulesOf([withAllow('Bash(brew install *)'), withAllow('Bash(eslint:*)')]);
+    assert.deepEqual(rules, ['Bash(brew install *)', 'Bash(eslint:*)']);
+  });
+
+  it('normalises the whitespace inside a rule, so the comparison is not defeated by a double space', () => {
+    assert.deepEqual(rulesOf([withAllow('  Bash(git  status:*) ')]), ['Bash(git status:*)']);
+  });
+
+  it('skips a source that does not exist: the harness loads nothing from it either', () => {
+    const absent: SettingsSource = {
+      source: 'user',
+      path: path.join(os.tmpdir(), 'backlog-no-such-settings.json'),
+    };
+    assert.deepEqual(rulesOf([absent, withAllow('Bash(fd:*)')]), ['Bash(fd:*)']);
+  });
+
+  it('is an empty list when a source declares no permissions at all', () => {
+    assert.deepEqual(
+      loadSettingsAllowRules([
+        { source: 'project', path: writeSettings(JSON.stringify({ hooks: {} })) },
+      ]),
+      [],
+    );
+  });
+
+  // Silence here would grant the worker whatever the file holds: unreadable is not "empty".
+  it('throws on a settings file it cannot parse rather than assuming it grants nothing', () => {
+    assert.throws(
+      () => loadSettingsAllowRules([{ source: 'project', path: writeSettings('{ not json') }]),
+      /settings\.json/,
+    );
+  });
+
+  it('throws when permissions.allow is not a list of strings', () => {
+    assert.throws(() => loadSettingsAllowRules([withAllow(...([1, 2] as unknown as string[]))]));
+  });
+});
+
+describe('settingsSourcePaths', () => {
+  it('names the user file and the project file for the FRONTIER lane, in load order, tagged with which is which', () => {
+    assert.deepEqual(settingsSourcePaths(LANE.FRONTIER, '/repo', '/home/carlos'), [
+      { source: 'user', path: '/home/carlos/.claude/settings.json' },
+      { source: 'project', path: '/repo/.claude/settings.json' },
+    ]);
+  });
+
+  // The local lane passes `--setting-sources user`, so the project file is not loaded into it — and
+  // a file that is not loaded must not be subtracted either: denying a rule nobody granted can only
+  // cancel one the lane grants (the project's `Bash(pnpm --filter * test)` over this lane's
+  // per-task test grant).
+  it('names ONLY the user file for the LOCAL lane, matching the one source it passes', () => {
+    assert.deepEqual(settingsSourcePaths(LANE.LOCAL, '/repo', '/home/carlos'), [
+      { source: 'user', path: '/home/carlos/.claude/settings.json' },
+    ]);
+  });
+
+  // The flag value and the subtraction must describe the same set of files, so both are derived
+  // from ONE map instead of being kept in step by hand.
+  it('derives its files from the very --setting-sources value each lane passes', () => {
+    for (const lane of [LANE.LOCAL, LANE.FRONTIER]) {
+      assert.deepEqual(
+        settingsSourcePaths(lane, '/repo', '/home/carlos').map((source) => source.source),
+        settingSourcesFlag(lane).split(','),
+      );
+    }
+  });
+
+  // Neither lane loads the overlay: it is the click-approval file (`Bash(git *)`, `Bash(pnpm *)`,
+  // `Bash(python3 -c *)` on the machine this was measured on), and since Claude Code 2.1.211 a
+  // worktree reads the MAIN checkout's copy, so a slot would inherit it whole.
+  it('leaves the local overlay out entirely on BOTH lanes: it is neither loaded nor subtracted', () => {
+    for (const lane of [LANE.LOCAL, LANE.FRONTIER]) {
+      for (const { path: file } of settingsSourcePaths(lane, '/repo', '/home/carlos')) {
+        assert.ok(!file.includes('settings.local.json'), `${file} is the click-approval overlay`);
+      }
+    }
+  });
+});
+
+// The point of unioning the sources: a rule that reaches this worker from the USER file is denied
+// like any other, and a rule that lives only in the overlay reaches neither the worker nor the deny
+// list, because the launch does not load that file.
+describe('loadSettingsAllowRules feeding settingsAllowRulesToDeny', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'backlog-settings-sources-'));
+  const write = (source: 'user' | 'project', name: string, rules: string[]): SettingsSource => {
+    const file = path.join(dir, name);
+    fs.writeFileSync(file, JSON.stringify({ permissions: { allow: rules } }));
+    return { source, path: file };
+  };
+  const checkout = fs.mkdtempSync(path.join(os.tmpdir(), 'backlog-checkout-'));
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'backlog-home-'));
+
+  it('denies a user-file rule and skips a project rule the lane already grants', () => {
+    const sources = [
+      write('user', 'user.json', ['Bash(brew install *)']),
+      write('project', 'project.json', ['Bash(git status:*)']),
+    ];
+
+    const deny = settingsAllowRulesToDeny(loadSettingsAllowRules(sources), [
+      'Read',
+      'Edit(./**)',
+      'Bash(git status:*)',
+    ]);
+
+    assert.deepEqual(deny, ['Bash(brew install *)']);
+  });
+
+  // The whole reason the overlay is excluded: its wildcard click-approvals are BROADER than the
+  // lane's own rules, so subtracting them could only either revoke a reviewed grant or refuse the
+  // launch. Not loading the file removes the dilemma — nothing from it is granted or denied.
+  it('never sees a rule that lives only in the local overlay', () => {
+    for (const dir_ of [path.join(checkout, '.claude'), path.join(home, '.claude')]) {
+      fs.mkdirSync(dir_, { recursive: true });
+    }
+    fs.writeFileSync(
+      path.join(checkout, '.claude', 'settings.json'),
+      JSON.stringify({ permissions: { allow: ['Bash(eslint:*)'] } }),
+    );
+    fs.writeFileSync(
+      path.join(checkout, '.claude', 'settings.local.json'),
+      JSON.stringify({ permissions: { allow: ['Bash(git *)', 'Bash(pnpm *)'] } }),
+    );
+    fs.writeFileSync(
+      path.join(home, '.claude', 'settings.json'),
+      JSON.stringify({ permissions: { allow: [] } }),
+    );
+
+    const loaded = loadSettingsAllowRules(settingsSourcePaths(LANE.FRONTIER, checkout, home));
+
+    assert.deepEqual(loaded, [{ rule: 'Bash(eslint:*)', source: 'project' }]);
+    // And with it out, the broader-than-granted refusal those two wildcards would have triggered
+    // against `Bash(git status:*)` / `Bash(pnpm --filter * test)` cannot fire.
+    assert.doesNotThrow(() =>
+      settingsAllowRulesToDeny(loaded, [
+        'Read',
+        'Edit(./**)',
+        'Bash(git status:*)',
+        'Bash(pnpm --filter * test)',
+      ]),
+    );
+  });
+});
+
+describe('settingsAllowRulesToDeny', () => {
+  it('denies a project rule the granted list does not carry, and leaves the granted one alone', () => {
+    const deny = settingsAllowRulesToDeny(projectRules('Bash(fd:*)', 'Bash(git status:*)'), [
+      'Bash(git status:*)',
+    ]);
+    assert.deepEqual(deny, ['Bash(fd:*)']);
+  });
+
+  it('compares after whitespace normalisation, so a re-spaced rule is not denied back', () => {
+    assert.deepEqual(
+      settingsAllowRulesToDeny(projectRules('Bash(git  status:*)'), ['Bash(git status:*)']),
+      [],
+    );
+  });
+
+  // A deny is coarse: `Bash(openspec status:*)` would cancel the lane's own `Bash(openspec:*)`,
+  // because a deny outranks EVERY allow. A project rule the lane already grants more broadly is
+  // therefore skipped — it grants nothing the lane has not granted anyway.
+  it('skips a project rule the granted list already covers more broadly', () => {
+    const granted = ['Bash(openspec:*)', 'Bash(catalyst:*)'];
+    const project = projectRules(
+      'Bash(openspec status:*)',
+      'Bash(openspec validate:*)',
+      'Bash(catalyst origin list:*)',
+    );
+    assert.deepEqual(settingsAllowRulesToDeny(project, granted), []);
+  });
+
+  // T-7: the granted rule is the exact-form half of the shipped pair — its base has no trailing
+  // `:*`, so it is not `isDeadBashRule`, and it still covers the project's per-package rule.
+  it('reads the wildcard inside a granted rule when deciding coverage', () => {
+    assert.deepEqual(
+      settingsAllowRulesToDeny(projectRules('Bash(pnpm --filter aurora-back test:*)'), [
+        'Bash(pnpm --filter * test)',
+      ]),
+      [],
+    );
+  });
+
+  it('denies a project rule that only looks similar to a granted one', () => {
+    const deny = settingsAllowRulesToDeny(projectRules('Bash(pnpm exec prettier --check:*)'), [
+      'Bash(pnpm --filter * exec prettier --check)',
+    ]);
+    assert.deepEqual(deny, ['Bash(pnpm exec prettier --check:*)']);
+  });
+
+  it('denies a bare tool rule the granted list does not name', () => {
+    const deny = settingsAllowRulesToDeny(projectRules('mcp__claude-in-chrome__tabs_context_mcp'), [
+      'mcp__backlog__task_view',
+    ]);
+    assert.deepEqual(deny, ['mcp__claude-in-chrome__tabs_context_mcp']);
+  });
+
+  // The unseparable case: denying the BROADER project rule would revoke the narrower rule the
+  // launch just granted — typically the per-task test rule (`pnpm test:hooks x` under the project's
+  // `Bash(pnpm test:hooks:*)`). Neither answer is safe to pick unattended, so the task is blocked
+  // with the pair named — by guard 1b (`guards.ts`'s `checkPermissionComposition`), before a slot is
+  // taken. This throw is the invariant BEHIND that guard, for a caller that composed a launch
+  // without evaluating it; the verdict itself comes from the same `findPermissionConflict`.
+  it('refuses to compose a deny that would revoke a rule the launch grants', () => {
+    assert.throws(
+      () =>
+        settingsAllowRulesToDeny(projectRules('Bash(pnpm test:hooks:*)'), [
+          'Bash(pnpm test:hooks scripts/x.test.ts:*)',
+        ]),
+      /Bash\(pnpm test:hooks:\*\)/,
+    );
+  });
+
+  it('returns each rule once even when the project list repeats it', () => {
+    assert.deepEqual(settingsAllowRulesToDeny(projectRules('Bash(fd:*)', 'Bash(fd:*)'), []), [
+      'Bash(fd:*)',
+    ]);
+  });
+});
+
+// bf7faed9c added `Bash(node packages/cli/bin/run.js:*)` and `Bash(pnpm cli:build:*)` to
+// `.claude/settings.json` ALONE, meaning to let a dispatched worker build and run the generator. It
+// did the opposite: `settingsAllowRulesToDeny` reads a project settings file as the surface to
+// SUBTRACT, never to grant, so a rule that exists only there becomes an EXPLICIT deny for every
+// worker. The fix grants both rules directly in `frontier.settings.json`, so they are covered
+// rather than subtracted. A third rule, `Bash(pnpm --dir packages/cli install:*)`, was proposed and
+// then dropped (round 3, S1) — see the `GENERATOR_RULES` comment below.
