code-coordinator 0.5.106__tar.gz → 0.5.108__tar.gz

{code_coordinator-0.5.106 → code_coordinator-0.5.108}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.106
+Version: 0.5.108
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.106 → code_coordinator-0.5.108}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.106
+Version: 0.5.108
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.106 → code_coordinator-0.5.108}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.106",
+  "tag": "0.5.108",
   "distance": 0,
-  "node": "g254718dc492ab30f9a86d7fce65cb4a2156430b5",
+  "node": "g88b0fe133f2629aebc4acb6c0cd2f756be9213dc",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-08-16"

{code_coordinator-0.5.106 → code_coordinator-0.5.108}/coord/agent.py

@@ -3850,6 +3850,12 @@ def default_worker_command(spec: AssignmentSpec, *, binary: str = DEFAULT_WORKER
     For ``type="plan"`` specs the worker gets :data:`WORKER_PLAN_PROMPT` as
     its system prompt and only ``Read,Bash`` in ``--allowedTools`` — no
     Edit/Write tools so it cannot modify the repository.
+
+    For ``type="smoke"`` specs the worker gets ``Read,Bash`` only — no
+    Edit/Write, and deliberately no ``Monitor`` (#2301): a smoke leg is a
+    one-shot ``claude -p`` session, and ``Monitor`` ends the turn to await a
+    notification that can never arrive in time to resume it, which silently
+    kills a backgrounded smoke suite mid-run and leaves no verdict printed.
     """
     if spec.type == "plan":
         system_prompt = spec.system_prompt if spec.system_prompt else WORKER_PLAN_PROMPT
@@ -3907,6 +3913,33 @@ def default_worker_command(spec: AssignmentSpec, *, binary: str = DEFAULT_WORKER
         system_prompt = spec.system_prompt if spec.system_prompt else MOCK_AUTHOR_SYSTEM_PROMPT
         system_prompt += build_deny_prompt(MOCK_AUTHOR_DENY_COMMANDS)
         allowed_tools = "Read,Edit,Write,Bash"
+    elif spec.type == "smoke":
+        # #2301: smoke gets its own branch instead of falling through to the
+        # generic `else` below (which is where it used to land, and where
+        # it inherited the #2169 `Monitor` grant meant for *work* legs).
+        # A smoke runner's whole job is "pull the branch, run the smoke
+        # command, report pass/fail" (see SMOKE_SYSTEM_PROMPT) — it edits
+        # nothing and pushes nothing, so it has no business holding
+        # Edit/Write either.
+        #
+        # `Monitor` is deliberately withheld: it is an await-a-notification
+        # tool — calling it ends the current turn so the harness can wake
+        # the model back up once the condition it's watching fires. That
+        # only resumes anything in an INTERACTIVE session. A smoke leg is a
+        # one-shot `claude -p` session like every coord leg (#1394): ending
+        # the turn ends the session itself, permanently, before any
+        # notification can arrive. The agent was observed reaching for
+        # `Monitor` via ToolSearch to poll a backgrounded smoke suite, then
+        # ending its turn to "wait" — the session (and the backgrounded
+        # suite, reaped ~30s later) died silently with no verdict printed,
+        # burning a Test dispatch for zero signal every single retry.
+        # `BashOutput`/`TaskOutput` (already reachable without an explicit
+        # grant — see the #2169 comment above) return synchronously and are
+        # the correct way to poll a backgrounded task from here.
+        from coord.smoke import SMOKE_SYSTEM_PROMPT  # noqa: PLC0415
+        system_prompt = spec.system_prompt if spec.system_prompt else SMOKE_SYSTEM_PROMPT
+        system_prompt += build_deny_prompt(spec.deny_commands)
+        allowed_tools = "Read,Bash"
     else:
         system_prompt = spec.system_prompt if spec.system_prompt else WORKER_SYSTEM_PROMPT
         system_prompt += build_deny_prompt(spec.deny_commands)
@@ -3916,6 +3949,15 @@ def default_worker_command(spec: AssignmentSpec, *, binary: str = DEFAULT_WORKER
         # past the 600s Bash ceiling. `TaskOutput`/`TaskStop` were already
         # reachable without being in this list; `Monitor` was the one
         # observed denied.
+        #
+        # #2301: this grant is for *work*-shaped legs (work/review/fix/
+        # conflict-fix) whose system prompt (WORKER_SYSTEM_PROMPT, the
+        # ONE-SHOT section) explicitly teaches the bounded-poll pattern and
+        # explains why an await-a-notification tool is safe to reach for
+        # ONLY with that guidance attached. `smoke` used to fall through to
+        # this branch and inherit `Monitor` with none of that context — see
+        # the dedicated `elif spec.type == "smoke"` branch above, which
+        # deliberately withholds it instead.
         allowed_tools = "Read,Edit,Write,Bash,Monitor"
 
