@frankzhang2026/opencode-android-orchestrator 0.3.0 → 0.5.0

package/templates/scripts/automation/lib.sh

@@ -47,6 +47,9 @@ AUTOMATION_STATE_DIR="$AUTOMATION_RUNTIME_ROOT/state"
 AUTOMATION_EVIDENCE_DIR="$AUTOMATION_RUNTIME_ROOT/evidence"
 AUTOMATION_LOCKS_DIR="$AUTOMATION_RUNTIME_ROOT/locks"
 AUTOMATION_WORKSPACES_DIR="$AUTOMATION_RUNTIME_ROOT/workspaces"
+AUTOMATION_WORKTREE_ALLOWLIST_RELATIVE_PATH=".automation-worktree-allowlist"
+AUTOMATION_WORKTREE_ALLOWLIST_MAX_BYTES=65536
+AUTOMATION_WORKTREE_ALLOWLIST_MAX_ENTRIES=256
 
 automation_info() {
     printf '[automation] %s\n' "$*"
@@ -383,12 +386,235 @@ automation_array_matches_path() {
     return 1
 }
 
+automation_validate_worktree_allowlist_entry_at() {
+    local root="$1"
+    local path="$2"
+    local config_file="$root/automation/config.json"
+    local protected
+
+    if [[ -z "$path" ]]; then
+        automation_die "worktree allowlist entries must not be empty"
+        return 1
+    fi
+    if [[ "$path" == [[:space:]]* || "$path" == *[[:space:]] ]]; then
+        automation_die "worktree allowlist entries must not have leading or trailing whitespace: $path"
+        return 1
+    fi
+    case "$path" in
+        *[[:cntrl:]]*|*'\\'*)
+            automation_die "worktree allowlist entries must use plain repository-relative paths: $path"
+            return 1
+            ;;
+        *'*'*|*'?'*|*'['*|*']'*)
+            automation_die "worktree allowlist entries must be exact file paths, not patterns: $path"
+            return 1
+            ;;
+    esac
+    case "/$path/" in
+        *'//'*|*'/./'*|*'/../'*)
+            automation_die "worktree allowlist entries must be normalized repository-relative paths: $path"
+            return 1
+            ;;
+    esac
+    case "$path" in
+        /*|./*|.|..|.git|.git/*|docs/plans|docs/plans/*|"$AUTOMATION_WORKTREE_ALLOWLIST_RELATIVE_PATH")
+            automation_die "worktree allowlist entry is reserved or unsafe: $path"
+            return 1
+            ;;
+    esac
+    if [[ -d "$root/$path" ]]; then
+        automation_die "worktree allowlist entries must identify files, not directories: $path"
+        return 1
+    fi
+
+    if [[ ! -f "$config_file" ]]; then
+        automation_die "missing automation configuration while validating worktree allowlist: $config_file"
+        return 1
+    fi
+    if ! jq -e '.protectedPaths | type == "array" and all(.[]; type == "string" and length > 0)' \
+        "$config_file" >/dev/null; then
+        automation_die "automation protectedPaths are invalid while validating the worktree allowlist"
+        return 1
+    fi
+    while IFS= read -r protected; do
+        if automation_path_matches "$path" "$protected"; then
+            automation_die "worktree allowlist must not include a protected path: $path"
+            return 1
+        fi
+    done < <(jq -r '.protectedPaths[]' "$config_file")
+    return 0
+}
+
+automation_worktree_allowlist_file_entries_at() {
+    local root="$1"
+    local allowlist_file="$root/$AUTOMATION_WORKTREE_ALLOWLIST_RELATIVE_PATH"
+    local byte_count line existing
+    local entry_count=0
+    local -a entries=()
+
+    if [[ ! -e "$allowlist_file" && ! -L "$allowlist_file" ]]; then
+        return 0
+    fi
+    if [[ -L "$allowlist_file" || ! -f "$allowlist_file" ]]; then
+        automation_die "worktree allowlist must be a regular file, not a symlink: $allowlist_file"
+        return 1
+    fi
+    byte_count="$(wc -c < "$allowlist_file" | tr -d '[:space:]')"
+    if [[ ! "$byte_count" =~ ^[0-9]+$ ]] || \
+       [[ "$byte_count" -gt "$AUTOMATION_WORKTREE_ALLOWLIST_MAX_BYTES" ]]; then
+        automation_die "worktree allowlist exceeds $AUTOMATION_WORKTREE_ALLOWLIST_MAX_BYTES bytes: $allowlist_file"
+        return 1
+    fi
+
+    while IFS= read -r line || [[ -n "$line" ]]; do
+        line="${line%$'\r'}"
+        [[ -n "$line" && "$line" != \#* ]] || continue
+        automation_validate_worktree_allowlist_entry_at "$root" "$line" || return 1
+        if [[ "$entry_count" -gt 0 ]]; then
+            for existing in "${entries[@]}"; do
+                if [[ "$existing" == "$line" ]]; then
+                    automation_die "duplicate worktree allowlist entry: $line"
+                    return 1
+                fi
+            done
+        fi
+        entry_count=$((entry_count + 1))
+        if [[ "$entry_count" -gt "$AUTOMATION_WORKTREE_ALLOWLIST_MAX_ENTRIES" ]]; then
+            automation_die "worktree allowlist exceeds $AUTOMATION_WORKTREE_ALLOWLIST_MAX_ENTRIES entries"
+            return 1
+        fi
+        entries[${#entries[@]}]="$line"
+    done < "$allowlist_file"
+
+    if [[ "$entry_count" -gt 0 ]]; then
+        for line in "${entries[@]}"; do
+            printf '%s\n' "$line"
+        done
+    fi
+    return 0
