@aurorajs.dev/catalyst-cli 1.1.3 → 2.0.0

package/dist/templates/monorepo/scripts/backlog/launch.test.ts

@@ -44,6 +44,7 @@ import {
   type FrontierLaneSettings,
   type Launch,
   type LocalLaneProfile,
+  type LocalLaneSettings,
   type SettingsSource,
 } from './launch.js';
 import {
@@ -106,7 +107,7 @@ describe('loadLaneConfig', () => {
     assert.equal(config.lanes.local.maxParallel, 1);
     assert.equal(config.lanes.local.effort, 'medium');
     assert.equal(config.lanes.local.maxTurns, 40);
-    assert.equal(config.lanes.local.timeoutMinutes, 30);
+    assert.equal(config.lanes.local.timeoutMinutes, 60);
     assert.equal(config.lanes.local.healthCheckUrl, 'http://localhost:1234');
     assert.equal(config.lanes.local.reviewerModel, 'sonnet');
     assert.equal(config.lanes.local.reviewerTimeoutMinutes, 15);
@@ -124,7 +125,7 @@ describe('loadLaneConfig', () => {
     // T-8 point 5: the shipped file declares 4 — `dispatch.ts` converts this to ms and passes it as
     // `MaintenanceContext.orphanInProgressThresholdMs`, which gates the sweep's orphan-`In Progress`
     // check (point 10).
-    assert.equal(config.orphanInProgressThresholdHours, 4);
+    assert.equal(config.orphanInProgressThresholdHours, 24);
   });
 
   it('parses a minimal synthetic file with the same shape', () => {
@@ -136,6 +137,7 @@ describe('loadLaneConfig', () => {
         slotsRoot: '.claude/worktrees',
         slots: ['dispatch-a', 'dispatch-b'],
         attempts: 3,
+        orphanInProgressThresholdHours: 24,
         lanes: {
           local: {
             settings: 'scripts/backlog/lanes/local.settings.json',
@@ -145,6 +147,7 @@ describe('loadLaneConfig', () => {
             timeoutMinutes: 30,
             healthCheckUrl: 'http://localhost:1234',
             reviewerModel: 'sonnet',
+            reviewerTimeoutMinutes: 15,
           },
           frontier: {
             settings: 'scripts/backlog/lanes/frontier.settings.json',
@@ -162,12 +165,13 @@ describe('loadLaneConfig', () => {
     assert.deepEqual(config.slots, ['dispatch-a', 'dispatch-b']);
     assert.equal(config.lanes.local.maxTurns, 40);
     assert.deepEqual(config.lanes.frontier.model, { direct: 'sonnet', sdd: 'opus' });
-    // G1: a hung reviewer holds a slot for as long as nobody bounds it. The synthetic file above
-    // declares no `reviewerTimeoutMinutes`, so the default must be a real bound, not "none".
+    // G1: a hung reviewer holds a slot for as long as nobody bounds it. `lanes.json` is the only
+    // source of truth for this bound — there is no code-level fallback (see the dedicated
+    // "missing entirely" test below), so the synthetic file above must declare it.
     assert.equal(config.lanes.local.reviewerTimeoutMinutes, 15);
-    // T-8 point 5: the synthetic file above declares no `orphanInProgressThresholdHours` either —
-    // the default (4h) must apply the same way `reviewerTimeoutMinutes`'s does, never `undefined`.
-    assert.equal(config.orphanInProgressThresholdHours, 4);
+    // T-8 point 5: same rule for the sweep's orphan threshold — mandatory in `lanes.json`, no
+    // code default, so the synthetic file above declares it too.
+    assert.equal(config.orphanInProgressThresholdHours, 24);
   });
 
   // T-8 point 5.
