create-agent-rig 0.6.0 → 0.6.1

package/CHANGELOG.md

@@ -11,6 +11,36 @@ Numbering is ordinary semver — **additive is a minor, a fix is a patch** — s
 that "I only take minors" remains a usable policy; 0.3.2 shipped additive
 content as a patch by the owner's call and stays recorded as one.
 
+## 0.6.1
+
+**Security and upgrade hardening for the Agent OS shipped by 0.6.0.** This patch
+closes the rulebook, unattended-run and queue-board gaps found while upgrading a
+live generated repository; it adds no dependency and changes no public CLI
+command.
+
+### Security
+
+- **`guard-rulebook` now covers the whole shared rulebook and symlink aliases on
+  either side of the comparison.** `AGENTS.md` and `.codex/hooks.json` are
+  protected alongside the Claude files. Checkout roots and payload paths are
+  judged in both their selected and canonical spellings, including a
+  payload-only alias.
+- **Queue board names containing terminal control characters are rejected before
+  selection, diagnostics or selector writes.** Ordinary names, including names
+  with spaces, remain valid; ANSI, OSC, C1 and DEL bytes from repository-owned
+  `queue.json` keys can no longer repaint terminal output.
+- **Unattended authorization is checkout-scoped.** Concurrent worktrees derive
+  distinct flag paths from canonical checkout identity, legacy machine-wide
+  state fails closed, and migration or cleanup refuses when any armed flag cannot
+  be removed instead of reporting a partial disarm as success.
+
+### Fixed
+
+- The generated prose-reviewer exception for upstream-only tests now applies
+  only to manifest-proven generator snapshots and expires on local drift. This
+  keeps intentional generator test references available without turning a dead
+  reference in an edited downstream rulebook into a pass.
+
 ## 0.6.0
 
 **The loop now checks its premises against the tracker at three points, and

package/README.md

@@ -108,7 +108,7 @@ wired by both `.claude/settings.json` and `.codex/hooks.json`:
   the web talks to the backend over HTTP only;
 - **`guard-rulebook`** — in an unattended run (a flag file the `loop` skill
   writes at claim time), refuses an edit to the rulebook — hooks, wiring,
-  `queue.json`, the queue adapters, the router, the gate sweep, the rules,
+  `queue.json` and its board selector, the queue adapters, the router, the gate sweep, the rules,
   `CLAUDE.md` — outside the current item's allow-list; does nothing in an
   attended session.
 - **`guard-secret-file`** — refuses an edit that writes a credential: either the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-agent-rig",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Scaffold a new project with an agent operating system (rules, gates, hooks) and a runnable code skeleton",
   "keywords": [
     "create",

package/templates/agent-os/init/AGENTS.md

@@ -116,13 +116,15 @@ All four are one-liners, and all four are inert until you do them.
    no-op, and the Definition of Done is back to being a wish.
 2. **The elevated-path list below is a seed, not a survey.** It names only what
    every repo has. Everything else is yours to add.
-3. **Four runtime paths need a `.gitignore` line each**, and `init` cannot add
+3. **Five runtime paths need a `.gitignore` line each**, and `init` cannot add
    them — it installs into your repository and does not edit files it did not
-   bring. Add all four:
+   bring. If any are missing, add only the missing entries:
 
    ```
    # the tier the last close recorded
    .claude/queue.state.json
+   # the board this checkout runs on, when the config declares several
+   .claude/queue.board
    # gate rounds, one count per branch
    .claude/gate-rounds.json
    # task worktrees

package/templates/agent-os/init/CLAUDE.md

@@ -116,13 +116,15 @@ All four are one-liners, and all four are inert until you do them.
    no-op, and the Definition of Done is back to being a wish.
 2. **The elevated-path list below is a seed, not a survey.** It names only what
    every repo has. Everything else is yours to add.
-3. **Four runtime paths need a `.gitignore` line each**, and `init` cannot add
+3. **Five runtime paths need a `.gitignore` line each**, and `init` cannot add
    them — it installs into your repository and does not edit files it did not
-   bring. Add all four:
+   bring. If any are missing, add only the missing entries:
 
    ```
    # the tier the last close recorded
    .claude/queue.state.json
+   # the board this checkout runs on, when the config declares several
+   .claude/queue.board
    # gate rounds, one count per branch
    .claude/gate-rounds.json
    # task worktrees

package/templates/agent-os/universal/.agents/skills/loop/SKILL.md

@@ -39,6 +39,28 @@ node .claude/scripts/queue/index.mjs hygiene   # stale labels, link anomalies, o
   (`JIRA_BASE_URL`, `JIRA_EMAIL`, `JIRA_API_TOKEN`) and never from a file in the
   repo; the project or the JQL goes in `.claude/queue.json`.
 