+}
+
+automation_worktree_allowlist_entries_json() {
+    local entries="$1"
+    if [[ -z "$entries" ]]; then
+        printf '[]\n'
+    else
+        printf '%s\n' "$entries" | jq -Rsc 'split("\n") | map(select(length > 0))'
+    fi
+}
+
+automation_worktree_allowlist_file_json_at() {
+    local root="$1"
+    local entries
+    entries="$(automation_worktree_allowlist_file_entries_at "$root")" || return 1
+    automation_worktree_allowlist_entries_json "$entries"
+}
+
+automation_effective_worktree_allowlist_entries_at() {
+    local root="$1"
+    local resolved_root
+    local lease_file="$AUTOMATION_LOCKS_DIR/repository.workspace.lease/lease.json"
+    local task_id workspace_file source_root task_root resolved_source resolved_task entry
+
+    resolved_root="$(cd "$root" && pwd -P)" || {
+        automation_die "unable to resolve worktree root for allowlist: $root"
+        return 1
+    }
+    if [[ -f "$lease_file" ]]; then
+        task_id="$(jq -er '.taskId' "$lease_file")" || {
+            automation_die "repository lease is invalid while resolving the worktree allowlist"
+            return 1
+        }
+        workspace_file="$(automation_workspace_path "$task_id")"
+        if [[ -f "$workspace_file" ]] && jq -e 'has("worktreeAllowlist")' "$workspace_file" >/dev/null; then
+            jq -e \
+                --argjson max "$AUTOMATION_WORKTREE_ALLOWLIST_MAX_ENTRIES" \
+                '.worktreeAllowlist as $entries |
+                 ($entries | type == "array") and
+                 ($entries | length <= $max) and
+                 ($entries | length == (unique | length)) and
+                 all($entries[]; type == "string" and length > 0)' \
+                "$workspace_file" >/dev/null || {
+                    automation_die "workspace worktreeAllowlist snapshot is invalid: $workspace_file"
+                    return 1
+                }
+            source_root="$(jq -er '.sourceRoot' "$workspace_file")" || return 1
+            task_root="$(automation_workspace_task_root "$workspace_file")" || return 1
+            resolved_source="$(cd "$source_root" 2>/dev/null && pwd -P || true)"
+            resolved_task="$(cd "$task_root" 2>/dev/null && pwd -P || true)"
+            if [[ "$resolved_root" == "$resolved_source" ]]; then
+                while IFS= read -r entry; do
+                    [[ -n "$entry" ]] || continue
+                    automation_validate_worktree_allowlist_entry_at "$root" "$entry" || return 1
+                    printf '%s\n' "$entry"
+                done < <(jq -r '.worktreeAllowlist[]' "$workspace_file")
+                return 0
+            fi
+            if [[ "$resolved_root" == "$resolved_task" ]]; then
+                return 0
+            fi
+        fi
+    fi
+
+    automation_worktree_allowlist_file_entries_at "$root"
+}
+
+automation_effective_worktree_allowlist_json_at() {
+    local root="$1"
+    local entries
+    entries="$(automation_effective_worktree_allowlist_entries_at "$root")" || return 1
+    automation_worktree_allowlist_entries_json "$entries"
+}
+
+automation_worktree_path_is_allowlisted() {
+    local path="$1"
+    local entries="$2"
+    local entry
+
+    [[ "$path" == "$AUTOMATION_WORKTREE_ALLOWLIST_RELATIVE_PATH" ]] && return 0
+    while IFS= read -r entry; do
+        [[ -n "$entry" ]] || continue
+        [[ "$path" == "$entry" ]] && return 0
+    done <<< "$entries"
+    return 1
+}
+
+automation_filter_worktree_paths_at() {
+    local root="$1"
+    local paths="$2"
+    local allowlist path
+
+    allowlist="$(automation_effective_worktree_allowlist_entries_at "$root")" || return 1
+    while IFS= read -r path; do
+        [[ -n "$path" ]] || continue
+        if ! automation_worktree_path_is_allowlisted "$path" "$allowlist"; then
+            printf '%s\n' "$path"
+        fi
+    done <<< "$paths"
+    return 0
+}
+
+automation_tracked_changed_paths_at() {
+    local root="$1"
+    local paths
+    paths="$(git -C "$root" diff --no-renames --name-only HEAD -- | LC_ALL=C sort -u)" || return 1
+    automation_filter_worktree_paths_at "$root" "$paths"
+}
+
+automation_untracked_paths_at() {
+    local root="$1"
+    local paths
+    paths="$(git -C "$root" ls-files --others --exclude-standard | LC_ALL=C sort -u)" || return 1
+    automation_filter_worktree_paths_at "$root" "$paths"
+}
+
 automation_changed_paths_at() {
     local root="$1"
-    {
-        git -C "$root" diff --name-only HEAD --
-        git -C "$root" ls-files --others --exclude-standard
-    } | LC_ALL=C sort -u
+    local tracked untracked
+
+    tracked="$(automation_tracked_changed_paths_at "$root")" || return 1
+    untracked="$(automation_untracked_paths_at "$root")" || return 1
+    printf '%s\n%s\n' "$tracked" "$untracked" | awk 'NF' | LC_ALL=C sort -u
 }
 