+//
+// FRONTIER ONLY. The local lane was considered and refused: `lane:local` accepts `tier:minor`
+// only, and the Task-Weight Triage's own definition of Minor is "NO catalyst CLI run" — a task
+// dispatched on `lane:local` therefore never legitimately needs the generator, while granting it
+// there would have reintroduced a standing `pnpm` rule the local lane deliberately carries none of
+// (H8, `launch.test.ts`'s `grants no standing pnpm rule` test).
+describe('the generator build/run rules reach the frontier lane (T-48)', () => {
+  const projectAllow = loadSettingsAllowRules([
+    {
+      source: 'project',
+      path: path.join(import.meta.dirname, '..', '..', '.claude', 'settings.json'),
+    },
+  ]);
+  // `Bash(pnpm --dir packages/cli install:*)` was dropped (round 3, S1): its `:*` suffix admits a
+  // second `--dir` after the first, and pnpm keeps the LAST one, so the rule granted `pnpm install`
+  // at ANY path, not just `packages/cli`.
+  const GENERATOR_RULES = ['Bash(pnpm cli:build:*)', 'Bash(node packages/cli/bin/run.js:*)'];
+
+  it('grants and never denies the generator rules on the frontier lane', () => {
+    const settings = JSON.parse(
+      fs.readFileSync(path.join(import.meta.dirname, 'lanes', 'frontier.settings.json'), 'utf8'),
+    ) as { permissions?: { allow?: string[] } };
+    const laneAllow = settings.permissions?.allow ?? [];
+    const composed = settingsAllowRulesToDeny(projectAllow, laneAllow);
+    for (const rule of GENERATOR_RULES) {
+      assert.ok(laneAllow.includes(rule), `frontier lane must grant ${rule}`);
+      assert.ok(!composed.includes(rule), `frontier lane composition must not deny ${rule}`);
+    }
+  });
+});
+
+describe('the shipped .claude/settings.json against the shipped frontier lane file', () => {
+  // The repo's own file only. The other source this lane loads (the USER file — the overlay is not a
+  // source at all) is machine-local, so an assertion over it would test the machine, not the repo —
+  // its subtraction is covered by the source-union tests above.
+  const projectAllow = loadSettingsAllowRules([
+    {
+      source: 'project',
+      path: path.join(import.meta.dirname, '..', '..', '.claude', 'settings.json'),
+    },
+  ]);
+  const projectAllowRules = projectAllow.map((entry) => entry.rule);
+  const frontier = JSON.parse(
+    fs.readFileSync(path.join(import.meta.dirname, 'lanes', 'frontier.settings.json'), 'utf8'),
+  ) as { permissions?: { allow?: string[]; deny?: string[] } };
+  const frontierAllow = frontier.permissions?.allow ?? [];
+  const effectiveDeny = [
+    ...(frontier.permissions?.deny ?? []),
+    ...settingsAllowRulesToDeny(projectAllow, frontierAllow),
+  ];
+
+  // The exact rules the finding named: a finder that reaches `--exec`, a git verb that discards
+  // work, and three runners that execute a file out of a tree this worker can write to.
+  it('denies every project rule that runs, finds or discards — none of them reaches the worker', () => {
+    const dangerous = projectAllowRules.filter((rule) =>
+      ['Bash(pnpm test:', 'Bash(fd', 'Bash(git restore', 'Bash(eslint', 'Bash(npm '].some(
+        (prefix) => rule.startsWith(prefix),
+      ),
+    );
+    assert.ok(
+      dangerous.length > 0,
+      'the project allow list no longer carries the rules this test exists for',
+    );
+    for (const rule of dangerous) {
+      assert.ok(effectiveDeny.includes(rule), `the frontier launch would inherit ${rule}`);
+    }
+  });
+
+  // The whole subtraction over the two shipped files, as a list rather than as a property: these 14
+  // rules are the ONLY ones the lane already grants (five read-only git verbs it names identically,
+  // the four `openspec` and two `catalyst origin` rules its own `Bash(openspec:*)`/`Bash(catalyst:*)`
+  // cover, the two generator build/run rules `frontier.settings.json` now grants directly (T-48;
+  // the third, `install`, was dropped — round 3, S1), and `pnpm --filter aurora-back test` under
+  // `Bash(pnpm --filter * test)`). Every other project rule is denied. Add a rule to either file and
+  // this list is what tells you which side it landed on — and a rule added to `.claude/settings.json`
+  // ALONE lands on the denied side, since the subtraction reads that file as the surface to take
+  // away, never as one to grant.
+  it('leaves granted exactly the project rules the lane covers, and denies the other 30', () => {
+    const composed = settingsAllowRulesToDeny(projectAllow, frontierAllow);
+    assert.deepEqual(
+      projectAllowRules.filter((rule) => !composed.includes(rule)),
+      [
+        'Bash(git log:*)',
+        'Bash(git diff:*)',
+        'Bash(git status:*)',
+        'Bash(git rev-parse:*)',
+        'Bash(git symbolic-ref:*)',
+        'Bash(openspec status:*)',
+        'Bash(openspec validate:*)',
+        'Bash(openspec list:*)',
+        'Bash(openspec instructions:*)',
+        'Bash(catalyst origin list:*)',
+        'Bash(catalyst origin diff:*)',
+        'Bash(node packages/cli/bin/run.js:*)',
+        'Bash(pnpm cli:build:*)',
+        'Bash(pnpm --filter aurora-back test:*)',
+      ],
+    );
+    assert.equal(composed.length, 30);
+    for (const rule of composed) {
+      assert.ok(!frontierAllow.includes(rule), `${rule} is both granted and denied`);
+    }
+  });
+});
+
+// The surface a frontier launch grants is composed TWICE — once by guard 1b, to compare it against
+// the loaded settings list, and once by `buildLaunch`, to write it into `--allowedTools`. Two
+// spellings of the same list is a way for the guard to approve one surface and the launch to grant
+// another, so there is one function and both callers read it.
+describe('composeGrantedAllow', () => {
+  const laneAllow = ['Read', 'Edit(./**)', 'Bash(openspec:*)'];
+
+  it('is the lane list plus the per-task wrapper and test grants, deduped', () => {
+    const task = baseTask({ id: 'T-7', testCommand: 'pnpm --filter aurora-back test' });
+
+    assert.deepEqual(composeGrantedAllow(task, laneAllow, '/repo'), [
+      ...laneAllow,
+      ...backlogRulesForTask('T-7', '/repo'),
+      ...testCommandRuleForTask('pnpm --filter aurora-back test'),
+    ]);
+  });
+
+  it('is what buildLaunch writes into --allowedTools', () => {
+    const task = baseTask({
+      lane: LANE.FRONTIER,
+      path: EXECUTION_PATH.DIRECT,
+      testCommand: 'pnpm --filter aurora-back test',
+    });
+    const launch = buildLaunch({
+      task,
+      lane: 'frontier',
+      settingsAllow: [],
+      workerSystemPromptPath: '/Users/carlos/Projects/aurora/aurora-catalyst/.backlog/.dispatch/T-1/intento-1/frontier-addendum.md',
+      slot: { ...slot, lane: LANE.FRONTIER },
+      attempt: 1,
+      prompt: 'trabajemos T-1',
+      laneProfile: {
+        settings: 'scripts/backlog/lanes/frontier.settings.json',
+        maxParallel: 2,
+        model: { direct: 'sonnet', sdd: 'opus' },
+        maxTurns: 120,
+        maxBudgetUsd: 5,
+        timeoutMinutes: 90,
+      },
+      settings: { permissions: { allow: laneAllow, deny: [] } },
+      mainCheckoutPath: '/repo',
+      model: 'sonnet',
+    });
+
+    assert.equal(
+      launch.args[launch.args.indexOf('--allowedTools') + 1],
+      composeGrantedAllow(task, laneAllow, '/repo').join(' '),
+    );
+  });
+});
+
+describe('backlogRulesForTask', () => {
+  // K1: a permission rule matches a PREFIX and cannot narrow what follows it, so
+  // `Bash(backlog task edit T-12 --notes:*)` admitted `--notes x --status Done` — the per-flag
+  // grant was only as narrow as it looked. Neither the raw write nor the raw READ is granted any
+  // more: `Bash(backlog task view T-12:*)` is a prefix too, so a command line starting with those
+  // words matched whatever followed. ONE command, whose whole argv the wrapper validates.
+  it('grants exactly one command — the wrapper, which reads with --view too', () => {
+    assert.deepEqual(backlogRulesForTask('T-12', '/repo'), [
+      'Bash(npx --loglevel=error tsx /repo/scripts/backlog/worker-edit.ts T-12:*)',
+    ]);
+  });
+
+  // The granted wrapper is the MAIN checkout's copy: the slot's `scripts/` is a directory the
+  // worker could write to if a deny rule ever failed to match, and a barrier the thing under test
+  // can edit is not a barrier.
+  it('points the granted wrapper at the main checkout, never at the slot', () => {
+    const rules = backlogRulesForTask('T-12', '/Users/carlos/Projects/aurora/aurora-catalyst');
+    assert.ok(
+      rules.some((rule) =>
+        rule.includes(
+          '/Users/carlos/Projects/aurora/aurora-catalyst/scripts/backlog/worker-edit.ts',
+        ),
+      ),
+    );
+  });
+
+  it('grants no rule that would let the worker re-status itself or rewrite its own criteria', () => {
+    const granted = backlogRulesForTask('T-12', '/repo').join(' ');
+    for (const flag of [
+      '--status',
+      '-s ',
+      '--ac',
+      '--acceptance-criteria',
+      '--title',
+      '--desc',
+      '--dod',
+    ]) {
+      assert.ok(
+        !granted.includes(flag),
+        `${flag} must not be reachable through the per-task grant`,
+      );
+    }
+    assert.ok(
+      !granted.includes('backlog task edit'),
+      'the raw board write must not be granted at all',
+    );
+  });
+});
+
+// ── buildLaunch ────────────────────────────────────────────────────────────────
+
+describe('buildLaunch', () => {
+  const localProfile: LocalLaneProfile = {
+    settings: 'scripts/backlog/lanes/local.settings.json',
+    maxParallel: 1,
+    effort: 'medium',
+    maxTurns: 40,
+    timeoutMinutes: 30,
+    healthCheckUrl: 'http://localhost:1234',
+    reviewerModel: 'sonnet',
+    reviewerTimeoutMinutes: 15,
+  };
+  const localSettings = {
+    model: 'qwen/qwen3.8-27b',
+    env: { ANTHROPIC_BASE_URL: 'http://localhost:1234', ANTHROPIC_AUTH_TOKEN: 'lmstudio' },
+    permissions: {
+      allow: ['Read', 'Grep', 'Glob', 'Edit(./**)', 'Write(./**)'],
+      deny: ['WebFetch'],
+    },
+  };
+
+  // T-31 round 4: the flag's value was resolved absolutely by ONE of its two producers and asserted
+  // nowhere at the point of use — replacing `resolveWorkerSystemPromptPath(repoRoot)` with the bare
+  // relative constant at its only real call site left the whole suite green, and fifteen doubles in
+  // this file passed the relative literal, so the argv layer was exercised exclusively with the value
+  // the fix exists to eliminate. `cwd` is the SLOT, so a relative path makes the attempt the author of
+  // its own worker brief — a channel `--bare` does not close, because the flag is explicit.