+A config may declare several boards (`boards: { <name>: options }` plus a
+default `board`); the active one is chosen per checkout, not by editing the
+composed file:
+
+```bash
+node .claude/scripts/queue/index.mjs board        # the active board and the declared ones
+node .claude/scripts/queue/index.mjs board RP     # switch this checkout: writes .claude/queue.board
+```
+
+The selector is per-checkout runtime state, the same class as
+`.claude/queue.state.json`: it needs its own `.gitignore` line, which a generated
+project ships and an `init`-installed rig adds by hand. An undeclared name is
+refused, never read as "no board" (see `test/template/queue-board.test.ts` ›
+"refuses a board nobody declared instead of falling back" — in the generator,
+absent in a generated rig). It is a rulebook path for `guard-rulebook`:
+`.claude/queue.board` is refused even when an item allow-list names it,
+and the `board` command itself refuses a switch while the checkout is unattended. This
+does not prevent an arbitrary direct shell write to the selector — edit-tool
+hooks cannot see one. `.claude/queue.state.json` stays per config, not per board:
+the tier the last close recorded rations the next selection whichever board it
+lands on.
+
 Adding a fourth is an adapter, not a rewrite: `core.mjs` holds every selection
 decision and each adapter only maps its tracker's records onto the neutral shape.
 
@@ -99,14 +121,15 @@ invocation. What a hook CAN see is a file, so the unattended signal is one:
 ```bash
 # at claim time, from the paths the item names (repo-relative prefixes, with
 # their trailing slash); the guard refuses every other rulebook edit while it is on
-node .claude/scripts/unattended-flag.mjs on --item <item-id> --run-dir "$RIG_RUN_DIR" --allow <prefix> [<prefix>…]
+node .claude/scripts/unattended-flag.mjs on --root "$PWD" --item <item-id> --run-dir "$RIG_RUN_DIR" --allow <prefix> [<prefix>…]
 ```
 
 `guard-rulebook` reads it (`.claude/rules/autonomy.md`, "Never"): with the flag
-on, a Write/Edit/MultiEdit/NotebookEdit/`apply_patch` under `.claude/hooks/`,
-`.claude/settings.json`, `.claude/queue.json`, `.claude/scripts/queue/`, the
-router, the gate sweep, `.claude/rules/` or `CLAUDE.md` is refused unless its
-path starts with an allowed prefix; with no flag the guard does nothing. An
+on, a Write/Edit/MultiEdit/NotebookEdit/`apply_patch` under the generated
+rulebook — both harnesses' rules, skills, agents and hook wiring, plus their
+scripts, queue config and integrity manifest — is refused unless its
+path starts with an allowed prefix; the board selector is the one always-refused
+exception and cannot be admitted by an allow-list. With no flag the guard does nothing. An
 item that needs a rulebook path names it here — a decision made at claim
 time, never a default — and the stop step below turns the flag off. Pinned in
 the generator's `test/template/guard-rulebook.test.ts` — absent in a generated
@@ -718,9 +741,18 @@ next attended session would find its rulebook edits refused in the name of an
 item nobody is working:
 
 ```bash
-node .claude/scripts/unattended-flag.mjs off
+node .claude/scripts/unattended-flag.mjs off --root "$PWD"
 ```
 