 automation_changed_paths() {
@@ -461,20 +687,71 @@ automation_changed_paths_between() {
 
 automation_worktree_diff_sha() {
     local root="${1:-$AUTOMATION_ROOT}"
-    local path
+    local tracked_paths untracked_paths path
+    tracked_paths="$(automation_tracked_changed_paths_at "$root")" || return 1
+    untracked_paths="$(automation_untracked_paths_at "$root")" || return 1
     {
-        git -C "$root" diff --binary HEAD --
+        while IFS= read -r path; do
+            [[ -n "$path" ]] || continue
+            git -C "$root" diff --binary --no-renames HEAD -- "$path"
+        done <<< "$tracked_paths"
         while IFS= read -r path; do
             [[ -n "$path" ]] || continue
             printf 'UNTRACKED %s\0' "$path"
             git -C "$root" hash-object -- "$path"
-        done < <(git -C "$root" ls-files --others --exclude-standard | LC_ALL=C sort)
+        done <<< "$untracked_paths"
     } | shasum -a 256 | awk '{print $1}'
 }
 
+automation_worktree_diff_stat_at() {
+    local root="${1:-$AUTOMATION_ROOT}"
+    local tracked_paths path
+    local -a paths=()
+
+    tracked_paths="$(automation_tracked_changed_paths_at "$root")" || return 1
+    while IFS= read -r path; do
+        [[ -n "$path" ]] && paths[${#paths[@]}]="$path"
+    done <<< "$tracked_paths"
+    if [[ "${#paths[@]}" -gt 0 ]]; then
+        git -C "$root" diff --stat --no-renames HEAD -- "${paths[@]}"
+    fi
+    return 0
+}
+
+automation_worktree_patch_at() {
+    local root="${1:-$AUTOMATION_ROOT}"
+    local tracked_paths untracked_paths path
+
+    tracked_paths="$(automation_tracked_changed_paths_at "$root")" || return 1
+    untracked_paths="$(automation_untracked_paths_at "$root")" || return 1
+    while IFS= read -r path; do
+        [[ -n "$path" ]] || continue
+        git -C "$root" diff --binary --no-renames HEAD -- "$path"
+    done <<< "$tracked_paths"
+    while IFS= read -r path; do
+        [[ -n "$path" ]] || continue
+        git -C "$root" diff --binary --no-index -- /dev/null "$root/$path" || [[ "$?" -eq 1 ]]
+    done <<< "$untracked_paths"
+    return 0
+}
+
+automation_worktree_status_at() {
+    local root="${1:-$AUTOMATION_ROOT}"
+    local changed_paths path
+
+    changed_paths="$(automation_changed_paths_at "$root")" || return 1
+    printf 'branch %s\n' "$(automation_current_branch "$root")"
+    while IFS= read -r path; do
+        [[ -n "$path" ]] && printf 'changed %s\n' "$path"
+    done <<< "$changed_paths"
+    return 0
+}
+
 automation_worktree_is_clean() {
     local root="${1:-$AUTOMATION_ROOT}"
-    [[ -z "$(git -C "$root" status --porcelain --untracked-files=all)" ]]
+    local changed_paths
+    changed_paths="$(automation_changed_paths_at "$root")" || return 1
+    [[ -z "$changed_paths" ]]
 }
 