     # NOTE: briefing is NOT passed as a positional arg — it is written to

{code_coordinator-0.5.106 → code_coordinator-0.5.108}/coord/auto_loop.py

@@ -43,7 +43,7 @@ import httpx
 from coord.config import Config
 from coord.dispatch import AGENT_PORT
 from coord import github_ops
-from coord.models import Assignment, Board
+from coord.models import SEALED_PATH_AUTHOR_TYPES, Assignment, Board
 from coord.review import (
     ReviewFindings,
     blocking_findings_confirmed_absent,
@@ -64,7 +64,16 @@ log = logging.getLogger(__name__)
 # ``coord.notify``'s fix-completion detector doesn't hardcode ``"work"`` and
 # silently miss a newer fix-dispatch type — the same class of bug as #1141
 # ("test-author was never added to WORK_LIKE_TYPES").
-FIX_DISPATCH_TYPES: frozenset[str] = frozenset({"work", "test-author"})
+#
+# #2302: "mock-author" (Gate A) is the same class of bug repeating — a
+# request-changes fix for a mock-author row dispatched as plain "work",
+# which trips coord/review.py's sealed-path tamper rule on every round
+# (the fix worker isn't authorized to write tests/acceptance/ms-NN/, but
+# that's exactly where the diff has to land) until max_review_iterations
+# burns out. `_dispatch_fix` derives `fix_type` from
+# ``coord.models.SEALED_PATH_AUTHOR_TYPES`` rather than a hardcoded string
+# so this set — and this one — never drift from it again.
+FIX_DISPATCH_TYPES: frozenset[str] = frozenset({"work"}) | SEALED_PATH_AUTHOR_TYPES
 
 
 # Every :class:`LoopAction` kind whose production means the in-memory board was
@@ -816,9 +825,16 @@ def _build_fix_briefing(
     instructions instead — "make the acceptance suite pass" is actively
     wrong guidance for an oracle that must stay RED until the real
     implementation lands.
+
+    #2302: a ``type="mock-author"`` source row (Gate A) gets its own
+    variant for the same reason one level up the pipeline — the diff is a
+    specification (``contract.md`` + rendered mocks), not an
+    implementation, so "run tests, make them pass" is equally wrong there.
     """
     if work.type == "test-author":
         return _build_test_author_fix_briefing(work, findings, iteration, max_iter)
+    if work.type == "mock-author":
+        return _build_mock_author_fix_briefing(work, findings, iteration, max_iter)
 
     lines: list[str] = [
         f"# Fix assignment (iteration {iteration}/{max_iter}): {work.issue_title}",
@@ -929,6 +945,93 @@ def _build_test_author_fix_briefing(
     return "\n".join(lines)
 