@@ -191,6 +195,7 @@ describe('loadLaneConfig', () => {
               timeoutMinutes: 30,
               healthCheckUrl: 'http://localhost:1234',
               reviewerModel: 'sonnet',
+              reviewerTimeoutMinutes: 15,
             },
             frontier: {
               settings: 'scripts/backlog/lanes/frontier.settings.json',
@@ -225,6 +230,44 @@ describe('loadLaneConfig', () => {
               timeoutMinutes: 30,
               healthCheckUrl: 'http://localhost:1234',
               reviewerModel: 'sonnet',
+              reviewerTimeoutMinutes: 15,
+            },
+            frontier: {
+              settings: 'scripts/backlog/lanes/frontier.settings.json',
+              maxParallel: 2,
+              model: { direct: 'sonnet', sdd: 'opus' },
+              maxTurns: 120,
+              timeoutMinutes: 90,
+            },
+          },
+        }),
+      );
+
+      assert.throws(
+        () => loadLaneConfig(file),
+        /expected a number at "orphanInProgressThresholdHours"/,
+      );
+    });
+
+    it('throws when orphanInProgressThresholdHours is missing entirely — lanes.json is the only source, there is no code fallback', () => {
+      const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'backlog-lanes-'));
+      const file = path.join(dir, 'lanes.json');
+      fs.writeFileSync(
+        file,
+        JSON.stringify({
+          slotsRoot: '.claude/worktrees',
+          slots: ['dispatch-a'],
+          attempts: 3,
+          lanes: {
+            local: {
+              settings: 'scripts/backlog/lanes/local.settings.json',
+              maxParallel: 1,
+              effort: 'medium',
+              maxTurns: 40,
+              timeoutMinutes: 30,
+              healthCheckUrl: 'http://localhost:1234',
+              reviewerModel: 'sonnet',
+              reviewerTimeoutMinutes: 15,
             },
             frontier: {
               settings: 'scripts/backlog/lanes/frontier.settings.json',
@@ -265,6 +308,7 @@ describe('loadLaneConfig', () => {
               timeoutMinutes: 30,
               healthCheckUrl: 'http://localhost:1234',
               reviewerModel: 'sonnet',
+              reviewerTimeoutMinutes: 15,
             },
             frontier: {
               settings: 'scripts/backlog/lanes/frontier.settings.json',
@@ -294,6 +338,45 @@ describe('loadLaneConfig', () => {
     });
   });
 
+  describe('lanes.local.reviewerTimeoutMinutes', () => {
+    it('throws when reviewerTimeoutMinutes is missing entirely — lanes.json is the only source, there is no code fallback', () => {
+      const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'backlog-lanes-'));
+      const file = path.join(dir, 'lanes.json');
+      fs.writeFileSync(
+        file,
+        JSON.stringify({
+          slotsRoot: '.claude/worktrees',
+          slots: ['dispatch-a'],
+          attempts: 3,
+          orphanInProgressThresholdHours: 24,
+          lanes: {
+            local: {
+              settings: 'scripts/backlog/lanes/local.settings.json',
+              maxParallel: 1,
+              effort: 'medium',
+              maxTurns: 40,
+              timeoutMinutes: 30,
+              healthCheckUrl: 'http://localhost:1234',
+              reviewerModel: 'sonnet',
+            },
+            frontier: {
+              settings: 'scripts/backlog/lanes/frontier.settings.json',
+              maxParallel: 2,
+              model: { direct: 'sonnet', sdd: 'opus' },
+              maxTurns: 120,
+              timeoutMinutes: 90,
+            },
+          },
+        }),
+      );
+
+      assert.throws(
+        () => loadLaneConfig(file),
+        /expected a number at "lanes\.local\.reviewerTimeoutMinutes"/,
+      );
+    });
+  });
+
   describe('resolveOrphanInProgressThresholdMs', () => {
     it('converts 0 hours to undefined — step 3c\'s own "disabled" signal, not the most aggressive threshold', () => {
       assert.equal(resolveOrphanInProgressThresholdMs(0), undefined);
@@ -334,6 +417,7 @@ describe('loadLaneConfig', () => {
           slotsRoot: '.claude/worktrees',
           slots: ['dispatch-a'],
           attempts: 3,
+          orphanInProgressThresholdHours: 24,
           ...extra,
           lanes: {
             local: {
@@ -344,6 +428,7 @@ describe('loadLaneConfig', () => {
               timeoutMinutes: 30,
               healthCheckUrl: 'http://localhost:1234',
               reviewerModel: 'sonnet',
+              reviewerTimeoutMinutes: 15,
             },
             frontier: {
               settings: 'scripts/backlog/lanes/frontier.settings.json',
@@ -414,6 +499,7 @@ describe('loadLaneConfig', () => {
           slotsRoot: '.claude/worktrees',
           slots: ['dispatch-a'],
           attempts: 3,
+          orphanInProgressThresholdHours: 24,
           lanes: {
             local: {
               settings: 'scripts/backlog/lanes/local.settings.json',
@@ -423,6 +509,7 @@ describe('loadLaneConfig', () => {
               timeoutMinutes: 30,
               healthCheckUrl: 'http://localhost:1234',
               reviewerModel: 'sonnet',
+              reviewerTimeoutMinutes: 15,
             },
             frontier: {
               settings: 'scripts/backlog/lanes/frontier.settings.json',
@@ -559,12 +646,15 @@ describe('lanes/local.settings.json — the executor permission surface', () =>
 
   // H8: `Bash(pnpm --filter * test*)` was a trailing glob over every pnpm subcommand whose words
   // happened to line up — `pnpm --filter x test-and-publish`, and anything else `test*` matched. The
-  // task's own snapshotted, allowlist-validated command is granted per launch instead.