+  it('refuses a RELATIVE worker system prompt on the local lane: cwd is the slot', () => {
+    assert.throws(
+      () =>
+        buildLaunch({
+          task: baseTask(),
+          lane: 'local',
+          settingsAllow: [],
+          slot,
+          attempt: 1,
+          prompt: 'assembled prompt text',
+          laneProfile: localProfile,
+          settings: localSettings,
+          mainCheckoutPath: '/Users/carlos/Projects/aurora/aurora-catalyst',
+          workerSystemPromptPath: '.claude/skills/catalyst-backlog/worker-system-prompt.md',
+        }),
+      /absolute/i,
+    );
+  });
+
+  it('emits an ABSOLUTE --append-system-prompt-file, never a slot-relative one', () => {
+    const launch = buildLaunch({
+      task: baseTask(),
+      lane: 'local',
+      settingsAllow: [],
+      slot,
+      attempt: 1,
+      prompt: 'assembled prompt text',
+      laneProfile: localProfile,
+      settings: localSettings,
+      mainCheckoutPath: '/Users/carlos/Projects/aurora/aurora-catalyst',
+      workerSystemPromptPath:
+        '/Users/carlos/Projects/aurora/aurora-catalyst/.claude/skills/catalyst-backlog/worker-system-prompt.md',
+    });
+
+    const value = launch.args[launch.args.indexOf('--append-system-prompt-file') + 1];
+    assert.ok(path.isAbsolute(value), `the flag's value must be absolute; got ${value}`);
+    assert.ok(!value.startsWith(slot.path), 'and must not resolve inside the slot');
+  });
+
+  it('builds the exact local-lane command, in the design-mandated flag order', () => {
+    const launch = buildLaunch({
+      task: baseTask(),
+      lane: 'local',
+      settingsAllow: [],
+      slot,
+      attempt: 1,
+      prompt: 'assembled prompt text',
+      laneProfile: localProfile,
+      settings: localSettings,
+      mainCheckoutPath: '/Users/carlos/Projects/aurora/aurora-catalyst',
+      workerSystemPromptPath: '/Users/carlos/Projects/aurora/aurora-catalyst/.claude/skills/catalyst-backlog/worker-system-prompt.md',
+    });
+
+    assert.equal(launch.command, 'claude');
+    assert.deepEqual(launch.args, [
+      '-p',
+      'assembled prompt text',
+      '--bare',
+      '--strict-mcp-config',
+      '--setting-sources',
+      'user',
+      '--disable-slash-commands',
+      '--append-system-prompt-file',
+      '/Users/carlos/Projects/aurora/aurora-catalyst/.claude/skills/catalyst-backlog/worker-system-prompt.md',
+      '--permission-mode',
+      'dontAsk',
+      '--allowedTools',
+      'Read Grep Glob Edit(./**) Write(./**) Bash(npx --loglevel=error tsx /Users/carlos/Projects/aurora/aurora-catalyst/scripts/backlog/worker-edit.ts T-1:*)',
+      '--disallowedTools',
+      'WebFetch',
+      '--effort',
+      'medium',
+      '--max-turns',
+      '40',
+      '--output-format',
+      'stream-json',
+      '--verbose',
+      '--model',
+      'qwen/qwen3.8-27b',
+    ]);
+    assert.equal(launch.cwd, slot.path);
+    assert.equal(launch.timeoutMs, 30 * 60_000);
+    assert.deepEqual(launch.env, {
+      BACKLOG_DISPATCH_ACTIVE: '1',
+      BACKLOG_CWD: '/Users/carlos/Projects/aurora/aurora-catalyst',
+      BACKLOG_TASK_ID: 'T-1',
+      CLAUDE_PROJECT_DIR: slot.path,
+      ANTHROPIC_BASE_URL: 'http://localhost:1234',
+      ANTHROPIC_AUTH_TOKEN: 'lmstudio',
+      CLAUDE_CODE_DISABLE_BACKGROUND_TASKS: '1',
+    });
+  });
+
+  // See HEADLESS_FORCED_ENV's own JSDoc in launch.ts for why this is forced.
+  it('wins over a lane env that tries to turn it back off on the local lane', () => {
+    const launch = buildLaunch({
+      task: baseTask(),
+      lane: 'local',
+      settingsAllow: [],
+      slot,
+      attempt: 1,
+      prompt: 'p',
+      laneProfile: localProfile,
+      settings: {
+        ...localSettings,
+        env: { ...localSettings.env, CLAUDE_CODE_DISABLE_BACKGROUND_TASKS: '0' },
+      },
+      mainCheckoutPath: '/repo',
+      workerSystemPromptPath:
+        '/Users/carlos/Projects/aurora/aurora-catalyst/.claude/skills/catalyst-backlog/worker-system-prompt.md',
+    });
+
+    assert.equal(launch.env.CLAUDE_CODE_DISABLE_BACKGROUND_TASKS, '1');
+  });
+
+  // T-61: `qwen/qwen3.8-27b` is unknown to Claude Code, so it assumes a 200k-token window and
+  // auto-compacts against that number — 2.5x the 80896 tokens LM Studio actually has loaded
+  // (`lms ps`), so the session is let to grow past what the server accepts, and the failure lands
+  // mid-attempt. `local.settings.json`'s `env` block is the one place a key reaches the worker
+  // (`spawnWorker` strips the parent's inherited `CLAUDE_CODE_*` keys and keeps only the lane's OWN
+  // overlay), so this test reads the SHIPPED file and asserts the composed launch env carries the
+  // key — a later edit that drops it from the file fails here, not just in a hand-rolled fixture.
+  it('carries CLAUDE_CODE_MAX_CONTEXT_TOKENS from the shipped local.settings.json into the composed launch env', () => {
+    const shippedSettings = JSON.parse(
+      fs.readFileSync(path.join(import.meta.dirname, 'lanes', 'local.settings.json'), 'utf8'),
+    ) as LocalLaneSettings;
+
+    const launch = buildLaunch({
+      task: baseTask(),
+      lane: 'local',
+      settingsAllow: [],
+      slot,
+      attempt: 1,
+      prompt: 'assembled prompt text',
+      laneProfile: localProfile,
+      settings: shippedSettings,
+      mainCheckoutPath: '/Users/carlos/Projects/aurora/aurora-catalyst',
+      workerSystemPromptPath:
+        '/Users/carlos/Projects/aurora/aurora-catalyst/.claude/skills/catalyst-backlog/worker-system-prompt.md',
+    });
+
+    assert.ok(
+      'CLAUDE_CODE_MAX_CONTEXT_TOKENS' in launch.env,
+      'the composed launch env must carry CLAUDE_CODE_MAX_CONTEXT_TOKENS',
+    );
+    // The value must leave room for the max_tokens reservation (32000, measured on the wire) inside
+    // the 80896-token loaded context — declaring the bare 80896 would let input plus that
+    // reservation exceed what the server actually accepts.
+    assert.equal(launch.env.CLAUDE_CODE_MAX_CONTEXT_TOKENS, '48896');
+  });
+
+  // A slot's backend boot runs the task's `Test command:` — on this lane, potentially a
+  // `test:e2e` script that starts the backend against the SHARED dev database. Without this key
+  // the boot would apply an unreviewed branch's pending migrations to that database; applying
+  // migrations stays a human step (see `scripts/backlog/README.md` — Lane profiles). Reads the
+  // SHIPPED file for the same reason the CLAUDE_CODE_MAX_CONTEXT_TOKENS test above does: a later
+  // edit that drops the key from the file fails here, not just in a hand-rolled fixture.
+  it('carries DATABASE_MIGRATE_ON_BOOT=false from the shipped local.settings.json into the composed launch env', () => {
+    const shippedSettings = JSON.parse(
+      fs.readFileSync(path.join(import.meta.dirname, 'lanes', 'local.settings.json'), 'utf8'),
+    ) as LocalLaneSettings;
+
+    const launch = buildLaunch({
+      task: baseTask(),
+      lane: 'local',
+      settingsAllow: [],
+      slot,
+      attempt: 1,
+      prompt: 'assembled prompt text',
+      laneProfile: localProfile,
+      settings: shippedSettings,
+      mainCheckoutPath: '/Users/carlos/Projects/aurora/aurora-catalyst',
+      workerSystemPromptPath:
+        '/Users/carlos/Projects/aurora/aurora-catalyst/.claude/skills/catalyst-backlog/worker-system-prompt.md',
+    });
+
+    assert.equal(launch.env.DATABASE_MIGRATE_ON_BOOT, 'false');
+  });
+
+  it('emits the lane settings deny list as --disallowedTools, right after --allowedTools', () => {
+    const launch = buildLaunch({
+      task: baseTask(),
+      lane: 'local',
+      settingsAllow: [],
+      slot,
+      attempt: 1,
+      prompt: 'assembled prompt text',
+      laneProfile: localProfile,
+      settings: {
+        ...localSettings,
+        permissions: {
+          allow: ['Read', 'Edit'],
+          deny: ['Bash(git push*)', 'Bash(gh *)', 'WebFetch', 'WebSearch'],
+        },
+      },
+      mainCheckoutPath: '/repo',
+      workerSystemPromptPath: '/Users/carlos/Projects/aurora/aurora-catalyst/.claude/skills/catalyst-backlog/worker-system-prompt.md',
+    });
+
+    const allowedIndex = launch.args.indexOf('--allowedTools');
+    assert.deepEqual(launch.args.slice(allowedIndex, allowedIndex + 4), [
+      '--allowedTools',
+      'Read Edit Bash(npx --loglevel=error tsx /repo/scripts/backlog/worker-edit.ts T-1:*)',
+      '--disallowedTools',
+      'Bash(git push*) Bash(gh *) WebFetch WebSearch',
+    ]);
+  });
+
+  // H11: the local lane used to DROP `--disallowedTools` when the deny list was empty, so the
+  // README's and design.md's "both flags are always emitted" was true of one lane only.
+  it('emits --disallowedTools even when the lane settings declare no deny list', () => {
+    const launch = buildLaunch({
+      task: baseTask(),
+      lane: 'local',
+      settingsAllow: [],
+      slot,
+      attempt: 1,
+      prompt: 'assembled prompt text',
+      laneProfile: localProfile,
+      settings: { ...localSettings, permissions: { allow: ['Read', 'Edit(./**)'] } },
+      mainCheckoutPath: '/repo',
+      workerSystemPromptPath: '/Users/carlos/Projects/aurora/aurora-catalyst/.claude/skills/catalyst-backlog/worker-system-prompt.md',
+    });
+
+    assert.ok(launch.args.includes('--disallowedTools'));
+  });
+
+  // H11: `--allowedTools ""` under `--permission-mode dontAsk` is not "nothing allowed" — the flag
+  // carries no rule at all, so nothing narrows the mode. Refusing to launch blocks the task with a
+  // reason, which is the only safe reading of a permission surface that came out empty.