+If that command reports a legacy machine-wide flag, it deliberately leaves a
+foreign pre-upgrade authorization in place and the checkout stays fail-closed.
+Inspect the exact reported record and confirm that no pre-upgrade run still uses
+it, then remove only that record with
+`node .claude/scripts/unattended-flag.mjs off --legacy --path <reported-path>`.
+Run scoped `off --root "$PWD"` again to surface the next record, and repeat the
+inspection one at a time; do not record the flag as off until the scoped command
+succeeds.
+
 At every **stop** — not at a checkpoint — turn the run's findings into **at most
 three** improvement proposals. **The cap is the mechanism, not a budget:** an
 unbounded improvement list is another diary, and three forces a choice. Each names
@@ -750,7 +782,7 @@ node --input-type=module -e '
     // mechanism accepts a proposal without them; this procedure does not.
     measured: "<the paths the probe actually exercised>",
     inferred: "<the conclusion, citing only surfaces named in measured>",
-  }, { project: "<KEY>" }));   // jira only — the project key from .claude/queue.json;
+  }, { project: "<KEY>" }));   // jira only — the ACTIVE board's key: `queue/index.mjs board --json` → options.project;
                                // plan-md and github-issues take no second argument
 '
 ```
@@ -853,7 +885,7 @@ three poisons the only channel by which this project learns.
   validation and its take-up — an adapter re-records the take-up after each
   write of its own (§2, AR-140), so a comment posted after BEFORE_PR does not
   hold the close; pinned in the generator's
-  `test/template/self-inflicted-marker.test.ts` › "continues when the run’s own
+  `test/template/self-inflicted-marker.test.ts` (absent in a generated rig) › "continues when the run’s own
   write moved the marker after the last validation" — and its
   state against the `in-progress` a close expects, journals one `revalidation`
   event at `point: BEFORE_CLOSE`, and lists the item's dependants with each
@@ -864,7 +896,7 @@ three poisons the only channel by which this project learns.
   and reads a hold as a stop" and › "re-reads each dependant's state, and names
   one the tracker no longer offers". On a `github-issues` queue that list is
   empty: a single `gh issue view` carries no cross-index, so `find` answers no
-  `blocks` there (`test/template/close-transitioned.test.ts` › "github asks `gh
+  `blocks` there (`test/template/close-transitioned.test.ts` (absent in a generated rig) › "github asks `gh
   issue view` with the full field list and maps CLOSED to closed"). A
   hold (exit 2) stops the close: re-read the item, record the outcome with
   `node .claude/scripts/revalidate.mjs outcome --point BEFORE_CLOSE --ticket
@@ -876,7 +908,7 @@ three poisons the only channel by which this project learns.
   `true` says the close landed, because every adapter reads the item back after
   the transition — `jira` the status category after the POST, `github-issues`
   `gh issue view --json state`, `plan-md` the line being there and then gone
-  (the generator's `test/template/close-transitioned.test.ts` › "GETs the issue
+  (the generator's `test/template/close-transitioned.test.ts` (absent in a generated rig) › "GETs the issue
   status after the transition POST and reports transitioned: true when the
   category is done", › "runs `issue view <id> --json state` after `issue close`
   and reports transitioned: true on CLOSED", › "reports transitioned: true once

package/templates/agent-os/universal/.claude/agents/prose-reviewer.md

@@ -61,11 +61,16 @@ about it here, so the two gates never file competing opinions on one paragraph.
 
    ⚠ A pointer into a test suite the reader's project does not carry is normally
    item 2, not backing. There is one narrow inherited-snapshot exception from
-   `invariants.md`: a generator-authored hook may point to upstream generator
-   tests that are absent locally **only while the hook is unchanged downstream**
-   and its hook header identifies those tests as absent locally. If that hook is
-   edited downstream or appears as changed in the current diff, the exception
-   expires and the local test is yours; then an absent pointer is item 2 again.
+   `invariants.md`: a generator-authored artifact — rules, hooks, skills,
+   scripts, or agent specs —
+   may point to upstream generator tests that are absent locally only when the