-  it('grants no standing pnpm rule: the task test command is granted per launch', () => {
-    assert.deepEqual(
-      settings.permissions.allow.filter((rule) => rule.includes('pnpm')),
-      [],
-    );
+  // task's own snapshotted, allowlist-validated command is still granted per launch, never as a
+  // standing rule here. T-60 adds ONE standing pnpm rule: `exec prettier --check`, copied verbatim
+  // from `frontier.settings.json`, where it is a fixed verification tool (not a task-shaped test
+  // command) — the worker must be able to test the same Prettier condition the close judges it on.
+  it('grants no standing pnpm rule beyond the fixed prettier --check pair', () => {
+    assert.deepEqual(settings.permissions.allow.filter((rule) => rule.includes('pnpm')), [
+      'Bash(pnpm --filter * exec prettier --check)',
+      'Bash(pnpm --filter * exec prettier --check *)',
+    ]);
   });
 
   // H13: bare `Edit`/`Write` let the executor write anywhere the process could reach, the main
@@ -638,11 +728,16 @@ describe('lanes/frontier.settings.json', () => {
   // The commands are the ones a frontier ORCHESTRATOR needs to do its job: inspect the tree it is
   // working in (`git status`/`diff`/`log`/`show`/`rev-parse`/`symbolic-ref` — read-only verbs, none
   // of which stage, commit, move a branch or discard a file), run the SDD flow (`openspec`), run the
-  // generator (`catalyst`), verify its own work in a workspace (a scoped `test`, Prettier's
-  // `--check`, `tsc --noEmit`), and evolve the database schema OFFLINE (`db:generate` diffs
-  // `*.schema.ts` against the last `snapshot.json`; `db:check` is the same offline comparison — see
-  // `catalyst-schema-migrations`; neither touches a real database, which stays out of reach). Nothing
-  // here runs a script out of the tree the worker can write to.
+  // generator (`catalyst`, plus the two T-48 exceptions below that build and run it FROM the slot's
+  // own sources), verify its own work in a workspace (a scoped `test`, Prettier's `--check`,
+  // `tsc --noEmit`), evolve the database schema OFFLINE (`db:generate` diffs `*.schema.ts` against
+  // the last `snapshot.json`; `db:check` is the same offline comparison — see
+  // `catalyst-schema-migrations`; neither opens a connection), and READ the live database
+  // (`db:query`). The lane's database boundary is READ-ONLY, not absent: `db:query` does open a
+  // connection, and what keeps it harmless is the dedicated non-superuser role it connects with
+  // plus two more layers, not this list — see the comment on its rules below. TWO rules here DO
+  // run a script out of the tree the worker can write to — `WRITABLE_TREE_RUNNER_EXCEPTIONS` below
+  // names them and reasons about the exposure.
   const FRONTIER_ALLOW: readonly string[] = [
     'Read',
     'Grep',
@@ -660,6 +755,21 @@ describe('lanes/frontier.settings.json', () => {
     'Bash(git symbolic-ref:*)',
     'Bash(openspec:*)',
     'Bash(catalyst:*)',
+    // T-48: build and run the generator FROM THE SLOT'S OWN SOURCES. The global `catalyst` binary
+    // (line above) is a cmd-shim resolving to a globally-LINKED package that is itself a symlink to
+    // the MAIN checkout's `packages/cli` — so it can never verify a schema/template change the
+    // worker made in THIS slot, and running the main checkout's code was also a security property:
+    // that code the worker cannot edit. These two rules trade that property away on purpose — see
+    // `WRITABLE_TREE_RUNNER_EXCEPTIONS` below. `Bash(pnpm --dir packages/cli install:*)` was a third
+    // rule here and was REMOVED (round 3, S1): its `:*` suffix admits a second `--dir` after the
+    // first, and pnpm keeps the LAST one — measured, `pnpm --dir packages/cli install --dir
+    // <anywhere> --dry-run` installs at `<anywhere>`, not at `packages/cli`, anywhere on disk
+    // including the main checkout the dispatcher itself runs from. `packages/cli` stays deliberately
+    // not a workspace member (root `CLAUDE.md`, D8), so its one-time `pnpm --dir packages/cli
+    // install` stays a manual, interactive step (`scripts/worktree-link.sh` / the Worktree Gate),
+    // never a standing frontier grant.
+    'Bash(pnpm cli:build:*)',
+    'Bash(node packages/cli/bin/run.js:*)',
     // T-7: each command is TWO rules, an exact form and a with-arguments form, never one rule with
     // a trailing `:*`. Measured (2026-09-07, Claude Code 2.1.263): a Bash rule combining a mid-rule
     // `*` with a trailing `:*` matches NOTHING — `Bash(pnpm --filter * test:*)` never matched
@@ -677,8 +787,27 @@ describe('lanes/frontier.settings.json', () => {
     // assume.