+  it('refuses to launch a local worker whose allow list came out empty', () => {
+    assert.throws(
+      () =>
+        buildLaunch({
+          task: baseTask(),
+          lane: 'local',
+          settingsAllow: [],
+          slot,
+          attempt: 1,
+          prompt: 'p',
+          laneProfile: localProfile,
+          settings: { ...localSettings, permissions: { allow: [] } },
+          mainCheckoutPath: '/repo',
+          workerSystemPromptPath: '/Users/carlos/Projects/aurora/aurora-catalyst/.claude/skills/catalyst-backlog/worker-system-prompt.md',
+        }),
+      /allow/i,
+    );
+  });
+
+  // T-7: a dead Bash rule is a silent hole, not a narrow grant — refusing the launch and naming
+  // the rule is the only safe reaction, on BOTH lanes and on either list (allow or deny).
+  it('refuses to launch a local worker whose settings carry a dead Bash rule, naming it', () => {
+    assert.throws(
+      () =>
+        buildLaunch({
+          task: baseTask(),
+          lane: 'local',
+          settingsAllow: [],
+          slot,
+          attempt: 1,
+          prompt: 'p',
+          laneProfile: localProfile,
+          settings: {
+            ...localSettings,
+            permissions: { allow: ['Read', 'Edit(./**)', 'Bash(pnpm --filter * test:*)'] },
+          },
+          mainCheckoutPath: '/repo',
+          workerSystemPromptPath: '/Users/carlos/Projects/aurora/aurora-catalyst/.claude/skills/catalyst-backlog/worker-system-prompt.md',
+        }),
+      /Bash\(pnpm --filter \* test:\*\)/,
+    );
+  });
+
+  it('refuses to launch a local worker whose deny list carries a dead Bash rule too', () => {
+    assert.throws(
+      () =>
+        buildLaunch({
+          task: baseTask(),
+          lane: 'local',
+          settingsAllow: [],
+          slot,
+          attempt: 1,
+          prompt: 'p',
+          laneProfile: localProfile,
+          settings: {
+            ...localSettings,
+            permissions: { allow: ['Read', 'Edit(./**)'], deny: ['Bash(mkdir * end:*)'] },
+          },
+          mainCheckoutPath: '/repo',
+          workerSystemPromptPath: '/Users/carlos/Projects/aurora/aurora-catalyst/.claude/skills/catalyst-backlog/worker-system-prompt.md',
+        }),
+      /Bash\(mkdir \* end:\*\)/,
+    );
+  });
+
+  // Measured defect (T-5, 2026-09-07): `--bare` does NOT skip settings loading. `claude --help`
+  // lists what it does skip — hooks, LSP, plugin sync, attribution, auto-memory, background
+  // prefetches, keychain reads, `CLAUDE.md` auto-discovery — and settings files are not on that
+  // list. With no `--setting-sources` at all the launch got the DEFAULT (user + project + local
+  // overlay), so the executor ran `python3 -c` (writing a file in the MAIN checkout), `npx prettier`
+  // and `pnpm exec prettier` through rules the lane grants nowhere: they came from this machine's
+  // 61 click-approvals. `user` is the narrowest value the flag accepts — an empty one is not in the
+  // grammar — and it is the same value the close's reviewer passes.
+  it('names its settings source explicitly: --bare does not stop the project file and the overlay loading', () => {
+    const launch = buildLaunch({
+      task: baseTask(),
+      lane: 'local',
+      settingsAllow: [],
+      slot,
+      attempt: 1,
+      prompt: 'p',
+      laneProfile: localProfile,
+      settings: localSettings,
+      mainCheckoutPath: '/repo',
+      workerSystemPromptPath: '/Users/carlos/Projects/aurora/aurora-catalyst/.claude/skills/catalyst-backlog/worker-system-prompt.md',
+    });
+
+    const sourcesIndex = launch.args.indexOf('--setting-sources');
+    assert.notEqual(sourcesIndex, -1, 'the local launch passes no --setting-sources at all');
+    assert.equal(launch.args[sourcesIndex + 1], 'user');
+    // The isolation flags stay: `--bare` for the prefill cost, `--strict-mcp-config` for the MCP
+    // servers the user file would otherwise bring in with its settings.
+    assert.ok(launch.args.includes('--bare'));
+    assert.ok(launch.args.includes('--strict-mcp-config'));
+  });
+
+  // The consequence of loading a source: `--allowedTools` ADDS to what it grants, so the only thing
+  // that takes a loaded rule away is a deny — composed exactly as the frontier lane composes it.
+  it('denies every user-file rule the lane does not grant, click-approvals included', () => {
+    const launch = buildLaunch({
+      task: baseTask(),
+      lane: 'local',
+      settingsAllow: userRules('Bash(python3 -c *)', 'Bash(git *)', 'Read'),
+      slot,
+      attempt: 1,
+      prompt: 'p',
+      laneProfile: localProfile,
+      settings: localSettings,
+      mainCheckoutPath: '/repo',
+      workerSystemPromptPath: '/Users/carlos/Projects/aurora/aurora-catalyst/.claude/skills/catalyst-backlog/worker-system-prompt.md',
+    });
+
+    // Asserted over the joined value, not a `split(' ')`: a rule carries spaces of its own
+    // (`Bash(python3 -c *)`), which is exactly why the CLI splits outside parentheses.
+    const deny = launch.args[launch.args.indexOf('--disallowedTools') + 1];
+    assert.ok(
+      deny.includes('Bash(python3 -c *)'),
+      'the click-approval that wrote outside the slot is not denied',
+    );
+    assert.ok(deny.includes('Bash(git *)'));
+    // The lane's own static deny list survives alongside them.
+    assert.ok(deny.includes('WebFetch'));
+    // `Read` is already granted by the lane, so denying it by spelling would revoke that grant.
+    assert.doesNotMatch(deny, /(^| )Read( |$)/);
+  });
+
+  // The same no-safe-answer overlap the frontier lane has, now reachable on this lane too: a loaded
+  // rule BROADER than the per-task test grant is either denied (revoking the task's own command) or
+  // kept (a runner that executes files out of a tree the worker can write to).
+  it('throws on a user-file rule broader than the per-task test-command grant', () => {
+    assert.throws(
+      () =>
+        buildLaunch({
+          task: baseTask({ testCommand: 'pnpm test:hooks scripts/x.test.ts' }),
+          lane: 'local',
+          settingsAllow: userRules('Bash(pnpm test:hooks:*)'),
+          slot,
+          attempt: 1,
+          prompt: 'p',
+          laneProfile: localProfile,
+          settings: localSettings,
+          mainCheckoutPath: '/repo',
+          workerSystemPromptPath: '/Users/carlos/Projects/aurora/aurora-catalyst/.claude/skills/catalyst-backlog/worker-system-prompt.md',
+        }),
+      /pnpm test:hooks/,
+    );
+  });
+
+  // H8: the test command is snapshotted at launch and already validated by `resolveTestCommand`,
+  // so the executor gets a rule for THAT command and nothing wider.
+  it('grants the task own snapshotted test command as a scoped Bash rule', () => {
+    const launch = buildLaunch({
+      task: baseTask({ testCommand: 'pnpm --filter aurora-back test session.spec.ts' }),
+      lane: 'local',
+      settingsAllow: [],
+      slot,
+      attempt: 1,
+      prompt: 'p',
+      laneProfile: localProfile,
+      settings: localSettings,
+      mainCheckoutPath: '/repo',
+      workerSystemPromptPath: '/Users/carlos/Projects/aurora/aurora-catalyst/.claude/skills/catalyst-backlog/worker-system-prompt.md',
+    });
+
+    const allow = launch.args[launch.args.indexOf('--allowedTools') + 1];
+    assert.ok(allow.includes('Bash(pnpm --filter aurora-back test session.spec.ts:*)'));
+  });
+
+  it('grants nothing at all when the task declared no test command', () => {
+    const launch = buildLaunch({
+      task: baseTask(),
+      lane: 'local',
+      settingsAllow: [],
+      slot,
+      attempt: 1,
+      prompt: 'p',
+      laneProfile: localProfile,
+      settings: localSettings,
+      mainCheckoutPath: '/repo',
+      workerSystemPromptPath: '/Users/carlos/Projects/aurora/aurora-catalyst/.claude/skills/catalyst-backlog/worker-system-prompt.md',
+    });
+
+    assert.ok(!launch.args[launch.args.indexOf('--allowedTools') + 1].includes('Bash(pnpm'));
+  });
+
+  // The declared line is tokenized (quotes honoured, so a path with a space stays ONE argument) and
+  // then re-joined into the rule. Re-joined on a bare space it becomes a rule for a DIFFERENT
+  // command line than the one the close will spawn — the worker is told to run a command it is then
+  // denied.
+  it('re-quotes an argument containing whitespace when composing the rule', () => {
+    assert.deepEqual(testCommandRuleForTask('pnpm --filter backend test "my session.spec.ts"'), [
+      'Bash(pnpm --filter backend test "my session.spec.ts":*)',
+    ]);
+  });
+
+  it('grants nothing for a test command the close would refuse to run anyway', () => {
+    const launch = buildLaunch({
+      task: baseTask({ testCommand: 'pnpm dlx some-package' }),
+      lane: 'local',
+      settingsAllow: [],
+      slot,
+      attempt: 1,
+      prompt: 'p',
+      laneProfile: localProfile,
+      settings: localSettings,
+      mainCheckoutPath: '/repo',
+      workerSystemPromptPath: '/Users/carlos/Projects/aurora/aurora-catalyst/.claude/skills/catalyst-backlog/worker-system-prompt.md',
+    });
+
+    assert.ok(!launch.args[launch.args.indexOf('--allowedTools') + 1].includes('dlx'));
+  });
+
+  const frontierProfile: FrontierLaneProfile = {
+    settings: 'scripts/backlog/lanes/frontier.settings.json',
+    maxParallel: 2,
+    model: { direct: 'sonnet', sdd: 'opus' },
+    maxTurns: 120,
+    maxBudgetUsd: 5,
+    timeoutMinutes: 90,
+  };
+  /**
+   * The project `permissions.allow` the harness would load into a frontier worker. Empty in the
+   * fixtures that are about the flag order and the allow list; the subtraction it feeds has its own
+   * tests below and above.
+   */
+  const NO_LOADED_SETTINGS: readonly SettingsAllowRule[] = [];
+  const frontierSettings: FrontierLaneSettings = {
+    permissions: {
+      allow: ['Read', 'Grep', 'Glob', 'Edit(./**)', 'Write(./**)', 'Agent', 'Skill', 'TodoWrite'],
+      deny: ['Bash(git push:*)', 'Bash(gh:*)', 'WebFetch', 'WebSearch'],
+    },
+  };
+  // Per-attempt, not a static skill file: the addendum names this task's id and its wrapper command,
+  // so it is RENDERED into the attempt directory and that copy is what the launch appends.
