Implementation Plan: T5-P5-A3-WP3 Make the INVARIANT_REGISTRY Reflect Actual Enforcement Reality#4152
Merged
Trecek merged 1 commit intoJun 29, 2026
Conversation
… guards Change `recipe-read-headless` and `write-path-prefix` entries from `enforcement_layer="hook-deny"` to `enforcement_layer="server-side"` to reflect the actual enforcement reality: P5-A3-WP1 (commit c9ed35e) added `_check_recipe_read_prohibition()` and `_check_write_target_boundary()` in `server/_guards.py`, which are injected into `run_cmd` and `run_python` tool handlers. Add two pin tests asserting the new `server-side` values for both entries.
Trecek
commented
Jun 29, 2026
Trecek
left a comment
Trecek
left a comment
Collaborator
Author
There was a problem hiding this comment.
AutoSkillit PR Review — Verdict: approved
Trecek
deleted the
t5-p5-a3-wp3-make-the-invariant-registry-reflect-the-actual/4035
branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Update two
INVARIANT_REGISTRYentries —recipe-read-headlessandwrite-path-prefix— to haveenforcement_layer="server-side"instead of"hook-deny". This reflects the actual enforcement reality: P5-A3-WP1 (commitc9ed35e3d, PR #4105) added server-side guards_check_recipe_read_prohibition()and_check_write_target_boundary()inserver/_guards.py, which are injected intorun_cmdandrun_pythontool handlers inserver/tools/tools_execution.py. The registry entries still say"hook-deny"— this WP updates them to match reality. Add two pin tests asserting the new values.Implementation Plan
Plan file:
/home/talon/projects/autoskillit-runs/impl-20260628-200621-936012/.autoskillit/temp/make-plan/t5-p5-a3-wp3-invariant-registry-enforcement-layer_plan_2026-06-28_201500.mdCloses #4035
🤖 Generated with Claude Code via AutoSkillit
Token Usage Summary
* Step used a non-Anthropic provider; caching behavior may differ.
Token Efficiency
Model Usage Breakdown