 automation_create_lock_dir() {

package/templates/scripts/automation/orchestrate-task.sh

@@ -86,7 +86,7 @@ for _step in 1 2 3 4 5 6 7 8; do
             if [[ -f "$agent_runs" ]]; then
                 review_attempt="$(jq -s --argjson cycle "$review_cycle" '[.[] | select(.role == "scheduled-reviewer" and .cycle == $cycle)] | length' "$agent_runs")"
             fi
-            reviewer_prompt="Use \$scheduled-quality-reviewer with $task_id. This is fresh, non-interactive, read-only review attempt $review_attempt for sealed review cycle $review_cycle. Work within the step budget. Run exactly ./scripts/automation/status.sh $task_id once; its JSON already includes baseline, RED, ready, latest gate, current diff SHA, and the sealed-SHA comparison, so do not browse the external evidence directory. Then inspect the approved contract and run exactly git diff. Submit exactly one decision. Do not browse generated build reports, list the whole repository, retry denied command variants, or run Gradle commands separately before deciding: submit-review.sh performs and records the focused tests, full unit suite, assembleDebug, and lint for APPROVED. Reserve a tool call for submit-review.sh. Never edit, commit, merge, or push."
+            reviewer_prompt="Use \$scheduled-quality-reviewer with $task_id. This is fresh, non-interactive, read-only review attempt $review_attempt for sealed review cycle $review_cycle. Work within the step budget. Run exactly ./scripts/automation/status.sh $task_id once; its JSON already includes baseline, RED, ready, latest gate, current diff SHA, the sealed-SHA comparison, and runtime.effectiveWorktreeAllowlist, so do not browse the external evidence directory. Then inspect the approved contract and run exactly git diff, excluding the control file and every exact path in that effective list from review findings. Submit exactly one decision. Do not browse generated build reports, list the whole repository, retry denied command variants, or run Gradle commands separately before deciding: submit-review.sh performs and records the focused tests, full unit suite, assembleDebug, and lint for APPROVED. Reserve a tool call for submit-review.sh. Never edit, commit, merge, or push."
             run_agent scheduled-reviewer "$reviewer_prompt" "$review_cycle" "$review_attempt" || true
             if [[ "$(automation_read_state "$task_id")" == "REVIEWING" ]]; then
                 automation_transition_state "$task_id" "REVIEWING" "BLOCKED" "orchestrator" "reviewer exited without submitting a decision; sealed diff preserved for reviewer-only recovery"

package/templates/scripts/automation/scope-gate.sh

@@ -64,12 +64,13 @@ while IFS= read -r path; do
 done <<< "$changed_file_list"
 
 deleted_tests="$(
-    git -C "$AUTOMATION_ROOT" diff --name-only --diff-filter=D HEAD -- \
-        | while IFS= read -r path; do
-            if automation_array_matches_path "$AUTOMATION_CONFIG" '.androidProject.testPaths' "$path"; then
-                printf '%s\n' "$path"
-            fi
-        done
+    while IFS= read -r path; do
+        [[ -n "$path" ]] || continue
+        if [[ -n "$(git -C "$AUTOMATION_ROOT" diff --no-renames --name-only --diff-filter=D HEAD -- "$path")" ]] && \
+           automation_array_matches_path "$AUTOMATION_CONFIG" '.androidProject.testPaths' "$path"; then
+            printf '%s\n' "$path"
+        fi
+    done <<< "$changed_file_list"
 )"
 [[ -z "$deleted_tests" ]] || { automation_die "test deletion is forbidden: $deleted_tests"; exit 40; }
 
@@ -83,7 +84,7 @@ added_test_lines="$(
     while IFS= read -r path; do
         [[ -n "$path" ]] || continue
         if automation_array_matches_path "$AUTOMATION_CONFIG" '.androidProject.testPaths' "$path"; then
-            git -C "$AUTOMATION_ROOT" diff --unified=0 HEAD -- "$path"
+            git -C "$AUTOMATION_ROOT" diff --no-renames --unified=0 HEAD -- "$path"
         fi
     done <<< "$changed_file_list" \
         | awk '/^\+\+\+/ { next } /^\+/ { sub(/^\+/, ""); print }'
@@ -95,12 +96,14 @@ if printf '%s\n' "$added_test_lines" | rg -n "$weakening_pattern" >/dev/null; th
 fi
 
 while IFS= read -r untracked_test; do
-    if automation_array_matches_path "$AUTOMATION_CONFIG" '.androidProject.testPaths' "$untracked_test" && \
+    [[ -n "$untracked_test" ]] || continue
+    if ! git -C "$AUTOMATION_ROOT" ls-files --error-unmatch -- "$untracked_test" >/dev/null 2>&1 && \
+       automation_array_matches_path "$AUTOMATION_CONFIG" '.androidProject.testPaths' "$untracked_test" && \
         rg -n "$weakening_pattern" "$AUTOMATION_ROOT/$untracked_test" >/dev/null; then
         automation_die "potential test weakening detected in new test: $untracked_test"
         exit 40
     fi
-done < <(git -C "$AUTOMATION_ROOT" ls-files --others --exclude-standard)
+done <<< "$changed_file_list"
 
 if [[ "$planning_commit_policy" == "withProductChanges" ]]; then
     automation_info "scope gate passed ($changed_count product files; sealed planning artifacts excluded from the contract limit)"

