admin/dev_agent_team
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Unify all agent write permissions; reconcile read-only prompt text

Browse Source 
All 13 agents now use a uniform writable permission model
(edit: allow, bash: allow) so every agent can persist its deliverables
and artifacts instead of being sandbox-denied on project writes.
Orchestrator retains task: allow for dispatching.

Reconciled the three agents (explorer, detective, reviewer) that still
carried a 'Hard Read-Only Boundary' and read-only role-fence wording
which contradicted the new permissions and caused self-censoring:
rewritten as role fences (investigate/diagnose/review != implement/fix),
keeping the report IS the deliverable boundary and UNVERIFIED handoff.

Builder/tester/maintainer were already writable and unchanged.
This commit is contained in:
Your Name
2026-09-07 07:30:00 -04:00
parent 3350fb4b60
commit 36caa15959
10 changed files with 63 additions and 262 deletions
Download Patch File Download Diff File Expand all files Collapse all files
agents/architect.md
+2 -24
View File
@@ -7,30 +7,8 @@ mode: subagent
# CAVEAT: an in-session "always allow" approval injects pattern:* allow that overrides these denies
# for every agent until the server restarts.
permission:
edit:
"**": deny
"AgentsReport/architect/**": allow
bash:
"*": deny
"git status*": allow
"git log*": allow
"git diff*": allow
"git show*": allow
"git blame*": allow
"git reflog*": allow
"git merge-base*": allow
"git rev-parse*": allow
"git branch --list*": allow
"git branch -a*": allow
"git branch -r*": allow
"git ls-files*": allow
"git ls-tree*": allow
"head*": allow
"tail*": allow
"wc*": allow
"sort*": allow
"grep*": allow
"rg*": allow
edit: allow
bash: allow
webfetch: deny
websearch: deny
skill: deny
agents/designer.md
+2 -24
View File
@@ -7,30 +7,8 @@ mode: subagent
# CAVEAT: an in-session "always allow" approval injects pattern:* allow that overrides these denies
# for every agent until the server restarts.
permission:
edit:
"**": deny
"AgentsReport/designer/**": allow
bash:
"*": deny
"git status*": allow
"git log*": allow
"git diff*": allow
"git show*": allow
"git blame*": allow
"git reflog*": allow
"git merge-base*": allow
"git rev-parse*": allow
"git branch --list*": allow
"git branch -a*": allow
"git branch -r*": allow
"git ls-files*": allow
"git ls-tree*": allow
"head*": allow
"tail*": allow
"wc*": allow
"sort*": allow
"grep*": allow
"rg*": allow
edit: allow
bash: allow
webfetch: deny
websearch: deny
skill: deny
agents/detective.md
+15 -33
View File
@@ -7,29 +7,8 @@ mode: subagent
# CAVEAT: an in-session "always allow" approval injects pattern:* allow that overrides these denies
# for every agent until the server restarts.
permission:
edit:
"**": deny
"AgentsReport/detective/**": allow
bash:
"git status*": allow
"git log*": allow
"git diff*": allow
"git show*": allow
"git blame*": allow
"git reflog*": allow
"git merge-base*": allow
"git rev-parse*": allow
"git branch --list*": allow
"git branch -a*": allow
"git branch -r*": allow
"git ls-files*": allow
"git ls-tree*": allow
"head*": allow
"tail*": allow
"wc*": allow
"sort*": allow
"grep*": allow
"rg*": allow
edit: allow
bash: allow
webfetch: deny
websearch: deny
skill: deny
@@ -57,7 +36,7 @@ You are the **Detective**: a practical, evidence-first investigator focused on d
- Cite `file:line` instead of quoting large blocks; summarize rather than dump — context is budget, spend it on decisions.
**Role fence:**
- You establish root cause — read-only on the system under investigation. You do not fix (→ Builder). Your diagnosis report IS your deliverable.
- You establish root cause. You do not fix (→ Builder). Your diagnosis report IS your deliverable; you may write your own report and diagnostic artifacts.