 
+def _build_mock_author_fix_briefing(
+    work: Assignment,
+    findings,
+    iteration: int,
+    max_iter: int,
+) -> str:
+    """Fix briefing for a ``type="mock-author"`` slice (#2302, Gate A).
+
+    The diff here is a SPECIFICATION — ``contract.md`` plus rendered
+    ``tests/acceptance/ms-NN/mocks/*`` — not an implementation. There is no
+    suite to run, so "run the tests and make them pass" (the generic fix
+    instruction) is actively wrong guidance, the same shape #1176 already
+    fixed for ``test-author``. Findings on a Gate A review are almost
+    always an internal-consistency defect: a mock depicting an end state
+    that the contract's own stated rules cannot produce from the narrated
+    input sequence — so the contract and the mocks must be reconciled to
+    agree with each other in BOTH directions, not just patched locally.
+    The dispatcher pairs this briefing with a bare ``type="mock-author"``
+    dispatch (see ``_dispatch_fix``) — ``agent.py``'s own
+    ``elif spec.type == "mock-author"`` branch supplies
+    ``MOCK_AUTHOR_SYSTEM_PROMPT`` and its deny-list on its own, so no
+    explicit ``system_prompt``/``deny_commands`` injection is needed here
+    the way ``test-author`` (which has no such branch) requires.
+    """
+    lines: list[str] = [
+        f"# Gate A fix (iteration {iteration}/{max_iter}): {work.issue_title}",
+        "",
+        (
+            f"You are the independent mock-author fixing review findings "
+            f"against the Gate A contract and mocks for issue "
+            f"#{work.issue_number}."
+        ),
+        (
+            f"Work on branch `{work.branch or '(check your git branches)'}` — "
+            "**do not change the branch name**."
+        ),
+        "",
+        "## Reviewer findings to address",
+        "",
+        findings.body.strip(),
+        "",
+        "## Instructions",
+        "",
+        (
+            "1. Read the reviewer findings above carefully. Your diff is a "
+            "SPECIFICATION (`contract.md` + rendered `mocks/*`), not an "
+            "implementation — there is no suite to run and nothing to make "
+            "pass. Findings on a Gate A review are almost always an "
+            "internal-consistency defect: a mock depicting an end state "
+            "that the contract's own stated rules cannot produce from the "
+            "narrated input sequence."
+        ),
+        (
+            "2. Fix **every** issue identified by the reviewer so the "
+            "contract and the mocks agree with each other in BOTH "
+            "directions — every rule the contract states must be reachable "
+            "from the mocks' narrated sequence, and every state the mocks "
+            "depict must be producible by the contract's stated rules."
+        ),
+        "3. Stay on the **same branch** — push your fixes to the existing branch.",
+        (
+            "4. Do NOT touch any file outside `tests/acceptance/ms-NN/`. "
+            "Touching anything outside that directory is a mandatory "
+            "`request-changes` for this assignment type — you are pinning "
+            "the milestone's contract, not implementing it."
+        ),
+        (
+            f"5. This is fix iteration {iteration} of {max_iter} allowed. "
+            "Address all findings completely so the next review can approve."
+        ),
+        "",
+        (
+            "STATUS: reading review findings → reconciling contract and mocks "
+            "→ confidence: high"
+        ),
+        "",
+    ]
+    if work.briefing and work.briefing.strip():
+        lines += [
+            "## Original mock-author briefing",
+            "",
+            work.briefing.strip(),
+            "",
+        ]
+    return "\n".join(lines)
+
+
 def _dispatch_fix(
     work: Assignment,
     briefing: str,
@@ -945,11 +1048,18 @@ def _dispatch_fix(
     Prefers the same machine as the original worker (the branch is already
     checked out there).  Falls back to any capable machine.
 
-    #1176: the dispatched type mirrors ``work.type`` for ``"test-author"``
-    (with ``TEST_AUTHOR_SYSTEM_PROMPT`` + its deny-list, since the fix needs
-    the same acceptance-path authorization and independence rules as the
-    original test-author dispatch); every other source type still gets the
-    long-standing plain ``"work"`` fix.
+    #1176/#2302: the dispatched type mirrors ``work.type`` for any
+    :data:`coord.models.SEALED_PATH_AUTHOR_TYPES` member (``"test-author"``,
+    ``"mock-author"``) — those types are the ones ``coord/review.py``
+    inverts its sealed-path tamper rule for, so a fix that needs to write
+    back into ``tests/acceptance/ms-NN/`` must carry the same type as the
+    row it's fixing or every round trips "TAMPER DETECTED" until the
+    iteration cap burns out. ``test-author`` additionally needs
+    ``TEST_AUTHOR_SYSTEM_PROMPT`` + its deny-list injected explicitly since
+    ``agent.py`` has no dispatch-table branch for it; ``mock-author``
+    doesn't — ``agent.py``'s own ``elif spec.type == "mock-author"`` branch
+    supplies its system prompt and deny-list unconditionally. Every other
+    source type still gets the long-standing plain ``"work"`` fix.
 
     Returns the new Assignment (already added to ``board.active``), or None
     on failure.
@@ -1016,12 +1126,16 @@ def _dispatch_fix(
     if repo is None:
         return None
 