package/templates/scripts/automation/status.sh

@@ -33,6 +33,7 @@ if [[ "$ready_json" != "null" ]]; then
 fi
 
 current_diff_sha=""
+effective_worktree_allowlist_json='[]'
 lease_json=null
 lease_matches=null
 original_head_current=""
@@ -41,6 +42,7 @@ task_branch_exists=null
 if [[ "$workspace_json" != "null" ]]; then
     task_root="$(jq -r '.taskRoot // .taskWorktree // empty' <<< "$workspace_json")"
     if [[ -n "$task_root" && -d "$task_root" ]]; then
+        effective_worktree_allowlist_json="$(automation_effective_worktree_allowlist_json_at "$task_root")"
         current_diff_sha="$(automation_worktree_diff_sha "$task_root")"
     fi
     source_root="$(jq -r '.sourceRoot // empty' <<< "$workspace_json")"
@@ -97,6 +99,7 @@ jq -n \
     --argjson repositoryLease "$lease_json" \
     --argjson repositoryLeaseMatches "$lease_matches" \
     --argjson taskBranchExists "$task_branch_exists" \
+    --argjson effectiveWorktreeAllowlist "$effective_worktree_allowlist_json" \
     --arg originalHeadCurrent "$original_head_current" \
     --argjson originalBranchDrifted "$original_branch_drifted" \
     --arg evidence "$evidence_dir" \
@@ -106,6 +109,7 @@ jq -n \
         repositoryLease: $repositoryLease,
         repositoryLeaseMatches: $repositoryLeaseMatches,
         taskBranchExists: $taskBranchExists,
+        effectiveWorktreeAllowlist: $effectiveWorktreeAllowlist,
         originalHeadCurrent: ($originalHeadCurrent | if length == 0 then null else . end),
         originalBranchDrifted: $originalBranchDrifted
       },

package/templates/scripts/automation/tests/run-tests.sh

@@ -82,6 +82,7 @@ write_workspace() {
 mkdir -p \
     "$fixture/automation/tasks" \
     "$fixture/docs/plans" \
+    "$fixture/local" \
     "$fixture/scripts/automation" \
     "$fixture/mobile-client/src/main/java/dev/example/orchestratorfixture" \
     "$fixture/mobile-client/src/test/java/dev/example/orchestratorfixture"
@@ -89,6 +90,8 @@ mkdir -p \
 cp "$SOURCE_SCRIPT_DIR"/*.sh "$fixture/scripts/automation/"
 chmod +x "$fixture/scripts/automation/"*.sh
 printf '%s\n' '# Approved test plan' > "$fixture/docs/plans/TASK-TEST-001.md"
+printf '%s\n' 'operator baseline' > "$fixture/local/operator-note.txt"
+printf '%s\n' 'rename baseline' > "$fixture/local/rename-source.txt"
 printf '%s\n' 'class ExistingFeature' > "$fixture/mobile-client/src/main/java/dev/example/orchestratorfixture/ExistingFeature.kt"
 
 printf '%s\n' \
@@ -166,6 +169,7 @@ jq -n '{
         ]
     },
     protectedPaths: [
+        ".automation-worktree-allowlist",
         ".opencode/",
         ".automation-plugin/",
         "automation/",
@@ -200,6 +204,7 @@ jq -n '{
         "mobile-client/src/test/java/dev/example/orchestratorfixture/**"
     ],
     forbiddenPaths: [
+        ".automation-worktree-allowlist",
         ".opencode/**",
         ".automation-plugin/**",
         "automation/**",
@@ -243,6 +248,74 @@ jq -n '{
     git commit -qm 'Create automation fixture'
 )
 
+printf '%s\n' \
+    '# Exact repository-relative paths intentionally kept local' \
+    'local/operator-note.txt' \
+    'local/generated-note.txt' \
+    > "$fixture/.automation-worktree-allowlist"
+printf '%s\n' 'operator local edit' > "$fixture/local/operator-note.txt"
+printf '%s\n' 'generated local state' > "$fixture/local/generated-note.txt"
+run_fixture ./scripts/automation/preflight.sh --source >/dev/null
+allowlisted_changes="$(run_fixture bash -c 'source ./scripts/automation/lib.sh; automation_changed_paths')"
+[[ -z "$allowlisted_changes" ]] || fail "allowlisted paths remained visible: $allowlisted_changes"
+
+printf '%s\n' \
+    'local/operator-note.txt' \
+    'local/generated-note.txt' \
+    'local/rename-target.txt' \
+    > "$fixture/.automation-worktree-allowlist"
+git -C "$fixture" mv local/rename-source.txt local/rename-target.txt
+rename_changes="$(run_fixture bash -c 'source ./scripts/automation/lib.sh; automation_changed_paths')"
+[[ "$rename_changes" == "local/rename-source.txt" ]] || \
+    fail "an allowlisted rename target hid its non-allowlisted source: $rename_changes"
+git -C "$fixture" mv local/rename-target.txt local/rename-source.txt
+printf '%s\n' \
+    '# Exact repository-relative paths intentionally kept local' \
+    'local/operator-note.txt' \
+    'local/generated-note.txt' \
+    > "$fixture/.automation-worktree-allowlist"
+pass 'exact tracked and untracked entries are ignored without hiding rename sources'
+
+printf '%s\n' 'must still block' > "$fixture/unapproved-change.txt"
+if run_fixture ./scripts/automation/preflight.sh --source >/dev/null 2>&1; then
+    fail 'preflight ignored a path that was not allowlisted'
+fi
+rm "$fixture/unapproved-change.txt"
+pass 'a non-allowlisted worktree change still blocks orchestration startup'
+
+printf '%s\n' 'automation/config.json' > "$fixture/.automation-worktree-allowlist"
+if run_fixture bash -c 'source ./scripts/automation/lib.sh; automation_changed_paths >/dev/null' 2>/dev/null; then
+    fail 'worktree allowlist accepted a protected automation path'
+fi
+printf '%s\n' 'local/*.json' > "$fixture/.automation-worktree-allowlist"
+if run_fixture bash -c 'source ./scripts/automation/lib.sh; automation_changed_paths >/dev/null' 2>/dev/null; then
+    fail 'worktree allowlist accepted a glob pattern'
+fi
+printf '%s\n' 'local' > "$fixture/.automation-worktree-allowlist"
+if run_fixture bash -c 'source ./scripts/automation/lib.sh; automation_changed_paths >/dev/null' 2>/dev/null; then
+    fail 'worktree allowlist accepted a directory path'
+fi
+printf '%s\n' 'local/operator-note.txt' 'local/operator-note.txt' > "$fixture/.automation-worktree-allowlist"
+if run_fixture bash -c 'source ./scripts/automation/lib.sh; automation_changed_paths >/dev/null' 2>/dev/null; then
+    fail 'worktree allowlist accepted duplicate entries'
+fi
+printf '%s\n' '../outside.txt' > "$fixture/.automation-worktree-allowlist"
+if run_fixture bash -c 'source ./scripts/automation/lib.sh; automation_changed_paths >/dev/null' 2>/dev/null; then
+    fail 'worktree allowlist accepted a path outside the repository'
+fi
+rm "$fixture/.automation-worktree-allowlist"
+ln -s local/operator-note.txt "$fixture/.automation-worktree-allowlist"
+if run_fixture bash -c 'source ./scripts/automation/lib.sh; automation_changed_paths >/dev/null' 2>/dev/null; then
+    fail 'worktree allowlist accepted a symbolic-link control file'
+fi
+rm "$fixture/.automation-worktree-allowlist"
+printf '%s\n' \
+    '# Exact repository-relative paths intentionally kept local' \
+    'local/operator-note.txt' \
+    'local/generated-note.txt' \
+    > "$fixture/.automation-worktree-allowlist"
+pass 'invalid, duplicate, symbolic-link, patterned, and protected allowlist input fails closed'
+
 run_fixture ./scripts/automation/validate-contract.sh TASK-TEST-001 >/dev/null
 pass 'valid version-3 configuration and task contract are accepted'
 