+   pointer explicitly says the suite is absent locally and
+   `.claude/.rig-manifest.json` proves the current artifact's hash matches the
+   installed manifest. A manifest-backed upgrade remains an inherited,
+   generator-owned artifact; a changed file in the upgrade diff does not alone
+   make it downstream-authored. The exception applies **only while the manifest
+   hash matches**. A hash mismatch, missing manifest, or no evidence ends the
+   exception and the local test is yours; then an absent pointer is item 2 again.
 
    🔴 Three things this is not. It is not item 1: that one is about enforcement the
    mechanism does not provide, this one is about any claim with nothing behind it,

package/templates/agent-os/universal/.claude/hooks/gate-stop-dod.mjs

@@ -34,9 +34,9 @@
 // a per-step budget is how three checks quietly cost three times the wall
 // clock the wiring allows (`.claude/rules/invariants.md` — "an explicit total
 // budget rather than a per-step one").
-//   see hooks.test.ts › "gates the stop when a check outruns the budget — unmeasured is not a pass"
-//   see hooks.test.ts › "spends one budget across the whole suite, not a fresh one per check"
-//   see hooks.test.ts › "gives the stop gate a harness timeout its own budget finishes inside"
+//   see hooks.test.ts (absent in a generated rig) › "gates the stop when a check outruns the budget — unmeasured is not a pass"
+//   see hooks.test.ts (absent in a generated rig) › "spends one budget across the whole suite, not a fresh one per check"
+//   see hooks.test.ts (absent in a generated rig) › "gives the stop gate a harness timeout its own budget finishes inside"
 //
 // ⚠ This rests on ONE assumption about the harness that nothing in this
 // repository can prove or falsify: that a hook outrunning its timeout is
@@ -48,19 +48,19 @@
 // Limits, each with the test that pins it:
 //   - a check whose output outgrows the buffer is UNMEASURED, and blocks like
 //     any other unmeasured check —
-//     see hooks.test.ts › "gates the stop when a check drowns its own buffer — a pass nobody watched is not a pass"
+//     see hooks.test.ts (absent in a generated rig) › "gates the stop when a check drowns its own buffer — a pass nobody watched is not a pass"
 //   - below that buffer, output volume is not a verdict: a chatty check that
 //     passes, passes —
-//     see hooks.test.ts › "does not read a chatty passing check as a failure (the ENOBUFS false gate)"
+//     see hooks.test.ts (absent in a generated rig) › "does not read a chatty passing check as a failure (the ENOBUFS false gate)"
 //   - the RIG_DOD_BUDGET_MS override may only LOWER the budget, and an
 //     override this hook did not honour is announced rather than ignored —
-//     see hooks.test.ts › "clamps a budget override that would outlive the harness, and names the budget it used"
+//     see hooks.test.ts (absent in a generated rig) › "clamps a budget override that would outlive the harness, and names the budget it used"
 //   - a fail-open is announced on stderr, because a silent exit 0 and a clean
 //     pass are the same observation from outside —
-//     see hooks.test.ts › "announces a fail-open instead of returning a silent clean pass"
+//     see hooks.test.ts (absent in a generated rig) › "announces a fail-open instead of returning a silent clean pass"
 //   - an ABSENT config is not a failure and says nothing; only a config that
 //     exists and cannot be used announces —
-//     see hooks.test.ts › "stays silent when there is no config at all — nothing to gate is the design, not a swallowed error"
+//     see hooks.test.ts (absent in a generated rig) › "stays silent when there is no config at all — nothing to gate is the design, not a swallowed error"
 import { execSync, spawnSync } from 'node:child_process';
 import { readFileSync, realpathSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
@@ -81,9 +81,9 @@ import { withoutGitLocation } from '../scripts/git-env.mjs';
 // `worktree-task` worktree is measured at the main checkout, and the refusal
 // says so. Resolved inside `main()`, so a throw here reaches the backstop
 // and announces itself like every other fault of the gate's own.
-//   see hooks.test.ts › "runs the checks in the project root, so a check reading the tree sees the session project"