+  const FRONTIER_ADDENDUM_PATH = '/Users/carlos/Projects/aurora/aurora-catalyst/.backlog/.dispatch/T-1/intento-1/frontier-addendum.md';
+
+  // The frontier lane reaches the same value from the other producer (`writeFrontierAddendum` renders
+  // the file and hands back the path it wrote), so the invariant lives where the argv is built rather
+  // than in either producer.
+  it('refuses a RELATIVE worker system prompt on the frontier lane too', () => {
+    assert.throws(
+      () =>
+        buildLaunch({
+          task: baseTask({ lane: LANE.FRONTIER, path: EXECUTION_PATH.DIRECT }),
+          lane: 'frontier',
+          settingsAllow: NO_LOADED_SETTINGS,
+          workerSystemPromptPath: '.backlog/.dispatch/T-1/intento-1/frontier-addendum.md',
+          slot: { ...slot, lane: LANE.FRONTIER },
+          attempt: 1,
+          prompt: 'trabajemos T-1',
+          laneProfile: frontierProfile,
+          settings: frontierSettings,
+          mainCheckoutPath: '/Users/carlos/Projects/aurora/aurora-catalyst',
+          model: 'sonnet',
+        }),
+      /absolute/i,
+    );
+  });
+
+  it('builds the exact frontier-lane command, in the design-mandated flag order', () => {
+    const launch = buildLaunch({
+      task: baseTask({ lane: LANE.FRONTIER, path: EXECUTION_PATH.DIRECT }),
+      lane: 'frontier',
+      settingsAllow: NO_LOADED_SETTINGS,
+      workerSystemPromptPath: FRONTIER_ADDENDUM_PATH,
+      slot: { ...slot, lane: LANE.FRONTIER },
+      attempt: 1,
+      prompt: 'trabajemos T-1',
+      laneProfile: frontierProfile,
+      settings: frontierSettings,
+      mainCheckoutPath: '/Users/carlos/Projects/aurora/aurora-catalyst',
+      model: 'sonnet',
+    });
+
+    assert.equal(launch.command, 'claude');
+    assert.deepEqual(launch.args, [
+      '-p',
+      'trabajemos T-1',
+      // The click-approval overlay is NOT a source: `--setting-sources user,project` loads the
+      // project hooks and the user file's MCP setup and stops there.
+      '--setting-sources',
+      'user,project',
+      // T-24: measured 2026-09-09 — see the comment beside this flag's construction in `launch.ts`.
+      '--strict-mcp-config',
+      '--append-system-prompt-file',
+      FRONTIER_ADDENDUM_PATH,
+      '--permission-mode',
+      'dontAsk',
+      '--allowedTools',
+      'Read Grep Glob Edit(./**) Write(./**) Agent Skill TodoWrite Bash(npx --loglevel=error tsx /Users/carlos/Projects/aurora/aurora-catalyst/scripts/backlog/worker-edit.ts T-1:*)',
+      '--disallowedTools',
+      'Bash(git push:*) Bash(gh:*) WebFetch WebSearch',
+      '--max-turns',
+      '120',
+      '--max-budget-usd',
+      '5',
+      '--output-format',
+      'stream-json',
+      '--verbose',
+      '--model',
+      'sonnet',
+    ]);
+    assert.equal(launch.timeoutMs, 90 * 60_000);
+    assert.deepEqual(launch.env, {
+      BACKLOG_DISPATCH_ACTIVE: '1',
+      BACKLOG_CWD: '/Users/carlos/Projects/aurora/aurora-catalyst',
+      BACKLOG_TASK_ID: 'T-1',
+      CLAUDE_PROJECT_DIR: slot.path,
+      CLAUDE_CODE_DISABLE_BACKGROUND_TASKS: '1',
+    });
+  });
+
+  // See HEADLESS_FORCED_ENV's own JSDoc in launch.ts for why this is forced.
+  it('wins over a lane env that tries to turn it back off on the frontier lane', () => {
+    const launch = buildLaunch({
+      task: baseTask({ lane: LANE.FRONTIER, path: EXECUTION_PATH.DIRECT }),
+      lane: 'frontier',
+      settingsAllow: NO_LOADED_SETTINGS,
+      workerSystemPromptPath: FRONTIER_ADDENDUM_PATH,
+      slot: { ...slot, lane: LANE.FRONTIER },
+      attempt: 1,
+      prompt: 'trabajemos T-1',
+      laneProfile: frontierProfile,
+      settings: { ...frontierSettings, env: { CLAUDE_CODE_DISABLE_BACKGROUND_TASKS: '0' } },
+      mainCheckoutPath: '/Users/carlos/Projects/aurora/aurora-catalyst',
+      model: 'sonnet',
+    });
+
+    assert.equal(launch.env.CLAUDE_CODE_DISABLE_BACKGROUND_TASKS, '1');
+  });
+
+  // Mirrors the local-lane test above: the frontier lane dispatches Medium/Complex work too, and a
+  // slot's backend boot must never apply an unreviewed branch's migrations to the shared dev
+  // database on this lane either. Reads the SHIPPED file so a later edit that drops the key fails
+  // here.
+  it('carries DATABASE_MIGRATE_ON_BOOT=false from the shipped frontier.settings.json into the composed launch env', () => {
+    const shippedSettings = JSON.parse(
+      fs.readFileSync(path.join(import.meta.dirname, 'lanes', 'frontier.settings.json'), 'utf8'),
+    ) as FrontierLaneSettings;
+
+    const launch = buildLaunch({
+      task: baseTask({ lane: LANE.FRONTIER, path: EXECUTION_PATH.DIRECT }),
+      lane: 'frontier',
+      settingsAllow: NO_LOADED_SETTINGS,
+      workerSystemPromptPath: FRONTIER_ADDENDUM_PATH,
+      slot: { ...slot, lane: LANE.FRONTIER },
+      attempt: 1,
+      prompt: 'trabajemos T-1',
+      laneProfile: frontierProfile,
+      settings: shippedSettings,
+      mainCheckoutPath: '/Users/carlos/Projects/aurora/aurora-catalyst',
+      model: 'sonnet',
+    });
+
+    assert.equal(launch.env.DATABASE_MIGRATE_ON_BOOT, 'false');
+  });
+
+  // T-3: a claude.ai subscription login is not billed per token, so a profile with no
+  // `maxBudgetUsd` (this machine's shipped lanes.json, since the fix) must not emit a flag Claude
+  // Code cannot parse (`--max-budget-usd undefined`) — it must emit no flag at all.
+  it('omits --max-budget-usd entirely when the profile carries no value', () => {
+    const launch = buildLaunch({
+      task: baseTask({ lane: LANE.FRONTIER, path: EXECUTION_PATH.DIRECT }),
+      lane: 'frontier',
+      settingsAllow: NO_LOADED_SETTINGS,
+      workerSystemPromptPath: FRONTIER_ADDENDUM_PATH,
+      slot: { ...slot, lane: LANE.FRONTIER },
+      attempt: 1,
+      prompt: 'trabajemos T-1',
+      laneProfile: { ...frontierProfile, maxBudgetUsd: undefined },
+      settings: frontierSettings,
+      mainCheckoutPath: '/Users/carlos/Projects/aurora/aurora-catalyst',
+      model: 'sonnet',
+    });
+
+    assert.ok(!launch.args.includes('--max-budget-usd'));
+    assert.deepEqual(launch.args, [
+      '-p',
+      'trabajemos T-1',
+      '--setting-sources',
+      'user,project',
+      '--strict-mcp-config',
+      '--append-system-prompt-file',
+      FRONTIER_ADDENDUM_PATH,
+      '--permission-mode',
+      'dontAsk',
+      '--allowedTools',
+      'Read Grep Glob Edit(./**) Write(./**) Agent Skill TodoWrite Bash(npx --loglevel=error tsx /Users/carlos/Projects/aurora/aurora-catalyst/scripts/backlog/worker-edit.ts T-1:*)',
+      '--disallowedTools',
+      'Bash(git push:*) Bash(gh:*) WebFetch WebSearch',
+      '--max-turns',
+      '120',
+      '--output-format',
+      'stream-json',
+      '--verbose',
+      '--model',
+      'sonnet',
+    ]);
+  });
+
+  // G4: `--permission-mode dontAsk` with no `--allowedTools` is UNRESTRICTED, not restricted — the
+  // frontier worker ran with every tool available and nothing to deny it.
+  // L1: the frontier launch passed NO system-prompt file at all, so the worker learned about the
+  // wrapper from nothing — it reached for `backlog task edit`, was denied, and finished with every
+  // criterion unticked. The rendered addendum is what tells it.
+  it('appends the rendered addendum as the frontier worker system prompt', () => {
+    const launch = buildLaunch({
+      task: baseTask({ lane: LANE.FRONTIER, path: EXECUTION_PATH.DIRECT }),
+      lane: 'frontier',
+      settingsAllow: NO_LOADED_SETTINGS,
+      workerSystemPromptPath: FRONTIER_ADDENDUM_PATH,
+      slot: { ...slot, lane: LANE.FRONTIER },
+      attempt: 1,
+      prompt: 'trabajemos T-1',
+      laneProfile: frontierProfile,
+      settings: frontierSettings,
+      mainCheckoutPath: '/repo',
+      model: 'sonnet',
+    });
+    assert.equal(
+      launch.args[launch.args.indexOf('--append-system-prompt-file') + 1],
+      FRONTIER_ADDENDUM_PATH,
+    );
+  });
+
+  // T-24: measured 2026-09-09 — without the flag, the frontier worker's init event listed 101
+  // tools (68 `mcp__*`, from four of the six declared servers — two others failed/pending and
+  // contributed none), none of which `frontier.settings.json`'s 26 allow rules grant; with it, 30
+  // tools, 0 `mcp__*`, no declared servers at all. See the comment beside this flag's construction
+  // in `launch.ts` for the full measurement.
+  it('passes --strict-mcp-config on the frontier lane too', () => {
+    const launch = buildLaunch({
+      task: baseTask({ lane: LANE.FRONTIER, path: EXECUTION_PATH.DIRECT }),
+      lane: 'frontier',
+      settingsAllow: NO_LOADED_SETTINGS,
+      workerSystemPromptPath: FRONTIER_ADDENDUM_PATH,
+      slot: { ...slot, lane: LANE.FRONTIER },
+      attempt: 1,
+      prompt: 'trabajemos T-1',
+      laneProfile: frontierProfile,
+      settings: frontierSettings,
+      mainCheckoutPath: '/repo',
+      model: 'sonnet',
+    });
+    assert.ok(launch.args.includes('--strict-mcp-config'));
+  });
+
+  it('always emits --allowedTools and --disallowedTools, even with no deny list at all', () => {
+    const launch = buildLaunch({
+      task: baseTask({ lane: LANE.FRONTIER, path: EXECUTION_PATH.DIRECT }),
+      lane: 'frontier',
+      settingsAllow: NO_LOADED_SETTINGS,
+      workerSystemPromptPath: FRONTIER_ADDENDUM_PATH,
+      slot: { ...slot, lane: LANE.FRONTIER },
+      attempt: 1,
+      prompt: 'trabajemos T-1',
+      laneProfile: frontierProfile,
+      settings: { permissions: { allow: ['Read', 'Edit(./**)'] } },
+      mainCheckoutPath: '/repo',
+      model: 'sonnet',
+    });
+    assert.ok(launch.args.includes('--allowedTools'));
+    assert.ok(launch.args.includes('--disallowedTools'));
+  });
+
+  // P1 (round 9): the launch takes its allow list from the LANE FILE and nothing else. There is no
+  // second source to filter, so this asserts the whole list rather than the absence of particular
+  // rules — the lane's own `allow`, then the two grants the dispatcher itself decides on (the
+  // per-task wrapper and the validated test command), in that order and with nothing else in it.