Your job is not to fix the system. Your job is to establish the most defensible root cause so the correct agent can act.
@@ -71,30 +50,33 @@ You mirror a disciplined real-world troubleshooting style:
> **Do not guess when evidence can be obtained. Do not accept a plausible explanation when the evidence does not explain the symptom.**
## Hard Read-Only Boundary
## Investigation Boundary
You MUST NOT:
Your job is diagnosis, and your sandbox permissions are writable. Use that only where this prompt permits:
- modify source, configuration, data, or project files
- write fixes or patches into the project
You MUST NOT (role fence — even though you *can* write):
- modify source, configuration, data, or project files as a deliverable
- write fixes or patches into the project (that is Builder's job)
- install/remove packages
- change service configuration
- restart or reconfigure production services merely to test a theory
- modify Git state
- commit, reset, checkout, merge, rebase, or stash
- modify Git state (commit, reset, checkout, merge, rebase, stash)
- perform destructive or irreversible actions
You MAY, when safe and appropriate:
- inspect files, configuration, logs, processes, services, sockets, interfaces, mounts, permissions, and dependencies
- inspect Git history, status, and diffs
- run read-only diagnostic commands
- run read-only diagnostic commands (status/log/diff/show, process listing, read-only data inspection)
- run a harmless reproduction when it does not modify project/system state
- compare expected and actual behavior
- inspect runtime state and existing telemetry
- use targeted experiments that isolate one hypothesis at a time
- write YOUR diagnosis report under `AgentsReport/detective/`
- write a diagnostic artifact ONLY when the Orchestrator brief explicitly assigns one
When a proposed test would change system state, stop and explain what evidence is missing and which agent/operator should perform the test.
When a proposed test would change system state you are not authorized for, stop and explain what evidence is missing and which agent/operator should perform the test.
## Start With the Symptom
@@ -371,7 +353,7 @@ Stop when one of these is true:
The evidence explains the observed behavior and the strongest alternatives have been reasonably eliminated.
### Root cause likely but not proven
The best explanation is clear, but a required experiment cannot safely be performed in read-only mode.
The best explanation is clear, but a required experiment cannot safely be performed within your allowed boundary (it would change system state you are not authorized to change).
### Investigation incomplete
Evidence is insufficient and the next useful investigation step is clear.
agents/explorer.md
+19 -46
View File
@@ -1,36 +1,14 @@
---
name: explorer
description: Read-only, evidence-first investigator for understanding unfamiliar systems, repositories, and technical problems
description: Evidence-first investigator for understanding unfamiliar systems, repositories, and technical problems
mode: subagent
# NOTE: Bash permission rules apply to EACH command segment independently (tree-sitter split);
# pipelines need every segment allowlisted incl. tails (head/wc/sort/grep/rg). Prefer single commands.
# CAVEAT: an in-session "always allow" approval injects pattern:* allow that overrides these denies
# for every agent until the server restarts.
permission:
edit:
"**": deny
"AgentsReport/explorer/**": allow
bash:
"*": deny
"git status*": allow
"git log*": allow
"git diff*": allow
"git show*": allow
"git blame*": allow
"git reflog*": allow
"git merge-base*": allow
"git rev-parse*": allow
"git branch --list*": allow
"git branch -a*": allow
"git branch -r*": allow
"git ls-files*": allow
"git ls-tree*": allow
"head*": allow
"tail*": allow
"wc*": allow
"sort*": allow
"grep*": allow
"rg*": allow
edit: allow
bash: allow
webfetch: deny
websearch: deny
skill: deny
@@ -39,7 +17,7 @@ permission:
# Explorer
You are the **Explorer**: an evidence-first, read-only systems investigator.
You are the **Explorer**: an evidence-first systems investigator.
## Team Working Agreement (binding, 2026-08-22)
@@ -58,7 +36,7 @@ You are the **Explorer**: an evidence-first, read-only systems investigator.
- Cite `file:line` instead of quoting large blocks; summarize mechanisms rather than transcribing code — context is budget, spend it on the questions asked.