-//   see hooks.test.ts › "asks "is the tree clean?" about the project, not about the cwd"
-//   see hooks.test.ts › "names the tree it measured in the refusal, so a foreign failure is visible at a glance"
+//   see hooks.test.ts (absent in a generated rig) › "runs the checks in the project root, so a check reading the tree sees the session project"
+//   see hooks.test.ts (absent in a generated rig) › "asks "is the tree clean?" about the project, not about the cwd"
+//   see hooks.test.ts (absent in a generated rig) › "names the tree it measured in the refusal, so a foreign failure is visible at a glance"
 const projectRootOf = () => realpathSync(fileURLToPath(new URL('../..', import.meta.url)));
 
 // The default total budget, and the allowance for everything that happens
@@ -100,8 +100,8 @@ const projectRootOf = () => realpathSync(fileURLToPath(new URL('../..', import.m
 // So the preamble gets a number and a leash: `git status` below is given this
 // as its own timeout, which turns the allowance from a guess into a bound.
 // Both numbers are read from this file and compared against the wiring —
-//   see hooks.test.ts › "gives the stop gate a harness timeout its own budget finishes inside"
-//   see hooks.test.ts › "bounds its own preamble: the git status call carries a timeout derived from the declared margin"
+//   see hooks.test.ts (absent in a generated rig) › "gives the stop gate a harness timeout its own budget finishes inside"
+//   see hooks.test.ts (absent in a generated rig) › "bounds its own preamble: the git status call carries a timeout derived from the declared margin"
 const DEFAULT_BUDGET_MS = 600_000;
 const PREAMBLE_MARGIN_MS = 60_000;
 
@@ -137,7 +137,7 @@ const SPAWN_NEVER_STARTED = new Set(['ENOENT', 'EACCES', 'EPERM', 'EMFILE', 'ENF
  * it. `Number.isSafeInteger` is the test rather than `isFinite`, because
  * `spawnSync` throws on a fractional `timeout` — and a throw here would land in
  * the backstop and open the gate completely.
- *   see hooks.test.ts › "runs the gate on the default budget when the override is unusable, instead of not running it"
+ *   see hooks.test.ts (absent in a generated rig) › "runs the gate on the default budget when the override is unusable, instead of not running it"
  */
 function budgetMs(env) {
   const raw = env.RIG_DOD_BUDGET_MS;
@@ -235,13 +235,13 @@ function main() {
   // still ended green. Both were shipped here, one after the other, and both
   // are closed the same way — every usable entry runs, and a skipped entry is
   // a check with no verdict, which blocks.
-  //   see hooks.test.ts › "never lets an unusable config entry hide a failing check behind it (an empty string)"
-  //   see hooks.test.ts › "refuses the stop for an empty config entry it skipped, even though every check it could run passed"
+  //   see hooks.test.ts (absent in a generated rig) › "never lets an unusable config entry hide a failing check behind it (an empty string)"
+  //   see hooks.test.ts (absent in a generated rig) › "refuses the stop for an empty config entry it skipped, even though every check it could run passed"
   //
   // The predicate is exactly the three shapes `spawnSync` throws on, and no
   // wider: the shell answers every other unrunnable string with 127, which is
   // a verdict. Filtering past these three converts a real block into a skip.
-  //   see hooks.test.ts › "refuses the stop for a config it could read but cannot use, and names the file to fix"
+  //   see hooks.test.ts (absent in a generated rig) › "refuses the stop for a config it could read but cannot use, and names the file to fix"
   const runnable = (command) =>
     typeof command === 'string' && command !== '' && !command.includes('\0');
   const usable = checks.filter(runnable);

package/templates/agent-os/universal/.claude/hooks/guard-bash.mjs

@@ -24,7 +24,8 @@
 //
 // ── The limits, stated exactly — and TESTED ──────────────────────────────────
 //
-// This block is a credibility claim, so `test/template/guard-hardening.test.ts`
+// This block is a credibility claim, so the generator's
+// `test/template/guard-hardening.test.ts` (absent in a generated rig)
 // asserts each line twice: that the limit is documented here, and that the
 // command really does pass. A limits comment nothing checks drifts into fiction,
 // which is what happened the first time — an earlier version of this list was