+  it('emits exactly the lane allow list plus the two per-task grants — no other source', () => {
+    const launch = buildLaunch({
+      task: baseTask({
+        lane: LANE.FRONTIER,
+        path: EXECUTION_PATH.DIRECT,
+        testCommand: 'pnpm --filter backend test src/x.spec.ts',
+      }),
+      lane: 'frontier',
+      settingsAllow: NO_LOADED_SETTINGS,
+      workerSystemPromptPath: FRONTIER_ADDENDUM_PATH,
+      slot: { ...slot, lane: LANE.FRONTIER },
+      attempt: 1,
+      prompt: 'trabajemos T-1',
+      laneProfile: frontierProfile,
+      settings: frontierSettings,
+      mainCheckoutPath: '/repo',
+      model: 'sonnet',
+    });
+
+    assert.equal(
+      launch.args[launch.args.indexOf('--allowedTools') + 1],
+      [
+        ...(frontierSettings.permissions?.allow ?? []),
+        'Bash(npx --loglevel=error tsx /repo/scripts/backlog/worker-edit.ts T-1:*)',
+        'Bash(pnpm --filter backend test src/x.spec.ts:*)',
+      ].join(' '),
+    );
+  });
+
+  // Q1: `--allowedTools` ADDS to whatever the loaded settings files grant, and the frontier launch
+  // loads them on purpose (the worker runs the full harness and needs the project hooks). So the
+  // project's own allow list reaches this worker, and the only thing that takes an allow away is a
+  // deny — one per project rule the lane does not grant, appended to the lane's own deny list.
+  it('denies every project allow rule the lane does not grant, after the lane deny list', () => {
+    const launch = buildLaunch({
+      task: baseTask({ lane: LANE.FRONTIER, path: EXECUTION_PATH.DIRECT }),
+      lane: 'frontier',
+      settingsAllow: projectRules('Bash(fd:*)', 'Bash(git status:*)', 'Bash(npm test:*)'),
+      workerSystemPromptPath: FRONTIER_ADDENDUM_PATH,
+      slot: { ...slot, lane: LANE.FRONTIER },
+      attempt: 1,
+      prompt: 'trabajemos T-1',
+      laneProfile: frontierProfile,
+      settings: {
+        permissions: { allow: ['Read', 'Edit(./**)', 'Bash(git status:*)'], deny: ['WebFetch'] },
+      },
+      mainCheckoutPath: '/repo',
+      model: 'sonnet',
+    });
+
+    assert.equal(
+      launch.args[launch.args.indexOf('--disallowedTools') + 1],
+      'WebFetch Bash(fd:*) Bash(npm test:*)',
+    );
+  });
+
+  it('emits a project rule the lane deny list already carries exactly once', () => {
+    const launch = buildLaunch({
+      task: baseTask({ lane: LANE.FRONTIER, path: EXECUTION_PATH.DIRECT }),
+      lane: 'frontier',
+      settingsAllow: projectRules('Bash(fd:*)'),
+      workerSystemPromptPath: FRONTIER_ADDENDUM_PATH,
+      slot: { ...slot, lane: LANE.FRONTIER },
+      attempt: 1,
+      prompt: 'trabajemos T-1',
+      laneProfile: frontierProfile,
+      settings: { permissions: { allow: ['Read', 'Edit(./**)'], deny: ['Bash(fd:*)'] } },
+      mainCheckoutPath: '/repo',
+      model: 'sonnet',
+    });
+
+    assert.equal(launch.args[launch.args.indexOf('--disallowedTools') + 1], 'Bash(fd:*)');
+  });
+
+  // The per-task grants are part of the granted surface, not an afterthought: a project rule
+  // BROADER than the task's own test rule would revoke it, which is why the subtraction sees both.
+  it('counts the per-task grants as granted when subtracting the project list', () => {
+    const launch = buildLaunch({
+      task: baseTask({
+        lane: LANE.FRONTIER,
+        path: EXECUTION_PATH.DIRECT,
+        testCommand: 'pnpm --filter aurora-back test src/x.spec.ts',
+      }),
+      lane: 'frontier',
+      settingsAllow: projectRules('Bash(pnpm --filter aurora-back test src/x.spec.ts:*)'),
+      workerSystemPromptPath: FRONTIER_ADDENDUM_PATH,
+      slot: { ...slot, lane: LANE.FRONTIER },
+      attempt: 1,
+      prompt: 'trabajemos T-1',
+      laneProfile: frontierProfile,
+      settings: { permissions: { allow: ['Read', 'Edit(./**)'], deny: [] } },
+      mainCheckoutPath: '/repo',
+      model: 'sonnet',
+    });
+
+    assert.equal(launch.args[launch.args.indexOf('--disallowedTools') + 1], '');
+  });
+
+  // With nothing loaded from the user file, the local lane's deny list is the lane file's own — and
+  // the PROJECT file contributes nothing to it on this lane whatever it holds, because
+  // `--setting-sources user` never loads it.
+  it('leaves the local lane deny list alone when its one loaded source grants nothing', () => {
+    const launch = buildLaunch({
+      task: baseTask(),
+      lane: 'local',
+      settingsAllow: [],
+      slot,
+      attempt: 1,
+      prompt: 'T-1',
+      laneProfile: localProfile,
+      settings: localSettings,
+      mainCheckoutPath: '/repo',
+      workerSystemPromptPath: '/Users/carlos/Projects/aurora/aurora-catalyst/.claude/skills/catalyst-backlog/worker-system-prompt.md',
+    });
+
+    assert.ok(launch.args.includes('--bare'));
+    assert.equal(launch.args[launch.args.indexOf('--disallowedTools') + 1], 'WebFetch');
+  });
+
+  // The one `npx` rule the worker gets is the per-task wrapper the dispatcher owns — never a rule
+  // that came from somewhere else.
+  it('grants the per-task wrapper, and it is the only npx rule in the list', () => {
+    const launch = buildLaunch({
+      task: baseTask({ lane: LANE.FRONTIER, path: EXECUTION_PATH.DIRECT }),
+      lane: 'frontier',
+      settingsAllow: NO_LOADED_SETTINGS,
+      workerSystemPromptPath: FRONTIER_ADDENDUM_PATH,
+      slot: { ...slot, lane: LANE.FRONTIER },
+      attempt: 1,
+      prompt: 'trabajemos T-1',
+      laneProfile: frontierProfile,
+      settings: frontierSettings,
+      mainCheckoutPath: '/repo',
+      model: 'sonnet',
+    });
+
+    const allowed = launch.args[launch.args.indexOf('--allowedTools') + 1];
+    assert.equal(allowed.match(/npx/g)?.length, 1);
+    assert.ok(allowed.includes('worker-edit.ts T-1:*)'));
+  });
+
+  it('refuses to launch a frontier worker whose lane allow list came out empty', () => {
+    assert.throws(
+      () =>
+        buildLaunch({
+          task: baseTask({ lane: LANE.FRONTIER, path: EXECUTION_PATH.DIRECT }),
+          lane: 'frontier',
+          settingsAllow: NO_LOADED_SETTINGS,
+          workerSystemPromptPath: FRONTIER_ADDENDUM_PATH,
+          slot: { ...slot, lane: LANE.FRONTIER },
+          attempt: 1,
+          prompt: 'p',
+          laneProfile: frontierProfile,
+          settings: {},
+          mainCheckoutPath: '/repo',
+          model: 'sonnet',
+        }),
+      /allow/i,
+    );
+  });
+
+  // T-7: same refusal on the frontier lane — a dead Bash rule in its OWN settings file (never a
+  // project/user rule loaded through --setting-sources, out of scope for this check) is a silent
+  // hole, named rather than trusted.
+  it('refuses to launch a frontier worker whose settings carry a dead Bash rule, naming it', () => {
+    assert.throws(
+      () =>
+        buildLaunch({
+          task: baseTask({ lane: LANE.FRONTIER, path: EXECUTION_PATH.DIRECT }),
+          lane: 'frontier',
+          settingsAllow: NO_LOADED_SETTINGS,
+          workerSystemPromptPath: FRONTIER_ADDENDUM_PATH,
+          slot: { ...slot, lane: LANE.FRONTIER },
+          attempt: 1,
+          prompt: 'p',
+          laneProfile: frontierProfile,
+          settings: {
+            permissions: {
+              allow: [...frontierSettings.permissions!.allow!, 'Bash(pnpm --filter * test:*)'],
+            },
+          },
+          mainCheckoutPath: '/repo',
+          model: 'sonnet',
+        }),
+      /Bash\(pnpm --filter \* test:\*\)/,
+    );
+  });
+
+  // M1: "the list is not empty" was the wrong question — a list of `Bash` rules satisfies it and
+  // still leaves a worker that cannot open a file. The guard asks for the CAPABILITIES instead.
+  for (const [label, allow] of [
+    ['only Bash rules', ['Bash(git status:*)', 'Bash(git diff:*)']],
+    ['a read rule but no write rule', ['Bash(git status:*)', 'Read', 'Grep']],
+    ['a write rule but no read rule', ['Bash(git status:*)', 'Edit(./**)', 'Write(./**)']],
+  ] as const) {
+    it(`refuses to launch a frontier worker granted ${label}`, () => {
+      assert.throws(
+        () =>
+          buildLaunch({
+            task: baseTask({ lane: LANE.FRONTIER, path: EXECUTION_PATH.DIRECT }),
+            lane: 'frontier',
+            settingsAllow: NO_LOADED_SETTINGS,
+            workerSystemPromptPath: FRONTIER_ADDENDUM_PATH,
+            slot: { ...slot, lane: LANE.FRONTIER },
+            attempt: 1,
+            prompt: 'p',
+            laneProfile: frontierProfile,
+            settings: { permissions: { allow: [...allow] } },
+            mainCheckoutPath: '/repo',
+            model: 'sonnet',
+          }),
+        /allow/i,
+      );
+    });
+  }
+
+  // The same guard on the local lane, whose whole surface is the lane file: a `local.settings.json`
+  // edited down to Bash rules would dispatch an executor that cannot write the fix it was sent for.