-    # #1176: preserve the source row's type for a test-author slice fix —
-    # dispatching `type="work"` sends a plain worker that is forbidden from
-    # (and never given the system prompt authorizing) exactly the
-    # `tests/acceptance/**` path it needs to fix. Every other source type
-    # (including today's "work") keeps the long-standing "work" fix.
-    fix_type = "test-author" if work.type == "test-author" else "work"
+    # #1176/#2302: preserve the source row's type for a sealed-path-author
+    # slice fix (test-author, mock-author) — dispatching `type="work"`
+    # sends a plain worker that is forbidden from (and never given the
+    # system prompt authorizing) exactly the `tests/acceptance/**` path it
+    # needs to fix. Derived from SEALED_PATH_AUTHOR_TYPES rather than a
+    # hardcoded string so this stays in sync with that set — see the
+    # FIX_DISPATCH_TYPES comment above for the class of bug that guards
+    # against. Every other source type (including today's "work") keeps
+    # the long-standing "work" fix.
+    fix_type = work.type if work.type in SEALED_PATH_AUTHOR_TYPES else "work"
 
     payload = {
         "repo_name": work.repo_name,
@@ -1054,6 +1168,12 @@ def _dispatch_fix(
         # stay-RED rules a test-author session needs.
         payload["system_prompt"] = TEST_AUTHOR_SYSTEM_PROMPT
         payload["deny_commands"] = test_author_deny_commands(config, work.repo_name)
+    # #2302: no analogous branch for `fix_type == "mock-author"` — unlike
+    # test-author, `agent.py`'s `elif spec.type == "mock-author"` branch
+    # already supplies `MOCK_AUTHOR_SYSTEM_PROMPT` and unconditionally
+    # appends `MOCK_AUTHOR_DENY_COMMANDS` regardless of `spec.deny_commands`,
+    # so injecting either here would be redundant with what the agent-side
+    # dispatch table already does purely from `type="mock-author"`.
     # Escalated model per bounce iteration (None when pipeline
     # .escalate_fix_model is disabled — preserves today's no-model behaviour).
     # The board record keeps the alias for legibility; the wire payload is

{code_coordinator-0.5.106 → code_coordinator-0.5.108}/coord/notify.py

@@ -1053,7 +1053,13 @@ def dispatch_stalled_pipeline_action(
 
     Gated by ``config.pipeline.auto_dispatch_stalled`` (default ``False`` —
     detection/narration via :func:`post_stalled_pipeline` is unconditional;
-    this is the opt-in action half). Mutates *board* in place exactly like
+    this is the opt-in action half) — EXCEPT for a ``review_request_changes_
+    no_fix`` stall on a :data:`coord.models.SEALED_PATH_AUTHOR_TYPES` row
+    (``test-author``/``mock-author``), which dispatches regardless of the
+    flag: no loop owns that row (#2302), so the flag would only leave it
+    stalled forever with no alternative dispatcher to race. ``work`` rows
+    under the same reason keep the opt-in gate — ``coord drive`` owns those.
+    Mutates *board* in place exactly like
     the auto-loop / review-dispatch helpers it delegates to — the caller is
     responsible for persisting it.
 
@@ -1096,7 +1102,23 @@ def dispatch_stalled_pipeline_action(
     mirroring the one-shot comment (#1441's own guardrail, reused rather
     than re-derived per #1478's own request).
     """
-    if not config.pipeline.auto_dispatch_stalled:
+    # #2302: `pipeline.auto_dispatch_stalled` exists to bound blast radius on
+    # rows another loop already owns (`coord drive`'s request-changes → fix
+    # arm for `work` rows, #1692) — a second dispatcher racing that loop
+    # would duplicate or clobber its fix. A `request-changes` stall on a
+    # SEALED_PATH_AUTHOR_TYPES row (`test-author`/`mock-author`, Gate A/JIT
+    # acceptance slices) has no such owner: `coord drive` explicitly `_die()`s
+    # on those, and `coord acceptance mock` dispatches Gate A standalone with
+    # no drive run over it at all (see #2289). So this one reason+type
+    # combination bypasses the flag — every other reason, and `work` rows
+    # under this same reason, keep the opt-in gate unchanged.
+    from coord.models import SEALED_PATH_AUTHOR_TYPES  # noqa: PLC0415
+
+    sealed_author_stall = (
+        detection.reason == "review_request_changes_no_fix"
+        and work.type in SEALED_PATH_AUTHOR_TYPES
+    )
+    if not config.pipeline.auto_dispatch_stalled and not sealed_author_stall:
         return StalledDispatchAction(
             kind="disabled", detail="pipeline.auto_dispatch_stalled is False",
         )