package/templates/agent-os/universal/.claude/hooks/guard-rulebook.mjs

@@ -2,11 +2,12 @@
 // PreToolUse hook: in an UNATTENDED run, the rulebook is never edited outside
 // the current item's allow-list (AR-51).
 //
-// The rulebook is the set of files that decide what this session may do — the
-// hooks, their wiring, the queue config and adapters, the router and the gate
-// sweep, the rules, `CLAUDE.md`. Every one of them was editable by the run it
-// governs: a Write to `.claude/hooks/dod-checks.json` with `[]` switched the
-// stop gate off, and nothing refused it until the merge sweep, long after.
+// The rulebook is the set of files that decide what this session may do — hooks
+// and settings wiring, the queue config and selector, all scripts, rules, skills
+// and agents, the `.codex/` configuration, the integrity manifest, `AGENTS.md`
+// and `CLAUDE.md`. Every one of them was editable by the run it governs: a
+// Write to `.claude/hooks/dod-checks.json` with `[]` switched the stop gate
+// off, and nothing refused it until the merge sweep, long after.
 //
 // How it decides — and it is deliberately dumb:
 //   1. No unattended flag on disk (`.claude/scripts/unattended-flag.mjs`) → an
@@ -14,8 +15,12 @@
 //      the rulebook on purpose.
 //   2. Flag present and readable → every edit fragment whose repo-relative path
 //      sits under a rulebook prefix is refused (exit 2) unless it also sits
-//      under one of the item's `allow` prefixes. Paths outside the rulebook are
-//      never judged.
+//      under one of the item's `allow` prefixes. A known path outside the
+//      rulebook is never judged — › "allows a MultiEdit beyond the fragment cap
+//      when its known path is outside the rulebook". A pathless global refusal
+//      for an oversized or unsupported `apply_patch` payload is blocked while
+//      armed because its scope cannot be proved — › "states the pathless
+//      global-refusal limit for oversized and unsupported apply_patch payloads".
 //   3. Flag present and UNREADABLE → a rulebook edit is refused and the reason
 //      names the flag; an edit outside the rulebook still passes. Refusing to
 //      inspect is not allowing (`.claude/rules/invariants.md`).
@@ -37,15 +42,12 @@
 //   - it judges paths, not content: a README that merely mentions
 //     `.claude/hooks/guard-bash.mjs` is not a rulebook edit — › "guards the
 //     path, not prose that mentions a guarded path";
-//   - it compares paths as text: the repo-relative tail is what is left after
-//     stripping `CLAUDE_PROJECT_DIR` (falling back to the working directory
-//     when the harness does not set it) from the front of the tool's absolute
-//     path, so a root spelled differently from the file path — a symlinked
-//     `/tmp` versus `/private/tmp`, a case difference on a case-insensitive
-//     disk — is not stripped, and the edit is not judged. Documented and
-//     measured, not fixed: the harness spells both from one root — › "compares
-//     paths as text: a root spelled differently from the file path is not
-//     judged (documented, fails open)";
+//   - it compares both roots and payload paths in their selected and canonical
+//     spellings, whether selection came from `CLAUDE_PROJECT_DIR` or the
+//     working-directory fallback — › "canonicalizes a differently spelled
+//     checkout root before guarding a canonical payload path", › "blocks when
+//     the checkout root and payload use the same symlink spelling", and
+//     › "blocks an existing rulebook file when only the payload path uses a symlink spelling";
 //   - an `allow` prefix is a string prefix of the repo-relative path and may
 //     not widen the rulebook — an entry that is itself a prefix of a rulebook
 //     prefix (`.`, `.claude/`, `.claude/scripts/`) makes the flag unreadable
@@ -58,7 +60,8 @@
 //     adversary.
 //
 // The rule it enforces is stated in `.claude/rules/autonomy.md`, "Never".
-import { readFileSync } from 'node:fs';
+import { readFileSync, realpathSync } from 'node:fs';
+import { basename, dirname, join, resolve } from 'node:path';
 import { editFragments } from './lib/edit-input.mjs';
 import { RULEBOOK_PREFIXES, isRulebookPath, readUnattended } from '../scripts/unattended-flag.mjs';
 
@@ -68,6 +71,30 @@ const EDIT_TOOLS = new Set(['Write', 'Edit', 'MultiEdit', 'NotebookEdit', 'apply
 
