Records why the v2.0 classifier taxed the user 22 prompts and what changed.
Root cause: v2.0 conflated "contains a redirect character" with "writes
something". `2>&1` is file-descriptor plumbing and `>/dev/null` is a discard —
neither writes. That single mistake caused 16 of the 22 prompts. It was found
by reading ca_decisions.jsonl, not by inspection: the bug was the classifier's
reasoning, so re-reading the code only reproduced it.
v2.1 changes (all evidence-driven, none speculative):
- _SAFE_REDIRECT_RE strips fd plumbing + /dev/null discards before the
redirect check; a redirect to any REAL path still disqualifies, anchored so
`>/dev/nullx` cannot ride the prefix.
- `cd` added to READONLY_ALLOW (no filesystem effect; every other segment must
independently qualify anyway).
- `ssh <host> '<cmd>'` classifies the inner command under identical rules,
depth-limited to one hop.
Verified: 42/42 self-test, e2e ALL PASS, classify() median 0.011ms.
Tier-1 writes deliberately NOT shipped — widen on evidence, not guesses.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- constrained_autonomy_design_decisions.md: D1-D8 locked (hybrid hook
classifier + Agent-Sudo daemon executor, structural classification with
unknown->sandbox, fail-closed, Hermes recovery ladder) + EXECUTION ORDER
with CA-P1a inserted as zero-dependency item 0
- agent_prompts.md shared block: replace "TIER-2 IS BROKEN" with the
corrected root cause (old primary bridge's NTFY endpoint was unreachable;
tier-2 works when the bridge reaches ntfy + user is attended)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- P0 build prompt now does Part A (command_audit schema) + Part B
(read-only audit of all P1-P5 assumptions) + Part C (remediate safe
findings = all of P1: Incus install, host inventories, build-sandbox.sh,
both sandbox mirrors)
- Golden Rule: only remediate read-only or server-01-sandbox findings;
tier-2/manual-auth or prod-touching → batched, never blocked
- Ends with a BUILD READINESS wrap-up so the focused build starts at P2
- P1 section retained as canonical contract reference, marked folded-in
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Agent Builder: added Step 2 (fetch required_playbooks from Gitea URLs), added
mandatory claude_agent prompt design rules to Ollama prompt (--max-turns 15,
loop detection, credential map inline, defined output), added Step 6 synchronous
human NTFY gate for claude_agent prompt review before sandbox testing.
N8N Builder: same required_playbooks fetch step, added Step 8 synchronous human
NTFY gate for any workflow containing a claude -p node.
Both changes prevent runaway token loops in built automations by ensuring every
generated claude -p call has hard stops baked in and user-reviewed before deploy.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
allowlist.json must be root-owned so POST /allowlist is the only write
path; direct file edit bypasses audit log and danger veto. No cross-
bridge sync — allowlists grow organically per server.
All prereqs confirmed live on server-01. Full automation_ideas priority reorder (p1–p17 non-blocked,
p20–p29 blocked). Added id=67 N8N Builder Agent. id=57 expanded to full production mirror scope.
June 19: manual infrastructure day (id=51 + id=57). June 22: builder agents extended session.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Initial commit tracking session context, playbooks, and automation specs
for claude-config and agent-builder Claude Code conversations.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Backtalk6858