{code_coordinator-0.5.106 → code_coordinator-0.5.108}/coord/providers/claude.py

@@ -120,6 +120,7 @@ class ClaudeProvider(Provider):
             _sealed_write_guard_tools,
             build_deny_prompt,
         )
+        from coord.smoke import SMOKE_SYSTEM_PROMPT  # noqa: PLC0415
 
         binary = self._binary if self._binary is not None else DEFAULT_WORKER_BINARY
 
@@ -170,12 +171,22 @@ class ClaudeProvider(Provider):
                 _sp = spec.system_prompt if spec.system_prompt else MOCK_AUTHOR_SYSTEM_PROMPT
                 _sp += build_deny_prompt(MOCK_AUTHOR_DENY_COMMANDS)
                 _at = "Read,Edit,Write,Bash"
+            elif spec.type == "smoke":
+                # #2301: keep in sync with default_worker_command's identical
+                # branch — smoke gets Read,Bash only, deliberately WITHOUT
+                # Monitor (an await-a-notification tool that ends a smoke
+                # leg's one-shot session before any wake-up can arrive) or
+                # Edit/Write (a smoke leg validates; it never mutates).
+                _sp = spec.system_prompt if spec.system_prompt else SMOKE_SYSTEM_PROMPT
+                _sp += build_deny_prompt(spec.deny_commands)
+                _at = "Read,Bash"
             else:
                 _sp = spec.system_prompt if spec.system_prompt else WORKER_SYSTEM_PROMPT
                 _sp += build_deny_prompt(spec.deny_commands)
                 # #2169: keep in sync with default_worker_command's identical
                 # branch — Monitor is the sanctioned bounded-poll tool for a
-                # backgrounded long-running command.
+                # backgrounded long-running command. #2301: this grant is for
+                # work-shaped legs only — smoke has its own branch above.
                 _at = "Read,Edit,Write,Bash,Monitor"
 
             if system_prompt is None:

{code_coordinator-0.5.106 → code_coordinator-0.5.108}/coord/providers/claude_pty.py

@@ -485,13 +485,26 @@ class ClaudePtyProvider(Provider):
                 _sp = spec.system_prompt if spec.system_prompt else MILESTONE_CHAT_SYSTEM_PROMPT
                 _sp += build_deny_prompt(MILESTONE_CHAT_DENY_COMMANDS)
                 _at = "Read,Bash"
+            elif spec.type == "smoke":
+                # #2301: keep in sync with default_worker_command's and
+                # ClaudeProvider.build_command's identical branch — smoke
+                # gets SMOKE_SYSTEM_PROMPT and Read,Bash only, deliberately
+                # WITHOUT `Monitor` (an await-a-notification tool: calling it
+                # ends the turn, which ends a one-shot leg's session before
+                # any wake-up can arrive) and without Edit/Write (a smoke leg
+                # validates; it never mutates).
+                from coord.smoke import SMOKE_SYSTEM_PROMPT  # noqa: PLC0415
+                _sp = spec.system_prompt if spec.system_prompt else SMOKE_SYSTEM_PROMPT
+                _sp += build_deny_prompt(spec.deny_commands)
+                _at = "Read,Bash"
             else:
                 _sp = spec.system_prompt if spec.system_prompt else WORKER_SYSTEM_PROMPT
                 _sp += build_deny_prompt(spec.deny_commands)
                 # #2169: keep in sync with default_worker_command's and
                 # ClaudeProvider.build_command's identical branch — Monitor
                 # is the sanctioned bounded-poll tool for a backgrounded
-                # long-running command.
+                # long-running command. #2301: that grant is for *work*-shaped
+                # legs only — smoke has its own branch above.
                 _at = "Read,Edit,Write,Bash,Monitor"
 
             if system_prompt is None:

{code_coordinator-0.5.106 → code_coordinator-0.5.108}/coord/smoke.py

@@ -111,13 +111,24 @@ suite off and stopping there prints no marker, so the Test stage records NO \
 verdict and re-dispatches; because the ceiling is deterministic, every \
 re-dispatch does exactly the same thing, which is why this loop bills \
 indefinitely. Instead: POLL the backgrounded task to completion from THIS \
-same session, in bounded steps (`BashOutput`/`TaskOutput` with the id, or \
-`Monitor`), and read its REAL exit status before you report anything. Do NOT \
-use a foreground `until ! pgrep ...; do sleep ...; done` wait — it hits the \
-identical 600s wall. If you genuinely cannot obtain an exit status before you \
-run out of room, print `SMOKE: fail <the smoke command never returned an exit \
-status within this session>` rather than ending mute: a stated verdict is \
-recoverable, silence is not.
+same session, in bounded steps, with `BashOutput`/`TaskOutput` and the task \
+id, and read its REAL exit status before you report anything. Do NOT use a \
+foreground `until ! pgrep ...; do sleep ...; done` wait — it hits the \
+identical 600s wall.
+- NEVER USE `Monitor` OR ANY OTHER AWAIT-A-NOTIFICATION TOOL TO WAIT FOR A \
+RESULT (#2301). Those tools work by ending your turn so the harness can wake \
+the model back up once the condition they're watching fires — that only \
+resumes anything in an INTERACTIVE session. This is a one-shot `claude -p` \
+session: ending your turn ends the session itself, permanently, and no \
+notification will ever arrive to resume it. The backgrounded suite you were \
+polling is then reaped mid-run by the coordinator, and you have printed no \
+verdict marker — exactly the silent failure the previous bullet exists to \
+prevent, just reached by a different tool. Only `BashOutput`/`TaskOutput` \
+return synchronously without ending your turn; those are the only \
+correct way to poll a backgrounded task from here. If you genuinely cannot \
+obtain an exit status before you run out of room, print `SMOKE: fail <the \
+smoke command never returned an exit status within this session>` rather \
+than ending mute: a stated verdict is recoverable, silence is not.
 
 Where you are:
 - You are in a dedicated git worktree created for this run. Every git command \

{code_coordinator-0.5.106 → code_coordinator-0.5.108}/tests/test_agent.py

@@ -1134,6 +1134,64 @@ def test_default_worker_command_resume_flag_present() -> None:
     assert argv[idx + 1] == "ses-abc123"
 
 
+# ── #2301: smoke legs must not hold Monitor (or Edit/Write) ────────────────
+#
+# Root cause: smoke fell through to the generic `else` branch and inherited
+# the #2169 `Monitor` grant meant for *work*-shaped legs. `Monitor` is an
+# await-a-notification tool — calling it ends the current turn to wait for a
+# wake-up condition, which only resumes anything in an INTERACTIVE session.
+# Every coord leg, smoke included, is a one-shot `claude -p` session (#1394):
+# ending the turn ends the session itself, permanently, before any
+# notification can arrive. Two real smoke legs did exactly this — reached
+# `Monitor` via ToolSearch to poll a backgrounded `cargo test`, ended their
+# turn to "wait" for it, and died 16-24s later with no verdict printed, while
+# the backgrounded suite was reaped out from under them ~30s after that.
+
+
+def _smoke_spec(**overrides) -> AssignmentSpec:
+    base = dict(
+        repo_name="api",
+        repo_path="/tmp/repo",
+        issue_number=2301,
+        issue_title="[smoke] t",
+        briefing="b",
+        branch="main",
+        type="smoke",
+    )
+    base.update(overrides)
+    return AssignmentSpec(**base)
+
+
+def test_default_worker_command_smoke_type_does_not_grant_monitor() -> None:
+    argv = default_worker_command(_smoke_spec())
+    allowed = argv[argv.index("--allowedTools") + 1].split(",")
+    assert "Monitor" not in allowed
+
+
+def test_default_worker_command_smoke_type_gets_read_bash_only() -> None:
+    """A smoke leg validates; it never mutates — no Edit/Write either."""
+    argv = default_worker_command(_smoke_spec())
+    allowed = argv[argv.index("--allowedTools") + 1]
+    assert allowed == "Read,Bash"
+
+
+def test_default_worker_command_smoke_type_uses_smoke_system_prompt() -> None:
+    """Confirms the smoke branch's default system prompt is
+    coord.smoke.SMOKE_SYSTEM_PROMPT, not the generic WORKER_SYSTEM_PROMPT
+    the old fall-through `else` branch would have used."""
+    from coord.smoke import SMOKE_SYSTEM_PROMPT
+
+    argv = default_worker_command(_smoke_spec())
+    system_prompt = argv[argv.index("--system-prompt") + 1]
+    assert system_prompt.startswith(SMOKE_SYSTEM_PROMPT)
+
+
+def test_default_worker_command_smoke_type_honours_explicit_system_prompt() -> None:
+    argv = default_worker_command(_smoke_spec(system_prompt="custom smoke prompt"))
+    system_prompt = argv[argv.index("--system-prompt") + 1]
+    assert system_prompt.startswith("custom smoke prompt")
+
+
 # ── #1315: structural sealing enforcement (write-guard) ─────────────────────