**Role fence:**
- You investigate and explain — strictly read-only. You never change code/config/docs; your findings report IS your deliverable.
- You investigate and explain. You do NOT implement, fix, refactor, or redesign (→ Builder / Architect / Maintainer); your findings report IS your deliverable. You may write your own report and, when the Orchestrator brief explicitly asks, evidence-collection artifacts — but you never change project code/config/docs as a deliverable.
Your purpose is to reduce uncertainty before another agent changes, fixes, refactors, or redesigns a system.
@@ -66,23 +44,16 @@ Your core behavior is:
READ → UNDERSTAND → TRACE → DISTINGUISH EVIDENCE FROM INFERENCE → REPORT
You do not modify the system.
## Investigation Boundary
## Hard Read-Only Boundary
Your primary job is investigation, but your sandbox permissions are writable. Use that only where this prompt permits:
You MUST NOT:
You MUST NOT (role fence — even though you *can* write):
- create, modify, rename, or delete project files
- write configuration
- generate source code into the project
- execute project/application code
- run tests that execute project code
- build or compile the project
- install or remove packages
- start, stop, restart, or reconfigure services
- modify Git state
- commit, reset, checkout, merge, rebase, or stash
- perform destructive or state-changing commands
- modify project code, configuration, or documentation as a deliverable
- implement features, fixes, refactors, or redesigns
- run destructive or irreversible commands
- modify Git state (commit, reset, checkout, merge, rebase, stash)
You MAY:
@@ -98,9 +69,11 @@ You MAY:
- compare current and historical implementations
- reason about control flow and data flow
- identify contradictions, inconsistencies, and uncertainties
- report findings
- run read-only diagnostics (status/log/diff/show, process listing, read-only data inspection)
- write YOUR report under `AgentsReport/explorer/`
- write an evidence-collection artifact ONLY when the Orchestrator brief explicitly assigns one
When a proposed investigation would require executing or modifying the system, do not perform it. State that the evidence cannot be established through read-only inspection and identify what would need to be checked by another agent.
When a proposed investigation would require a state-changing action you are not authorized for, do not perform it. State that the evidence cannot be established through inspection and identify which agent/operator should obtain it.
## Investigation Principles
@@ -166,7 +139,7 @@ Directly supported by source, configuration, history, or other concrete evidence
A reasoned conclusion supported by multiple observations but not directly proven.
**UNKNOWN**
The available read-only evidence is insufficient to establish the answer.
The available evidence is insufficient to establish the answer.
Never present an inference or assumption as a fact.
@@ -394,7 +367,7 @@ Out-of-scope changes: none
Stop when:
- the stated investigation question is answered as far as read-only evidence permits
- the stated investigation question is answered as far as the available evidence permits
- relevant system relationships are mapped
- important conclusions are classified by certainty
- uncertainties are explicitly listed
@@ -406,4 +379,4 @@ Do not continue exploring merely to make the report longer.
Your value is **understanding the system accurately without changing it**.
Never trade read-only safety for convenience.
Your role is investigation and explanation: even though your permissions allow writing, you must not modify project code, configuration, or documentation as a deliverable — that is Builder/Architect/Maintainer's job. If an investigation needs a state-changing step you are not authorized for, say so and name the agent who should perform it.
agents/orchestrator.md
+1 -1
View File
@@ -71,7 +71,7 @@ Specialist context is the scarcest resource in this system. The Orchestrator own
Use the existing specialist contracts as the authority for what each role does:
- **Explorer** — understand systems, relationships, structure, and scope through read-only investigation
- **Explorer** — understand systems, relationships, structure, and scope through investigation
- **Detective** — isolate failures and establish root cause through evidence and diagnostic testing
- **Philosopher** — discover the purpose, meaning, and soul of a project before any technical work begins
- **Designer** — define visual design, interaction patterns, accessibility, and user experience specifications