@@ -500,6 +573,8 @@ approved_baseline="$(jq -er '.baselineHead' "$runtime_root/workspaces/TASK-TEST-
 leased_status="$(run_fixture ./scripts/automation/status.sh TASK-TEST-004)"
 [[ "$(jq -r '.runtime.repositoryLeaseMatches' <<< "$leased_status")" == "true" ]] || fail 'status did not verify the repository lease'
 [[ "$(jq -r '.runtime.originalBranchDrifted' <<< "$leased_status")" == "false" ]] || fail 'status reported false branch drift'
+[[ "$(jq -c '.runtime.effectiveWorktreeAllowlist' <<< "$leased_status")" == '["local/operator-note.txt","local/generated-note.txt"]' ]] || \
+    fail 'status did not expose the approved in-place allowlist snapshot'
 if run_fixture bash -c 'source ./scripts/automation/lib.sh; automation_acquire_repository_lease TASK-TEST-999 "$PWD" inPlaceExclusive' >/dev/null 2>&1; then
     fail 'a second task acquired the persistent repository lease'
 fi
@@ -508,6 +583,10 @@ pass 'persistent repository lease rejects a concurrent automation task'
 [[ "$(jq -r '.state' "$runtime_root/state/TASK-TEST-004.json")" == "PENDING" ]] || fail 'prepared task did not become PENDING'
 pass 'contract approval switches to a leased task branch while deferring the sealed plan and contract to the product commit'
 