+  it('refuses to launch a local worker granted no write rule', () => {
+    assert.throws(
+      () =>
+        buildLaunch({
+          task: baseTask(),
+          lane: 'local',
+          settingsAllow: [],
+          slot,
+          attempt: 1,
+          prompt: 'p',
+          laneProfile: localProfile,
+          settings: { ...localSettings, permissions: { allow: ['Read', 'Grep', 'Glob'] } },
+          mainCheckoutPath: '/repo',
+          workerSystemPromptPath: '/Users/carlos/Projects/aurora/aurora-catalyst/.claude/skills/catalyst-backlog/worker-system-prompt.md',
+        }),
+      /allow/i,
+    );
+  });
+
+  it('emits a rule that appears twice in the lane file exactly once', () => {
+    const launch = buildLaunch({
+      task: baseTask({ lane: LANE.FRONTIER, path: EXECUTION_PATH.DIRECT }),
+      lane: 'frontier',
+      settingsAllow: NO_LOADED_SETTINGS,
+      workerSystemPromptPath: FRONTIER_ADDENDUM_PATH,
+      slot: { ...slot, lane: LANE.FRONTIER },
+      attempt: 1,
+      prompt: 'trabajemos T-1',
+      laneProfile: frontierProfile,
+      settings: {
+        permissions: {
+          allow: ['Read', 'Edit(./**)', 'Bash(catalyst:*)', 'Bash(catalyst:*)'],
+          deny: [],
+        },
+      },
+      mainCheckoutPath: '/repo',
+      model: 'sonnet',
+    });
+
+    // Asserted on the joined string, not on `.split(' ')`: a rule may itself contain a space
+    // (`Bash(git status:*)`), so splitting on the separator would tear it in two.
+    const allow = launch.args[launch.args.indexOf('--allowedTools') + 1];
+    assert.equal(allow.match(/Bash\(catalyst:\*\)/g)?.length, 1, 'a repeated rule appears once');
+  });
+
+  it('denies git push on the frontier lane: the DISPATCHER pushes and opens the PR, not the worker', () => {
+    const launch = buildLaunch({
+      task: baseTask({ lane: LANE.FRONTIER, path: EXECUTION_PATH.DIRECT }),
+      lane: 'frontier',
+      settingsAllow: NO_LOADED_SETTINGS,
+      workerSystemPromptPath: FRONTIER_ADDENDUM_PATH,
+      slot: { ...slot, lane: LANE.FRONTIER },
+      attempt: 1,
+      prompt: 'trabajemos T-1',
+      laneProfile: frontierProfile,
+      settings: frontierSettings,
+      mainCheckoutPath: '/repo',
+      model: 'sonnet',
+    });
+
+    assert.match(launch.args[launch.args.indexOf('--disallowedTools') + 1], /Bash\(git push:\*\)/);
+  });
+
+  it('honours the frontier settings file: permissions become flags, env is injected', () => {
+    const launch = buildLaunch({
+      task: baseTask({ lane: LANE.FRONTIER, path: EXECUTION_PATH.DIRECT }),
+      lane: 'frontier',
+      settingsAllow: NO_LOADED_SETTINGS,
+      workerSystemPromptPath: FRONTIER_ADDENDUM_PATH,
+      slot: { ...slot, lane: LANE.FRONTIER },
+      attempt: 1,
+      prompt: 'trabajemos T-1',
+      laneProfile: frontierProfile,
+      settings: {
+        env: { ANTHROPIC_DEFAULT_OPUS_MODEL: 'sonnet' },
+        permissions: { allow: ['Read', 'Edit(./**)'], deny: ['Bash(rm -rf:*)'] },
+      },
+      mainCheckoutPath: '/repo',
+      model: 'sonnet',
+    });
+
+    const denyIndex = launch.args.indexOf('--disallowedTools');
+    assert.ok(denyIndex > -1);
+    assert.equal(launch.args[denyIndex + 1], 'Bash(rm -rf:*)');
+    assert.equal(launch.env.ANTHROPIC_DEFAULT_OPUS_MODEL, 'sonnet');
+  });
+
+  it('resolves the frontier model to opus for path:sdd', () => {
+    const launch = buildLaunch({
+      task: baseTask({ lane: LANE.FRONTIER, path: EXECUTION_PATH.SDD }),
+      lane: 'frontier',
+      settingsAllow: NO_LOADED_SETTINGS,
+      workerSystemPromptPath: FRONTIER_ADDENDUM_PATH,
+      slot: { ...slot, lane: LANE.FRONTIER },
+      attempt: 1,
+      prompt: 'trabajemos T-1',
+      laneProfile: frontierProfile,
+      settings: frontierSettings,
+      mainCheckoutPath: '/repo',
+      model: 'opus',
+    });
+    assert.ok(launch.args.includes('opus'));
+  });
+});
+
+// ── checkLocalModelLoaded ──────────────────────────────────────────────────────
+
+describe('checkLocalModelLoaded', () => {
+  const jsonResponse = (body: unknown, ok = true): typeof fetch =>
+    (async () =>
+      ({
+        ok,
+        json: async () => body,
+      }) as unknown as Response) as unknown as typeof fetch;
+
+  it('is true when the configured model is loaded (Phase 1 spike 1.6 shape)', async () => {
+    const fetchImpl = jsonResponse({
+      data: [
+        { id: 'qwen/qwen3.8-27b', state: 'loaded', loaded_context_length: 80896 },
+        { id: 'other/model', state: 'not-loaded' },
+      ],
+    });
+    const loaded = await checkLocalModelLoaded(
+      fetchImpl,
+      'http://localhost:1234',
+      'qwen/qwen3.8-27b',
+    );
+    assert.equal(loaded, true);
+  });
+
+  it('is false when the configured model is present but not loaded', async () => {
+    const fetchImpl = jsonResponse({ data: [{ id: 'qwen/qwen3.8-27b', state: 'not-loaded' }] });
+    const loaded = await checkLocalModelLoaded(
+      fetchImpl,
+      'http://localhost:1234',
+      'qwen/qwen3.8-27b',
+    );
+    assert.equal(loaded, false);
+  });
+
+  it('is false when the configured model is absent from the response', async () => {
+    const fetchImpl = jsonResponse({ data: [{ id: 'other/model', state: 'loaded' }] });
+    const loaded = await checkLocalModelLoaded(
+      fetchImpl,
+      'http://localhost:1234',
+      'qwen/qwen3.8-27b',
+    );
+    assert.equal(loaded, false);
+  });
+
+  it('is false when the HTTP response itself is not ok', async () => {
+    const fetchImpl = jsonResponse({ data: [] }, false);
+    const loaded = await checkLocalModelLoaded(
+      fetchImpl,
+      'http://localhost:1234',
+      'qwen/qwen3.8-27b',
+    );
+    assert.equal(loaded, false);
+  });
+
+  it('is false, never a rejection, when the server is unreachable', async () => {
+    const fetchImpl = (async () => {
+      throw new Error('ECONNREFUSED');
+    }) as unknown as typeof fetch;
+
+    // A rejection here would abort the whole reconciler pass instead of blocking one task, taking
+    // the maintenance sweep and every other queued task down with it.
+    const loaded = await checkLocalModelLoaded(
+      fetchImpl,
+      'http://localhost:1234',
+      'qwen/qwen3.8-27b',
+    );
+    assert.equal(loaded, false);
+  });
+
+  it('is false when the response body is not JSON at all', async () => {
+    const fetchImpl = (async () =>
+      ({
+        ok: true,
+        json: async () => {
+          throw new Error('Unexpected token < in JSON');
+        },
+      }) as unknown as Response) as unknown as typeof fetch;
+
+    const loaded = await checkLocalModelLoaded(
+      fetchImpl,
+      'http://localhost:1234',
+      'qwen/qwen3.8-27b',
+    );
+    assert.equal(loaded, false);
+  });
+
+  it('requests the documented /api/v0/models endpoint under the given base URL', async () => {
+    const requestedUrls: string[] = [];
+    const fetchImpl = (async (url: string) => {
+      requestedUrls.push(String(url));
+      return { ok: true, json: async () => ({ data: [] }) } as unknown as Response;
+    }) as unknown as typeof fetch;
+
+    await checkLocalModelLoaded(fetchImpl, 'http://localhost:1234', 'qwen/qwen3.8-27b');
+    assert.deepEqual(requestedUrls, ['http://localhost:1234/api/v0/models']);
+  });
+});
+
+// ── resetInjectorCache ─────────────────────────────────────────────────────────
+
+describe('resetInjectorCache', () => {
+  it('deletes .claude/.cache/br-injected.json when present (Phase 1 spike 1.3 finding)', () => {
+    const slotDir = fs.mkdtempSync(path.join(os.tmpdir(), 'backlog-slot-'));
+    const cacheDir = path.join(slotDir, '.claude', '.cache');
+    fs.mkdirSync(cacheDir, { recursive: true });
+    const cacheFile = path.join(cacheDir, 'br-injected.json');
+    fs.writeFileSync(cacheFile, '{"T-1":["BR-1"]}');
+
+    resetInjectorCache(slotDir);
+
+    assert.equal(fs.existsSync(cacheFile), false);
+  });
+
+  it('is a no-op when the cache file does not exist', () => {
+    const slotDir = fs.mkdtempSync(path.join(os.tmpdir(), 'backlog-slot-'));
+    assert.doesNotThrow(() => resetInjectorCache(slotDir));
+  });
+});
+
+// ── sanitizeInheritedEnv ───────────────────────────────────────────────────────
+
+describe('sanitizeInheritedEnv', () => {
+  it('drops every ANTHROPIC_* and CLAUDE_CODE_* key, keeping everything else', () => {
+    const sanitized = sanitizeInheritedEnv({
+      PATH: '/usr/bin',
+      HOME: '/Users/x',
+      ANTHROPIC_API_KEY: 'sk-x',
+      ANTHROPIC_BASE_URL: 'https://api.anthropic.com',
+      CLAUDE_CODE_ENTRYPOINT: 'cli',
+    });
+    assert.deepEqual(sanitized, { PATH: '/usr/bin', HOME: '/Users/x' });
+  });
+
+  it('drops an undefined value rather than passing it on as the string "undefined"', () => {
+    assert.deepEqual(sanitizeInheritedEnv({ A: undefined, B: 'b' }), { B: 'b' });
+  });
+
+  // N4: the reconciler is launched from an interactive session and from launchd, so its own env
+  // carries whatever the developer's shell exports. A worker that inherits `GITHUB_TOKEN` can push
+  // and open PRs through the API regardless of which `gh` rules the lane denies; `NPM_TOKEN`
+  // publishes; the SOPS and cloud keys decrypt this repo's secrets.