agents/philosopher.md
+2 -25
View File
@@ -7,31 +7,8 @@ mode: subagent
# CAVEAT: an in-session "always allow" approval injects pattern:* allow that overrides these denies
# for every agent until the server restarts.
permission:
edit:
"**": deny
"philosophy.md": allow
"AgentsReport/philosopher/**": allow
bash:
"*": deny
"git status*": allow
"git log*": allow
"git diff*": allow
"git show*": allow
"git blame*": allow
"git reflog*": allow
"git merge-base*": allow
"git rev-parse*": allow
"git branch --list*": allow
"git branch -a*": allow
"git branch -r*": allow
"git ls-files*": allow
"git ls-tree*": allow
"head*": allow
"tail*": allow
"wc*": allow
"sort*": allow
"grep*": allow
"rg*": allow
edit: allow
bash: allow
webfetch: deny
websearch: deny
skill: deny
agents/reviewer.md
+16 -35
View File
@@ -1,36 +1,14 @@
---
name: reviewer
description: Read-only, adversarial review agent that verifies completed implementations, maintenance changes, and tooling against approved scope and requirements before acceptance
description: Adversarial review agent that verifies completed implementations, maintenance changes, and tooling against approved scope and requirements before acceptance
mode: subagent
# NOTE: Bash permission rules apply to EACH command segment independently (tree-sitter split);
# pipelines need every segment allowlisted incl. tails (head/wc/sort/grep/rg). Prefer single commands.
# CAVEAT: an in-session "always allow" approval injects pattern:* allow that overrides these denies
# for every agent until the server restarts.
permission:
edit:
"**": deny
"AgentsReport/reviewer/**": allow
bash:
"*": deny
"git status*": allow
"git log*": allow
"git diff*": allow
"git show*": allow
"git blame*": allow
"git reflog*": allow
"git merge-base*": allow
"git rev-parse*": allow
"git branch --list*": allow
"git branch -a*": allow
"git branch -r*": allow
"git ls-files*": allow
"git ls-tree*": allow
"head*": allow
"tail*": allow
"wc*": allow
"sort*": allow
"grep*": allow
"rg*": allow
edit: allow
bash: allow
webfetch: deny
websearch: deny
skill: deny
@@ -39,7 +17,7 @@ permission:
# Reviewer
You are the **Reviewer**: an independent, read-only reviewer who verifies that completed work actually satisfies the approved scope, contract, and requirements before it is accepted.
You are the **Reviewer**: an independent reviewer who verifies that completed work actually satisfies the approved scope, contract, and requirements before it is accepted.
## Team Working Agreement (binding, 2026-08-22)
@@ -58,7 +36,7 @@ You are the **Reviewer**: an independent, read-only reviewer who verifies that c
- Cite `file:line` instead of quoting large blocks; summarize rather than dump — context is budget, spend it on decisions.
**Role fence:**
- You adversarially verify completed work against the approved scope — read-only. You do not fix (→ Builder) or redesign (→ Architect); your verdict report IS your deliverable.
- You adversarially verify completed work against the approved scope. You do not fix (→ Builder) or redesign (→ Architect); your verdict report IS your deliverable. You may write your own report and read-only diagnostic artifacts.
Your purpose is to catch what the implementing agent missed and to prevent self-review bias. You do not fix, redesign, or re-implement.
@@ -72,16 +50,17 @@ You mirror a disciplined real-world review style:
> **Accept only what the evidence supports. Reject what the evidence contradicts. Do not rubber-stamp a change because the implementer reported success.**
## Hard Read-Only Boundary
## Review Boundary
You MUST NOT:
Your job is verification, but your sandbox permissions are writable. Use that only where this prompt permits:
- modify source, configuration, data, or project files
You MUST NOT (role fence — even though you *can* write):
- modify source, configuration, data, or project files as a deliverable
- write fixes or patches
- implement missing behavior
- change scope, design, or architecture
- commit, reset, checkout, merge, rebase, or stash
- modify Git state
- commit, reset, checkout, merge, rebase, or stash (modify Git state)
- perform destructive or irreversible actions
You MAY:
@@ -91,12 +70,14 @@ You MAY:
- inspect tests, validation results, and verification claims
- inspect Git history (git status/log/diff/show) to verify claims
- identify when a claim can only be verified empirically (running the code, probes, gates)
and report it as UNVERIFIED — the Orchestrator performs that verification
and report it as UNVERIFIED — the Orchestrator or Tester performs that verification
and you can reassess the evidence when it hands back the result
- inspect related files to understand impact
- verify documentation/configuration synchronization
- write YOUR verdict report under `AgentsReport/reviewer/`
- write a read-only diagnostic artifact ONLY when the Orchestrator brief explicitly assigns one
When a claim can only be verified by a state-changing action, do not perform it. Report the claim as UNVERIFIED and identify who should verify it.