+git -C "$fixture" add -- \
+    .automation-worktree-allowlist \
+    local/operator-note.txt \
+    local/generated-note.txt
 run_task "$task_root" ./scripts/automation/claim-task.sh TASK-TEST-004 >/dev/null
 printf '%s\n' 'class OrchestratedFlowTest { fun expectedBehavior() = Unit }' > "$task_root/mobile-client/src/test/java/dev/example/orchestratorfixture/OrchestratedFlowTest.kt"
 run_task "$task_root" ./scripts/automation/record-red.sh TASK-TEST-004 'expected missing behavior' -- dev.example.orchestratorfixture.OrchestratedFlowTest >/dev/null
@@ -517,6 +596,15 @@ run_task "$task_root" ./scripts/automation/begin-review.sh TASK-TEST-004 >/dev/n
 run_task "$task_root" env AUTOMATION_FAKE_GREEN=1 ./scripts/automation/submit-review.sh TASK-TEST-004 APPROVED 'Fresh review confirms the sealed behavior and scope.' >/dev/null
 run_task "$task_root" ./scripts/automation/acceptance-report.sh TASK-TEST-004 >/dev/null
 [[ "$(jq -r '.changedPaths | length' "$runtime_root/evidence/TASK-TEST-004/acceptance-report.json")" -eq 2 ]] || fail 'acceptance package omitted product paths'
+if jq -e '.changedPaths | any(. == "local/operator-note.txt" or . == "local/generated-note.txt")' \
+    "$runtime_root/evidence/TASK-TEST-004/acceptance-report.json" >/dev/null; then
+    fail 'acceptance package included an allowlisted local path'
+fi
+if rg -F 'diff --git a/local/operator-note.txt b/local/operator-note.txt' "$runtime_root/evidence/TASK-TEST-004/sealed.diff" >/dev/null || \
+   rg -F 'diff --git a/local/generated-note.txt b/local/generated-note.txt' "$runtime_root/evidence/TASK-TEST-004/sealed.diff" >/dev/null || \
+   rg -F 'diff --git a/.automation-worktree-allowlist b/.automation-worktree-allowlist' "$runtime_root/evidence/TASK-TEST-004/sealed.diff" >/dev/null; then
+    fail 'sealed diff included allowlisted local content'
+fi
 [[ "$(jq -r '.evidence.qualityGate' "$runtime_root/evidence/TASK-TEST-004/acceptance-report.json")" == "PASSED" ]] || fail 'acceptance package omitted quality-gate status'
 acceptance_card="$(run_fixture ./scripts/automation/show-acceptance-review.sh TASK-TEST-004)"
 [[ "$acceptance_card" == *"人工验收提醒"* ]] || fail 'acceptance review did not actively identify the human gate'
@@ -555,6 +643,27 @@ for combined_path in \
         awk -v expected="$combined_path" '$0 == expected { found = 1 } END { exit !found }' || \
         fail "combined task commit omitted $combined_path"
 done
+if git -C "$fixture" diff-tree --no-commit-id --name-only -r "$combined_commit" | \
+    rg -x 'local/(operator-note|generated-note)\.txt|\.automation-worktree-allowlist' >/dev/null; then
+    fail 'combined task commit included an allowlisted local path or its control file'
+fi
+[[ "$(cat "$fixture/local/operator-note.txt")" == "operator local edit" ]] || fail 'tracked allowlisted content changed during integration'
+[[ "$(cat "$fixture/local/generated-note.txt")" == "generated local state" ]] || fail 'untracked allowlisted content changed during integration'
+staged_allowlist_paths="$(git -C "$fixture" diff --cached --name-only HEAD -- | LC_ALL=C sort)"
+for staged_allowlist_path in \
+    .automation-worktree-allowlist \
+    local/generated-note.txt \
+    local/operator-note.txt; do
+    printf '%s\n' "$staged_allowlist_paths" | \
+        awk -v expected="$staged_allowlist_path" '$0 == expected { found = 1 } END { exit !found }' || \
+        fail "integration consumed a staged allowlisted path: $staged_allowlist_path"
+done
+run_fixture bash -c 'source ./scripts/automation/lib.sh; automation_worktree_is_clean' || fail 'allowlisted local state made the integrated source root dirty'
+pass 'in-place integration preserves allowlisted local state without evidence or commit leakage'
+git -C "$fixture" restore --staged -- \
+    .automation-worktree-allowlist \
+    local/operator-note.txt \
+    local/generated-note.txt
 [[ "$(jq -r '.contractCommit' "$runtime_root/evidence/TASK-TEST-004/origin.json")" == "$combined_commit" ]] || fail 'origin evidence did not bind the contract to the combined task commit'
 [[ "$(jq -r '.pushed' "$runtime_root/evidence/TASK-TEST-004/integration.json")" == "false" ]] || fail 'integration evidence did not forbid push'
 [[ "$(jq -r '.method' "$runtime_root/evidence/TASK-TEST-004/integration.json")" == "inPlaceExclusive-fast-forward" ]] || fail 'integration did not use the in-place fast-forward path'
@@ -579,6 +688,10 @@ jq \
     > "$fixture/automation/tasks/TASK-TEST-008.json"
 run_fixture ./scripts/automation/prepare-contract-review.sh TASK-TEST-008 '批准方案，生成计划和任务合同。' >/dev/null
 run_fixture env AUTOMATION_SKIP_AGENT_RUN=1 ./scripts/automation/approve-and-run.sh TASK-TEST-008 '合同已复核，批准自动执行到人工验收阶段。' >/dev/null
+git -C "$fixture" add -- \
+    .automation-worktree-allowlist \
+    local/operator-note.txt \
+    local/generated-note.txt
 printf '%s\n' 'class AbortArchive { fun value() = "preserved" }' > "$fixture/mobile-client/src/main/java/dev/example/orchestratorfixture/AbortArchive.kt"
 printf '%s\n' 'must not be archived automatically' > "$fixture/out-of-contract.txt"
 if run_fixture ./scripts/automation/abort-task.sh TASK-TEST-008 '中止任务，封存修改并恢复原分支。' >/dev/null 2>&1; then
@@ -592,10 +705,27 @@ abort_recovery_commit="$(jq -er '.recoveryCommit' "$runtime_root/evidence/TASK-T
 git -C "$fixture" cat-file -e "$abort_recovery_commit:mobile-client/src/main/java/dev/example/orchestratorfixture/AbortArchive.kt" || fail 'abort recovery commit omitted the allowed change'
 git -C "$fixture" cat-file -e "$abort_recovery_commit:docs/plans/TASK-TEST-008.md" || fail 'abort recovery commit omitted the sealed plan'
 git -C "$fixture" cat-file -e "$abort_recovery_commit:automation/tasks/TASK-TEST-008.json" || fail 'abort recovery commit omitted the sealed contract'
+if git -C "$fixture" diff-tree --no-commit-id --name-only -r "$abort_recovery_commit" | \
+    rg -x 'local/(operator-note|generated-note)\.txt|\.automation-worktree-allowlist' >/dev/null; then
+    fail 'abort recovery commit included an allowlisted local path or its control file'
+fi
+staged_abort_allowlist_paths="$(git -C "$fixture" diff --cached --name-only HEAD -- | LC_ALL=C sort)"
+for staged_allowlist_path in \
+    .automation-worktree-allowlist \
+    local/generated-note.txt \
+    local/operator-note.txt; do
+    printf '%s\n' "$staged_abort_allowlist_paths" | \
+        awk -v expected="$staged_allowlist_path" '$0 == expected { found = 1 } END { exit !found }' || \
+        fail "abort consumed a staged allowlisted path: $staged_allowlist_path"
+done
 [[ ! -f "$fixture/mobile-client/src/main/java/dev/example/orchestratorfixture/AbortArchive.kt" ]] || fail 'abort left archived code on the original branch'
 [[ "$(jq -r '.state' "$runtime_root/state/TASK-TEST-008.json")" == "ABORTED" ]] || fail 'allowed abort did not reach ABORTED'
 [[ ! -d "$runtime_root/locks/repository.workspace.lease" ]] || fail 'allowed abort did not release the repository lease'
 pass 'abort refuses unrelated files and archives allowed uncommitted changes in a recovery commit'
+git -C "$fixture" restore --staged -- \
+    .automation-worktree-allowlist \
+    local/operator-note.txt \
+    local/generated-note.txt
 