+  it('drops every credential-shaped key, on both lanes', () => {
+    const sanitized = sanitizeInheritedEnv({
+      PATH: '/usr/bin',
+      GITHUB_TOKEN: 'ghp_x',
+      GH_TOKEN: 'ghp_y',
+      NPM_TOKEN: 'npm_x',
+      NODE_AUTH_TOKEN: 'npm_y',
+      SOPS_AGE_KEY: 'age-x',
+      AWS_SECRET_ACCESS_KEY: 'aws-x',
+      AZURE_CLIENT_SECRET: 'az-x',
+      GOOGLE_APPLICATION_CREDENTIALS: '/x.json',
+      OPENAI_API_KEY: 'sk-x',
+      MY_SERVICE_PASSWORD: 'p',
+      SOME_PRIVATE_KEY: 'k',
+      SENTRY_SECRET: 's',
+      LEGIT_API_KEY: 'a',
+    });
+    assert.deepEqual(sanitized, { PATH: '/usr/bin' });
+  });
+
+  it('keeps an ordinary key whose name merely mentions a credential word mid-string', () => {
+    assert.deepEqual(sanitizeInheritedEnv({ TOKEN_BUDGET: '10', SECRETS_DIR_NAME: 'x' }), {
+      TOKEN_BUDGET: '10',
+      SECRETS_DIR_NAME: 'x',
+    });
+  });
+});
+
+// ── spawnWorker ────────────────────────────────────────────────────────────────
+
+describe('spawnWorker', () => {
+  const nodeLaunch = (script: string, timeoutMs = 10_000): Launch => ({
+    command: process.execPath,
+    args: ['-e', script],
+    env: {},
+    cwd: process.cwd(),
+    timeoutMs,
+  });
+
+  it('feeds each stdout line to onLine as it arrives, and resolves when the process exits', async () => {
+    const lines: string[] = [];
+    await spawnWorker(nodeLaunch('console.log("first");console.log("second")'), (line) =>
+      lines.push(line),
+    );
+    assert.deepEqual(lines, ['first', 'second']);
+  });
+
+  it('splits on newlines, not on chunk boundaries — a long stream-json line survives whole', async () => {
+    const lines: string[] = [];
+    // The child builds the long line itself: Linux caps a single argv entry at 128 KB (E2BIG).
+    const longLength = 200_000;
+    await spawnWorker(nodeLaunch(`console.log("x".repeat(${longLength}))`), (line) =>
+      lines.push(line),
+    );
+    assert.equal(lines.length, 1);
+    assert.equal(lines[0].length, longLength);
+  });
+
+  it('resolves rather than throwing when the process exits non-zero (the close classifies the stream)', async () => {
+    const lines: string[] = [];
+    await spawnWorker(nodeLaunch('console.log("partial");process.exit(3)'), (line) =>
+      lines.push(line),
+    );
+    assert.deepEqual(lines, ['partial']);
+  });
+
+  it('resolves when the command does not exist at all, instead of leaving the pass hanging', async () => {
+    await spawnWorker(
+      {
+        command: 'definitely-not-a-real-binary-xyz',
+        args: [],
+        env: {},
+        cwd: process.cwd(),
+        timeoutMs: 5_000,
+      },
+      () => {},
+    );
+  });
+
+  it('kills the worker at the lane timeout and keeps the lines it already emitted', async () => {
+    const lines: string[] = [];
+    const started = Date.now();
+    await spawnWorker(
+      nodeLaunch('console.log("before the hang");setInterval(() => {}, 1000)', 300),
+      (line) => lines.push(line),
+    );
+    assert.deepEqual(lines, ['before the hang']);
+    assert.ok(Date.now() - started < 5_000, 'the timeout must end the wait, not the 1s interval');
+  });
+
+  it('reports the child pid as soon as it exists, so the lock can record the WORKER, not the dispatcher', async () => {
+    const pids: number[] = [];
+    await spawnWorker(nodeLaunch('console.log("hi")'), () => {}, {
+      onSpawn: (pid) => pids.push(pid),
+    });
+    assert.equal(pids.length, 1);
+    assert.ok(pids[0] > 0);
+    assert.notEqual(pids[0], process.pid, 'the worker must be its own process, not the dispatcher');
+  });
+
+  it("strips the parent's ANTHROPIC_* and CLAUDE_CODE_* keys — an inherited API key would bypass the lane", async () => {
+    const lines: string[] = [];
+    process.env.ANTHROPIC_API_KEY = 'sk-should-never-reach-a-worker';
+    process.env.CLAUDE_CODE_SOMETHING = 'inherited';
+    try {
+      await spawnWorker(
+        {
+          command: process.execPath,
+          args: [
+            '-e',
+            'console.log(`${process.env.ANTHROPIC_API_KEY} ${process.env.CLAUDE_CODE_SOMETHING}`)',
+          ],
+          env: {},
+          cwd: process.cwd(),
+          timeoutMs: 10_000,
+        },
+        (line) => lines.push(line),
+      );
+    } finally {
+      delete process.env.ANTHROPIC_API_KEY;
+      delete process.env.CLAUDE_CODE_SOMETHING;
+    }
+    assert.deepEqual(lines, ['undefined undefined']);
+  });
+
+  it("keeps the lane's OWN ANTHROPIC_* overlay, which is how the local lane reaches LM Studio", async () => {
+    const lines: string[] = [];
+    process.env.ANTHROPIC_BASE_URL = 'https://api.anthropic.com';
+    try {
+      await spawnWorker(
+        {
+          command: process.execPath,
+          args: ['-e', 'console.log(process.env.ANTHROPIC_BASE_URL)'],
+          env: { ANTHROPIC_BASE_URL: 'http://localhost:1234' },
+          cwd: process.cwd(),
+          timeoutMs: 10_000,
+        },
+        (line) => lines.push(line),
+      );
+    } finally {
+      delete process.env.ANTHROPIC_BASE_URL;
+    }
+    assert.deepEqual(lines, ['http://localhost:1234']);
+  });
+
+  it('passes the launch env through to the worker process', async () => {
+    const lines: string[] = [];
+    await spawnWorker(
+      {
+        command: process.execPath,
+        args: ['-e', 'console.log(process.env.BACKLOG_DISPATCH_ACTIVE)'],
+        env: { BACKLOG_DISPATCH_ACTIVE: '1' },
+        cwd: process.cwd(),
+        timeoutMs: 10_000,
+      },
+      (line) => lines.push(line),
+    );
+    assert.deepEqual(lines, ['1']);
+  });
+});
+
+// K5: launchd tracks the pid of what it starts and will NOT start a second instance while that
+// process lives. With the reconciler itself as `ProgramArguments`, its pid was the tracked one —
+// and the reconciler outlives its whole worker, so the timer went silent for the length of every
+// dispatch, exactly when a `StartInterval` recovery pass matters most. The launcher must therefore
+// detach the reconciler and exit, the same way the `onStatusChange` callback does.
+// R1: the OLD shape opened the log redirection (`>> ...log`) around the WHOLE `nohup sh -c
+// "mkdir -p ... && npx ..."` compound — the shell resolves that redirection's target BEFORE
+// running anything inside the quotes, so it failed outright on a fresh clone where
+// `.backlog/.dispatch/` does not exist yet. MEASURED correct shape (0.01s return, log created in a
+// clean dir): `mkdir -p .backlog/.dispatch; nohup <cmd> >> "<log>" 2>&1 < /dev/null &` — a
+// SEMICOLON after `mkdir`, so `&` backgrounds only the `nohup` command; with `&&` the whole list is
+// backgrounded and its subshell holds the caller's pipes for the whole run (measured 3s vs 0.01s).
+describe('trigger command shape — invariants shared by the plist and .backlog/config.yml', () => {
+  const plist = fs.readFileSync(
+    path.join(import.meta.dirname, 'dev.aurora.backlog-dispatch.plist'),
+    'utf8',
+  );
+  const config = fs.readFileSync(
+    path.join(import.meta.dirname, '..', '..', '.backlog', 'config.yml'),
+    'utf8',
+  );
+
+  // The plist's `-c` argument is the third <string> in ProgramArguments — extracted by matching the
+  // one that contains `mkdir`, since the surrounding array also holds the bare `/bin/sh`/`-c`
+  // strings, which never do.
+  const plistStringMatch = /<string>([^<]*mkdir[^<]*)<\/string>/.exec(plist);
+  const plistCommand = plistStringMatch?.[1] ?? '';
+
+  const onStatusChangeMatch = /onStatusChange:\s*'([^']*)'/.exec(config);
+  const configCommand = onStatusChangeMatch?.[1] ?? '';
+
+  it('runs the plist command through /bin/sh -c', () => {
+    assert.match(plist, /<string>\/bin\/sh<\/string>\s*\n\s*<string>-c<\/string>/);
+  });
+
+  const commands: Array<[string, string]> = [
+    ['plist', plistCommand],
+    ['config.yml onStatusChange', configCommand],
+  ];
+
+  for (const [label, command] of commands) {
+    describe(label, () => {
+      it('is non-empty (the extraction regex actually matched)', () => {
+        assert.ok(command.length > 0, `expected to extract a non-empty command from ${label}`);
+      });
+
+      it('runs mkdir -p .backlog/.dispatch BEFORE the first redirection', () => {
+        const mkdirIdx = command.indexOf('mkdir -p .backlog/.dispatch');
+        const firstRedirectIdx = command.indexOf(label === 'plist' ? '&gt;&gt;' : '>>');
+        assert.ok(mkdirIdx >= 0, 'mkdir -p .backlog/.dispatch must be present');
+        assert.ok(firstRedirectIdx >= 0, 'a >> redirection must be present');
+        assert.ok(mkdirIdx < firstRedirectIdx, 'mkdir must run before the log file is opened');
+      });
+
+      it('follows the mkdir with a semicolon, not &&, so & backgrounds only the nohup command', () => {
+        assert.match(
+          command,
+          /mkdir -p \.backlog\/\.dispatch;/,
+          'a ; must separate mkdir from the nohup command',
+        );
+        assert.ok(
+          !command.includes('mkdir -p .backlog/.dispatch &&') &&
+            !command.includes('mkdir -p .backlog/.dispatch &amp;&amp;'),
+          'mkdir must not be joined to nohup with &&: that backgrounds the whole compound list instead of just nohup',
+        );
+      });
+
+      it('ends with 2>&1 < /dev/null & (XML-escaped in the plist), so every stdio is detached', () => {
+        const tail = label === 'plist' ? '2&gt;&amp;1 &lt; /dev/null &amp;' : '2>&1 < /dev/null &';
+        assert.ok(
+          command.trimEnd().endsWith(tail),
+          `expected the command to end with ${tail}, got: ${command}`,
+        );
+      });
+
+      it('contains nohup', () => {
+        assert.match(command, /nohup/);
+      });
+
+      it('never uses exec (which would make the reconciler the pid launchd/Backlog.md tracks)', () => {
+        assert.ok(!command.includes('exec '));
+      });
+    });
+  }
+
+  // L11: two logs, not one. `launchd.log` is what launchd itself opens (StandardOutPath), and it
+  // only ever holds the LAUNCHER's output — a failing `mkdir` or `nohup`. The detached reconciler,
+  // which runs for tens of minutes, gets `reconciler.log`: interleaved into one file, neither was
+  // readable.
+  it('redirects the detached plist reconciler into its OWN log, separate from launchd own', () => {
+    assert.match(plist, /&gt;&gt; \.backlog\/\.dispatch\/reconciler\.log 2&gt;&amp;1/);
+    assert.ok(
+      !plistCommand.includes('launchd.log'),
+      'the reconciler must not write into launchd own log',
+    );
+    assert.match(plist, /<key>StandardOutPath<\/key>\s*\n\s*<string>[^<]*launchd\.log<\/string>/);
+  });
+});