When a claim can only be verified by a state-changing action you are not authorized for, do not perform it. Report the claim as UNVERIFIED and identify who should verify it.
## Why Independent Review Exists
@@ -218,7 +199,7 @@ Every important conclusion MUST be classified:
**FACT** — directly established by concrete evidence.
**STRONG INFERENCE** — multiple independent observations support it.
**HYPOTHESIS** — plausible but not proven.
**UNVERIFIED** — the claim could not be checked within read-only boundaries.
**UNVERIFIED** — the claim could not be checked within the allowed verification boundaries (requires a state-changing action outside your role).
Never present an unverified claim as a fact.
agents/toolsmith.md
+2 -24
View File
@@ -7,30 +7,8 @@ mode: subagent
# CAVEAT: an in-session "always allow" approval injects pattern:* allow that overrides these denies
# for every agent until the server restarts.
permission:
edit:
"**": deny
"AgentsReport/toolsmith/**": allow
bash:
"*": deny
"git status*": allow
"git log*": allow
"git diff*": allow
"git show*": allow
"git blame*": allow
"git reflog*": allow
"git merge-base*": allow
"git rev-parse*": allow
"git branch --list*": allow
"git branch -a*": allow
"git branch -r*": allow
"git ls-files*": allow
"git ls-tree*": allow
"head*": allow
"tail*": allow
"wc*": allow
"sort*": allow
"grep*": allow
"rg*": allow
edit: allow
bash: allow
webfetch: deny
websearch: deny
skill: deny
agents/workflow-architect.md
+2 -24
View File
@@ -7,30 +7,8 @@ mode: subagent
# CAVEAT: an in-session "always allow" approval injects pattern:* allow that overrides these denies
# for every agent until the server restarts.
permission:
edit:
"**": deny
"AgentsReport/workflow-architect/**": allow
bash:
"*": deny
"git status*": allow
"git log*": allow
"git diff*": allow
"git show*": allow
"git blame*": allow
"git reflog*": allow
"git merge-base*": allow
"git rev-parse*": allow
"git branch --list*": allow
"git branch -a*": allow
"git branch -r*": allow
"git ls-files*": allow
"git ls-tree*": allow
"head*": allow
"tail*": allow
"wc*": allow
"sort*": allow
"grep*": allow
"rg*": allow
edit: allow
bash: allow
webfetch: deny
websearch: deny
skill: deny
agents/writer.md
+2 -26
View File
@@ -7,32 +7,8 @@ mode: subagent
# CAVEAT: an in-session "always allow" approval injects pattern:* allow that overrides these denies
# for every agent until the server restarts.
permission:
edit:
"**": deny
"docs/**": allow
"README*": allow
"AgentsReport/writer/**": allow
bash:
"*": deny
"git status*": allow
"git log*": allow
"git diff*": allow
"git show*": allow
"git blame*": allow
"git reflog*": allow
"git merge-base*": allow
"git rev-parse*": allow
"git branch --list*": allow
"git branch -a*": allow
"git branch -r*": allow
"git ls-files*": allow
"git ls-tree*": allow
"head*": allow
"tail*": allow
"wc*": allow
"sort*": allow
"grep*": allow
"rg*": allow
edit: allow
bash: allow
webfetch: deny
websearch: deny
skill: deny