 planning_only_baseline="$(git -C "$fixture" rev-parse HEAD)"
 printf '%s\n' '# Planning-only abort plan' > "$fixture/docs/plans/TASK-TEST-009.md"
@@ -635,9 +765,17 @@ run_fixture ./scripts/automation/prepare-contract-review.sh TASK-TEST-007 '批
 run_fixture env AUTOMATION_SKIP_AGENT_RUN=1 ./scripts/automation/approve-and-run.sh TASK-TEST-007 '合同已复核，批准自动执行到人工验收阶段。' >/dev/null
 isolated_task_root="$(jq -er '.taskRoot' "$runtime_root/workspaces/TASK-TEST-007.json")"
 [[ "$isolated_task_root" != "$fixture" && -d "$isolated_task_root" ]] || fail 'optional isolated strategy did not create a separate task root'
+[[ "$(jq -r '.worktreeAllowlist | length' "$runtime_root/workspaces/TASK-TEST-007.json")" -eq 2 ]] || fail 'isolated workspace did not retain the approved allowlist snapshot'
 [[ -f "$isolated_task_root/docs/plans/TASK-TEST-007.md" && -f "$isolated_task_root/automation/tasks/TASK-TEST-007.json" ]] || fail 'isolated task root did not receive the sealed planning artifacts'
 [[ ! -e "$fixture/docs/plans/TASK-TEST-007.md" && ! -e "$fixture/automation/tasks/TASK-TEST-007.json" ]] || fail 'isolated preparation left duplicate planning artifacts in the source root'
 [[ "$(git -C "$fixture" worktree list --porcelain | awk '/^worktree / { count++ } END { print count + 0 }')" -eq 2 ]] || fail 'isolated strategy created more than one additional worktree'
+isolated_status="$(run_task "$isolated_task_root" ./scripts/automation/status.sh TASK-TEST-007)"
+[[ "$(jq -c '.runtime.effectiveWorktreeAllowlist' <<< "$isolated_status")" == '[]' ]] || \
+    fail 'status applied the source allowlist inside an isolated task root'
+printf '%s\n' 'task-local edit must stay visible' > "$isolated_task_root/local/operator-note.txt"
+isolated_visible_paths="$(run_task "$isolated_task_root" bash -c 'source ./scripts/automation/lib.sh; automation_changed_paths')"
+printf '%s\n' "$isolated_visible_paths" | rg -x 'local/operator-note.txt' >/dev/null || fail 'source allowlist hid a task-local isolated-worktree edit'
+git -C "$isolated_task_root" restore -- local/operator-note.txt
 run_task "$isolated_task_root" ./scripts/automation/claim-task.sh TASK-TEST-007 >/dev/null
 printf '%s\n' 'class IsolatedFlowTest { fun expectedBehavior() = Unit }' > "$isolated_task_root/mobile-client/src/test/java/dev/example/orchestratorfixture/IsolatedFlowTest.kt"
 run_task "$isolated_task_root" ./scripts/automation/record-red.sh TASK-TEST-007 'expected missing behavior' -- dev.example.orchestratorfixture.IsolatedFlowTest >/dev/null