     'Bash(pnpm --filter * db:generate)',
     'Bash(pnpm --filter * db:generate *)',
+    // T-57: `catalyst-schema-migrations`'s own examples use the ROOT form (`pnpm db:check`, `pnpm
+    // db:generate --name ...`), the same gap T-9 closed for `db:query` below — a worker copying the
+    // skill literally would otherwise run a DENIED command. `db:migrate` stays UNGRANTED: it writes.
+    'Bash(pnpm db:generate)',
+    'Bash(pnpm db:generate *)',
     'Bash(pnpm --filter * db:check)',
     'Bash(pnpm --filter * db:check *)',
+    'Bash(pnpm db:check)',
+    'Bash(pnpm db:check *)',
+    // T-9: read-only catalog lookups via `db:query`. Unlike the offline pair above it DOES open a
+    // connection, and only ever runs a single `SELECT`/`WITH` — enforced by the connecting role
+    // (a dedicated non-superuser, the primary control), `validateReadOnlyQuery()` and a READ ONLY
+    // transaction. See `catalyst-schema-migrations`. Both forms are granted because SKILL.md's own
+    // copy-pasteable examples use the ROOT form (`pnpm db:query "<SQL>"`), not the
+    // `--filter` form: a worker following the skill literally would otherwise run a DENIED
+    // command. The root script is a proxy to the same `db:query`, so this adds no reach
+    // beyond the `--filter` form already granted.
+    'Bash(pnpm --filter * db:query)',
+    'Bash(pnpm --filter * db:query *)',
+    'Bash(pnpm db:query)',
+    'Bash(pnpm db:query *)',
   ];
 
   it('ships exactly the explicit allow list, in order — no inheritance, nothing implicit', () => {
@@ -690,10 +819,12 @@ describe('lanes/frontier.settings.json', () => {
    * the dispatcher, however narrow its rule looks: the worker holds `Edit(./**)`/`Write(./**)` over
    * the slot, so `node scripts/x.ts` or `pnpm test:backlog` executes a file it just authored. Same
    * for the git verbs that stage, commit, move a branch or throw work away — the close owns those.
-   * A path-invoked or arbitrary-argument runner has no place in a list that is now hand-maintained.
+   * A path-invoked or arbitrary-argument runner has no place in a list that is now hand-maintained —
+   * with the two NAMED exceptions below, each reasoned about on its own terms.
    */
   const WRITABLE_TREE_RUNNERS: readonly string[] = [
     'pnpm test:',
+    'pnpm cli:',
     'npm ',
     'eslint',
     'fd',
@@ -707,21 +838,87 @@ describe('lanes/frontier.settings.json', () => {
     'git branch',
   ];
 
+  // T-48 (round 3): TWO named exceptions — `node ` and the new `pnpm cli:` prefix above — never a
+  // widened prefix, never a class of exception. `Bash(node packages/cli/bin/run.js:*)` runs the
+  // CLI's entry point; `Bash(pnpm cli:build:*)` runs its `tsc -b` build
+  // (`packages/cli/package.json`'s own `build` script). Both execute whatever the worker has
+  // written into `packages/cli/` by the time either runs.
+  //
+  //   (a) The global `catalyst` binary (`Bash(catalyst:*)` above) is a cmd-shim resolving to a
+  //       globally-LINKED package that is itself a symlink to the MAIN checkout's `packages/cli` —
+  //       so it can never verify a schema/template change the worker made in THIS slot; both
+  //       exceptions are anchored to files inside the slot instead. Running the main checkout's code
+  //       was ALSO a security property — that code the worker cannot edit — and these two exceptions
+  //       trade it away on purpose.
+  //   (b) The exposure is not new, but it is NARROWER than what these two rules grant — a future
+  //       reader must not over-read the precedent. `pnpm cli:test` (bare, no file argument) is an
+  //       accepted `Test command:` grammar (`ALLOWED_TEST_SCRIPT`, `guards.ts`'s
+  //       `resolveTestCommand`) that matches the project's OWN `Bash(pnpm cli:test:*)` rule exactly
+  //       — no permission conflict, unlike the WITH-an-argument form (README's "Test commands that
+  //       conflict with the project allow list") — and that grant already resolves through
+  //       `packages/cli/package.json`'s own `test` script, which this lane already lets the worker
+  //       edit. But that grant is PER LAUNCH, and only when THAT task declared it as its own test
+  //       command; these two rules are PERMANENT on every frontier launch, whatever the task
+  //       declares. Same package, not the same exposure.