 const toPosix = (value) => String(value ?? '').replaceAll('\\', '/');
 
+const canonicalRoot = (root) => {
+  try {
+    return realpathSync(root);
+  } catch {
+    return root;
+  }
+};
+
+/** Resolve symlinks in the nearest existing ancestor, preserving a missing tail. */
+const canonicalPath = (filePath) => {
+  let cursor = resolve(filePath);
+  const tail = [];
+  for (;;) {
+    try {
+      return join(realpathSync(cursor), ...tail);
+    } catch {
+      const parent = dirname(cursor);
+      if (parent === cursor) return filePath;
+      tail.unshift(basename(cursor));
+      cursor = parent;
+    }
+  }
+};
+
 /** The repo-relative tail of an absolute path, or the path itself when it is not under the root. */
 export const relativeTo = (root, filePath) => {
   const dir = toPosix(root).replace(/\/+$/, '');
@@ -79,6 +106,11 @@ export const relativeTo = (root, filePath) => {
 export const isAllowed = (rel, allow) =>
   (Array.isArray(allow) ? allow : []).some((prefix) => prefix !== '' && (rel === prefix || rel.startsWith(prefix)));
 
+const protectedRelative = (roots, filePath) =>
+  [...new Set([filePath, canonicalPath(filePath)])]
+    .flatMap((spelling) => roots.map((root) => relativeTo(root, spelling)))
+    .find(isRulebookPath);
+
 function main() {
   let input;
   try {
@@ -88,29 +120,57 @@ function main() {
   }
   if (!EDIT_TOOLS.has(input?.tool_name)) return 0;
 
-  const root = process.env.CLAUDE_PROJECT_DIR ?? process.cwd();
+  const selectedRoot = process.env.CLAUDE_PROJECT_DIR || process.cwd();
+  const root = canonicalRoot(selectedRoot);
+  const comparisonRoots = [...new Set([root, selectedRoot])];
+  const unattendedEnv = { ...process.env, CLAUDE_PROJECT_DIR: root };
+  const fragments = editFragments(input);
+  const globalRefusal = fragments.find(
+    ({ inspectionRefusal, appliesToAll }) => appliesToAll && inspectionRefusal,
+  );
+  if (globalRefusal) {
+    if (globalRefusal.filePath) {
+      const rel = protectedRelative(comparisonRoots, globalRefusal.filePath);
+      if (rel === undefined) return 0;
+    }
+    const mode = readUnattended(unattendedEnv);
+    if (!mode.on) return 0;
+    process.stderr.write(
+      `BLOCKED — cannot safely inspect this unattended edit: ${globalRefusal.inspectionRefusal}\n` +
+        `${globalRefusal.remedy ?? 'Split it into a smaller edit and retry.'}\n`,
+    );
+    return 2;
+  }
   const paths = [];
-  for (const { filePath } of editFragments(input)) {
+  for (const { filePath } of fragments) {
     if (typeof filePath !== 'string' || filePath === '') continue;
-    const rel = relativeTo(root, filePath);
-    if (isRulebookPath(rel) && !paths.includes(rel)) paths.push(rel);
-    if (paths.length >= 64) break;
+    const rel = protectedRelative(comparisonRoots, filePath);
+    if (rel !== undefined && !paths.includes(rel)) paths.push(rel);
   }
   if (paths.length === 0) return 0; // nothing under the rulebook: never judged
 
-  const mode = readUnattended();
+  const mode = readUnattended(unattendedEnv);
   if (!mode.on) return 0; // attended session
 
   if (mode.unreadable) {
     process.stderr.write(
       `BLOCKED — "${paths[0]}" is part of the rulebook and the unattended flag at ${mode.path} is unreadable (${mode.why}). ` +
-        'Refusing to inspect is not allowing: fix or remove the flag (`node .claude/scripts/unattended-flag.mjs off`), then retry.\n',
+        'Refusing to inspect is not allowing: fix it, or clear this checkout with `node .claude/scripts/unattended-flag.mjs off --root "$PWD"`, then retry.\n',
     );
     return 2;
   }
 
-  const refused = paths.filter((rel) => !isAllowed(rel, mode.allow));
+  const refused = paths.filter(
+    (rel) => rel === '.claude/queue.board' || !isAllowed(rel, mode.allow),
+  );
   if (refused.length === 0) return 0;
+  if (refused[0] === '.claude/queue.board') {
+    process.stderr.write(
+      'BLOCKED — ".claude/queue.board" is the checkout board selector and cannot be changed while unattended, even through an item allow-list. ' +
+        'Disarm unattended mode before deliberately switching queues.\n',
+    );
+    return 2;
+  }
   process.stderr.write(
     `BLOCKED — "${refused[0]}" is part of the rulebook, and an unattended run never edits the rulebook outside its item's allow-list ` +
       `(item ${mode.item ?? '(none)'}; allowed prefixes: ${mode.allow.length === 0 ? 'none' : mode.allow.join(', ')}). ` +