+  //   (c) There is no detector for this surface, and the close's scope check is not one. The scope
+  //       check and the PR's human-review mark (`HUMAN_REVIEW_PATHS`) only see VERSIONED files —
+  //       `close.ts`'s `collectChangedFiles` runs `git diff --name-only` and `git status
+  //       --porcelain --untracked-files=all`, neither with `--ignored`. `packages/cli/dist/` is
+  //       gitignored (`packages/cli/.gitignore`), and both exceptions invoke code that loads
+  //       `dist/`, not `src/` — so a worker can write a payload there, run it through either grant,
+  //       and leave a diff with no trace of it: no scope-check hit, no review mark. The grant is
+  //       accepted anyway because the SAME leak already exists via the declared `Test command:`
+  //       (README: "the standing hole this dispatcher has always had") — not because anything here
+  //       contains it. T-49 tracks closing this gap.
+  const WRITABLE_TREE_RUNNER_EXCEPTIONS: readonly string[] = [
+    'Bash(node packages/cli/bin/run.js:*)',
+    'Bash(pnpm cli:build:*)',
+  ];
+
+  it('the writable-tree-runner exceptions are exactly these two, named', () => {
+    assert.deepEqual(WRITABLE_TREE_RUNNER_EXCEPTIONS, [
+      'Bash(node packages/cli/bin/run.js:*)',
+      'Bash(pnpm cli:build:*)',
+    ]);
+  });
+
+  /**
+   * Whether the writable-tree-runner check refuses this ALLOW rule: a Bash rule not in `exceptions`
+   * whose command matches a `WRITABLE_TREE_RUNNERS` prefix. Pulled out of the assertion below so the
+   * "no bad rule ships" test and the "the exceptions stay narrow" test exercise the SAME mechanism —
+   * comparing two literals in the narrowness test alone proved nothing about the real check (T-48
+   * round 3, T2: that version stayed green under both a widened exception list and a widened match).
+   */
+  function refusesRule(rule: string, exceptions: readonly string[]): boolean {
+    if (exceptions.includes(rule)) {
+      return false;
+    }
+    const command = /^Bash\((.*)\)$/.exec(rule)?.[1];
+    if (command === undefined) {
+      return false; // a file or MCP tool rule carries no command to judge.
+    }
+    return WRITABLE_TREE_RUNNERS.some((runner) => command.startsWith(runner));
+  }
+
   it('grants no command that executes, stages or discards anything in the slot', () => {
     for (const rule of settings.permissions?.allow ?? []) {
-      const command = /^Bash\((.*)\)$/.exec(rule)?.[1];
-      if (command === undefined) {
-        continue; // a file or MCP tool rule carries no command to judge.
-      }
-      for (const runner of WRITABLE_TREE_RUNNERS) {
-        assert.ok(
-          !command.startsWith(runner),
-          `${rule} grants ${runner}, which runs or rewrites the slot`,
-        );
-      }
+      assert.ok(
+        !refusesRule(rule, WRITABLE_TREE_RUNNER_EXCEPTIONS),
+        `${rule} runs or rewrites the slot`,
+      );
     }
   });
 
+  // The exceptions above are TWO named rules, never the prefixes reopened: an unrelated rule under
+  // EITHER prefix must still fail the REAL check (`refusesRule`), not a comparison of two literals.
+  it('the exceptions are narrow: an unrelated rule under either prefix still fails the check', () => {
+    assert.equal(
+      refusesRule('Bash(node scripts/whatever-else.js:*)', WRITABLE_TREE_RUNNER_EXCEPTIONS),
+      true,
+    );
+    assert.equal(refusesRule('Bash(pnpm cli:test:*)', WRITABLE_TREE_RUNNER_EXCEPTIONS), true);
+  });
+
   // M1: under `--permission-mode dontAsk` a tool with NO allow rule is denied, and a lane whose
   // list held only `Bash(...)` rules gave the frontier orchestrator no way to open a file, let alone
   // change one: every attempt on this lane would have burned its budget being denied.
@@ -860,12 +1057,15 @@ describe('lanes/frontier.settings.json', () => {
   // That bounds the WORKER's own session and nothing more. The CLOSE does run code from the slot's
   // `scripts/**`: its triad spawns the task's declared `Test command:` with `cwd` = the slot, and
   // `ALLOWED_TEST_SCRIPT` admits `test:backlog`, which the root manifest maps to a runner over
-  // `scripts/backlog/**` — the slot's copies. And a failed attempt's tree is pushed to `task/<id>`
-  // and restored by the retry, so the write outlives the attempt. So a soft-list write to
-  // `scripts/backlog/` is NOT inert; what keeps this allowance proportionate is that the write is
-  // admitted-and-MARKED (`HUMAN_REVIEW_PATHS`, the `harness-review` PR mark, and the soft-list files
-  // named in the `Blocked` comment on the failure path), never admitted silently. Both mechanisms are
-  // measured in design.md decision 1.
+  // `scripts/backlog/**` — the slot's copies. Nothing at the settings layer denies THAT subtree
+  // either, but the DECISION is refused, not just marked: `scripts/backlog/` is supervised-only
+  // (guard 1e, `SUPERVISED_ONLY_PATHS`) — a task that declares it never reaches a slot, and one that
+  // only discovers the need mid-attempt spends its slot for nothing, since `close.ts`'s `checkScope`
+  // refuses the real diff outright, on both lanes. The edit permission stays broad because ordinary
+  // `scripts/**` work (outside `scripts/backlog/`) is unremarkable product tooling the close simply
+  // admits, and a failed attempt's tree is pushed to `task/<id>` and restored by the retry either
+  // way, so a write there — refused or ordinary — outlives the attempt regardless. Measured in
+  // design.md decision 1.
   const FRONTIER_ONLY_ALLOWANCES: readonly string[] = [
     'Edit(.claude/**)',
     'Write(.claude/**)',
@@ -1261,6 +1461,44 @@ describe('settingsAllowRulesToDeny', () => {
   });
 });
 
+// bf7faed9c added `Bash(node packages/cli/bin/run.js:*)` and `Bash(pnpm cli:build:*)` to
+// `.claude/settings.json` ALONE, meaning to let a dispatched worker build and run the generator. It
+// did the opposite: `settingsAllowRulesToDeny` reads a project settings file as the surface to
+// SUBTRACT, never to grant, so a rule that exists only there becomes an EXPLICIT deny for every
+// worker. The fix grants both rules directly in `frontier.settings.json`, so they are covered
+// rather than subtracted. A third rule, `Bash(pnpm --dir packages/cli install:*)`, was proposed and
+// then dropped (round 3, S1) — see the `GENERATOR_RULES` comment below.
+//
+// FRONTIER ONLY. The local lane was considered and refused: `lane:local` accepts `tier:minor`
+// only, and the Task-Weight Triage's own definition of Minor is "NO catalyst CLI run" — a task
+// dispatched on `lane:local` therefore never legitimately needs the generator, while granting it
+// there would have reintroduced a standing `pnpm` rule the local lane deliberately carries none of
+// (H8, `launch.test.ts`'s `grants no standing pnpm rule` test).
+describe('the generator build/run rules reach the frontier lane (T-48)', () => {
+  const projectAllow = loadSettingsAllowRules([
+    {
+      source: 'project',
+      path: path.join(import.meta.dirname, '..', '..', '.claude', 'settings.json'),
+    },
+  ]);
+  // `Bash(pnpm --dir packages/cli install:*)` was dropped (round 3, S1): its `:*` suffix admits a
+  // second `--dir` after the first, and pnpm keeps the LAST one, so the rule granted `pnpm install`
+  // at ANY path, not just `packages/cli`.
+  const GENERATOR_RULES = ['Bash(pnpm cli:build:*)', 'Bash(node packages/cli/bin/run.js:*)'];
+
+  it('grants and never denies the generator rules on the frontier lane', () => {
+    const settings = JSON.parse(
+      fs.readFileSync(path.join(import.meta.dirname, 'lanes', 'frontier.settings.json'), 'utf8'),
+    ) as { permissions?: { allow?: string[] } };
+    const laneAllow = settings.permissions?.allow ?? [];
+    const composed = settingsAllowRulesToDeny(projectAllow, laneAllow);
+    for (const rule of GENERATOR_RULES) {
+      assert.ok(laneAllow.includes(rule), `frontier lane must grant ${rule}`);
+      assert.ok(!composed.includes(rule), `frontier lane composition must not deny ${rule}`);
+    }
+  });
+});
+
 describe('the shipped .claude/settings.json against the shipped frontier lane file', () => {
   // The repo's own file only. The other source this lane loads (the USER file — the overlay is not a
   // source at all) is machine-local, so an assertion over it would test the machine, not the repo —
@@ -1298,12 +1536,15 @@ describe('the shipped .claude/settings.json against the shipped frontier lane fi
     }
   });
 
-  // The whole subtraction over the two shipped files, as a list rather than as a property: these 12
+  // The whole subtraction over the two shipped files, as a list rather than as a property: these 14
   // rules are the ONLY ones the lane already grants (five read-only git verbs it names identically,
   // the four `openspec` and two `catalyst origin` rules its own `Bash(openspec:*)`/`Bash(catalyst:*)`
-  // cover, and `pnpm --filter aurora-back test` under `Bash(pnpm --filter * test)`). Every other
-  // project rule is denied. Add a rule to either file and this list is what tells you which side it
-  // landed on.
+  // cover, the two generator build/run rules `frontier.settings.json` now grants directly (T-48;
+  // the third, `install`, was dropped — round 3, S1), and `pnpm --filter aurora-back test` under
+  // `Bash(pnpm --filter * test)`). Every other project rule is denied. Add a rule to either file and
+  // this list is what tells you which side it landed on — and a rule added to `.claude/settings.json`
+  // ALONE lands on the denied side, since the subtraction reads that file as the surface to take
+  // away, never as one to grant.
   it('leaves granted exactly the project rules the lane covers, and denies the other 30', () => {
     const composed = settingsAllowRulesToDeny(projectAllow, frontierAllow);
     assert.deepEqual(
@@ -1320,6 +1561,8 @@ describe('the shipped .claude/settings.json against the shipped frontier lane fi
         'Bash(openspec instructions:*)',
         'Bash(catalyst origin list:*)',
         'Bash(catalyst origin diff:*)',
+        'Bash(node packages/cli/bin/run.js:*)',
+        'Bash(pnpm cli:build:*)',
         'Bash(pnpm --filter aurora-back test:*)',
       ],
     );
@@ -1547,7 +1790,94 @@ describe('buildLaunch', () => {
       CLAUDE_PROJECT_DIR: slot.path,
       ANTHROPIC_BASE_URL: 'http://localhost:1234',
       ANTHROPIC_AUTH_TOKEN: 'lmstudio',
+      CLAUDE_CODE_DISABLE_BACKGROUND_TASKS: '1',
+    });
+  });
+
+  // See HEADLESS_FORCED_ENV's own JSDoc in launch.ts for why this is forced.
+  it('wins over a lane env that tries to turn it back off on the local lane', () => {
+    const launch = buildLaunch({
+      task: baseTask(),
+      lane: 'local',
+      settingsAllow: [],
+      slot,
+      attempt: 1,
+      prompt: 'p',
+      laneProfile: localProfile,
+      settings: {
+        ...localSettings,
+        env: { ...localSettings.env, CLAUDE_CODE_DISABLE_BACKGROUND_TASKS: '0' },
+      },
+      mainCheckoutPath: '/repo',
+      workerSystemPromptPath:
+        '/Users/carlos/Projects/aurora/aurora-catalyst/.claude/skills/catalyst-backlog/worker-system-prompt.md',
+    });
+
+    assert.equal(launch.env.CLAUDE_CODE_DISABLE_BACKGROUND_TASKS, '1');
+  });
+
+  // T-61: `qwen/qwen3.8-27b` is unknown to Claude Code, so it assumes a 200k-token window and
+  // auto-compacts against that number — 2.5x the 80896 tokens LM Studio actually has loaded
+  // (`lms ps`), so the session is let to grow past what the server accepts, and the failure lands
+  // mid-attempt. `local.settings.json`'s `env` block is the one place a key reaches the worker
+  // (`spawnWorker` strips the parent's inherited `CLAUDE_CODE_*` keys and keeps only the lane's OWN
+  // overlay), so this test reads the SHIPPED file and asserts the composed launch env carries the
+  // key — a later edit that drops it from the file fails here, not just in a hand-rolled fixture.
+  it('carries CLAUDE_CODE_MAX_CONTEXT_TOKENS from the shipped local.settings.json into the composed launch env', () => {
+    const shippedSettings = JSON.parse(
+      fs.readFileSync(path.join(import.meta.dirname, 'lanes', 'local.settings.json'), 'utf8'),
+    ) as LocalLaneSettings;
+
+    const launch = buildLaunch({
+      task: baseTask(),
+      lane: 'local',
+      settingsAllow: [],
+      slot,
+      attempt: 1,
+      prompt: 'assembled prompt text',
+      laneProfile: localProfile,
+      settings: shippedSettings,
+      mainCheckoutPath: '/Users/carlos/Projects/aurora/aurora-catalyst',
+      workerSystemPromptPath:
+        '/Users/carlos/Projects/aurora/aurora-catalyst/.claude/skills/catalyst-backlog/worker-system-prompt.md',
+    });
+
+    assert.ok(
+      'CLAUDE_CODE_MAX_CONTEXT_TOKENS' in launch.env,
+      'the composed launch env must carry CLAUDE_CODE_MAX_CONTEXT_TOKENS',
+    );
+    // The value must leave room for the max_tokens reservation (32000, measured on the wire) inside
+    // the 80896-token loaded context — declaring the bare 80896 would let input plus that
+    // reservation exceed what the server actually accepts.
+    assert.equal(launch.env.CLAUDE_CODE_MAX_CONTEXT_TOKENS, '48896');
+  });
+
+  // A slot's backend boot runs the task's `Test command:` — on this lane, potentially a
+  // `test:e2e` script that starts the backend against the SHARED dev database. Without this key
+  // the boot would apply an unreviewed branch's pending migrations to that database; applying
+  // migrations stays a human step (see `scripts/backlog/README.md` — Lane profiles). Reads the
+  // SHIPPED file for the same reason the CLAUDE_CODE_MAX_CONTEXT_TOKENS test above does: a later
+  // edit that drops the key from the file fails here, not just in a hand-rolled fixture.
+  it('carries DATABASE_MIGRATE_ON_BOOT=false from the shipped local.settings.json into the composed launch env', () => {
+    const shippedSettings = JSON.parse(
+      fs.readFileSync(path.join(import.meta.dirname, 'lanes', 'local.settings.json'), 'utf8'),
+    ) as LocalLaneSettings;
+
+    const launch = buildLaunch({
+      task: baseTask(),
+      lane: 'local',
+      settingsAllow: [],
+      slot,
+      attempt: 1,
+      prompt: 'assembled prompt text',
+      laneProfile: localProfile,
+      settings: shippedSettings,
+      mainCheckoutPath: '/Users/carlos/Projects/aurora/aurora-catalyst',
+      workerSystemPromptPath:
+        '/Users/carlos/Projects/aurora/aurora-catalyst/.claude/skills/catalyst-backlog/worker-system-prompt.md',
     });
+
+    assert.equal(launch.env.DATABASE_MIGRATE_ON_BOOT, 'false');
   });
 
   it('emits the lane settings deny list as --disallowedTools, right after --allowedTools', () => {
@@ -1909,9 +2239,55 @@ describe('buildLaunch', () => {
       BACKLOG_CWD: '/Users/carlos/Projects/aurora/aurora-catalyst',
       BACKLOG_TASK_ID: 'T-1',
       CLAUDE_PROJECT_DIR: slot.path,
+      CLAUDE_CODE_DISABLE_BACKGROUND_TASKS: '1',
     });
   });
 
+  // See HEADLESS_FORCED_ENV's own JSDoc in launch.ts for why this is forced.
+  it('wins over a lane env that tries to turn it back off on the frontier lane', () => {
+    const launch = buildLaunch({
+      task: baseTask({ lane: LANE.FRONTIER, path: EXECUTION_PATH.DIRECT }),
+      lane: 'frontier',
+      settingsAllow: NO_LOADED_SETTINGS,
+      workerSystemPromptPath: FRONTIER_ADDENDUM_PATH,
+      slot: { ...slot, lane: LANE.FRONTIER },
+      attempt: 1,
+      prompt: 'trabajemos T-1',
+      laneProfile: frontierProfile,
+      settings: { ...frontierSettings, env: { CLAUDE_CODE_DISABLE_BACKGROUND_TASKS: '0' } },
+      mainCheckoutPath: '/Users/carlos/Projects/aurora/aurora-catalyst',
+      model: 'sonnet',
+    });
+
+    assert.equal(launch.env.CLAUDE_CODE_DISABLE_BACKGROUND_TASKS, '1');
+  });
+
+  // Mirrors the local-lane test above: the frontier lane dispatches Medium/Complex work too, and a
+  // slot's backend boot must never apply an unreviewed branch's migrations to the shared dev
+  // database on this lane either. Reads the SHIPPED file so a later edit that drops the key fails
+  // here.
+  it('carries DATABASE_MIGRATE_ON_BOOT=false from the shipped frontier.settings.json into the composed launch env', () => {
+    const shippedSettings = JSON.parse(
+      fs.readFileSync(path.join(import.meta.dirname, 'lanes', 'frontier.settings.json'), 'utf8'),
+    ) as FrontierLaneSettings;
+
+    const launch = buildLaunch({
+      task: baseTask({ lane: LANE.FRONTIER, path: EXECUTION_PATH.DIRECT }),
+      lane: 'frontier',
+      settingsAllow: NO_LOADED_SETTINGS,
+      workerSystemPromptPath: FRONTIER_ADDENDUM_PATH,
+      slot: { ...slot, lane: LANE.FRONTIER },
+      attempt: 1,
+      prompt: 'trabajemos T-1',
+      laneProfile: frontierProfile,
+      settings: shippedSettings,
+      mainCheckoutPath: '/Users/carlos/Projects/aurora/aurora-catalyst',
+      model: 'sonnet',
+    });
+
+    assert.equal(launch.env.DATABASE_MIGRATE_ON_BOOT, 'false');
+  });
+
   // T-3: a claude.ai subscription login is not billed per token, so a profile with no
   // `maxBudgetUsd` (this machine's shipped lanes.json, since the fix) must not emit a flag Claude
   // Code cannot parse (`--max-budget-usd undefined`) — it must emit no flag at all.