finding (ops-gh): 2026-05-08 - Agent burned three bare gh issue create denials before reaching for coily ops gh #33
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally filed by @coilysiren on 2026-05-18T03:42:51Z - https://github.com/coilysiren/coily/issues/224
Migrated from
coily-ops-gh-meta/findings/2026-05-08-three-bare-gh-denials-before-wrapper-reach.mdon 2026-05-17 as part of coilysiren/coily#215. Original file preserved in git history; see deletion commit on coilysiren/coily#215.2026-05-08 - Agent burned three bare
gh issue createdenials before reaching forcoily ops ghWhat was observed
In a single turn the agent tried three permutations of bare
gh issue createagainstcoilysiren/coilyand got the harness "Permission to use Bash with command X has been denied" message each time. After the third denial the agent surfaced the question to Kai instead of routing throughcoily ops gh. Kai had to instruct the agent explicitly that bare-command denials should retry via the coily wrapper, and that any denial in any context warrants acoily audit finding.Concrete denied argv shapes from this turn (no audit row exists - denial is at the Claude Code permission layer, before coily is invoked):
gh issue create --repo coilysiren/coily --title "..." --body "..."gh issue create --repo coilysiren/coily --title "..." --body "..."(shorter body, retry)gh issue create -R coilysiren/coily -t "..." -b "..."(short flags, retry)Once routed through
coily --commit-scope=/Users/kai/projects/coilysiren/coily ops gh issue create ..., the call passed argv validation and reached gh, which then failed upstream with a GitHub GraphQL rate-limit error (exit_code=3, kind=upstream_failed). The wrapper path was the right path; the harness denial taught the agent the wrong lesson on the first three attempts.Why it slipped
Same root gap as 2026-05-05-claude-bypasses-coily-gh-wrapper: the harness deny message does not name
coily ops ghas the alternative, and the operating-context doc (AGENTS.md "Coily permission discipline") read denial-as-stop without carving out the wrapper-retry case. The agent's stop-on-denial rule was correctly triggered for the lockdown/security-config edge, but applied too broadly to ordinary external commands the wrapper exists for.This finding is the second data point in 4 days for the same shape. The 2026-05-05 finding was a 35-day sweep; this one is a single live turn. Frequency confirms the rule has not been internalized from the 2026-05-05 finding alone.
Rule it produced
Sequencing rule, now landed in
agentic-os-kai/AGENTS.md"Coily permission discipline": when the harness denies a bare external command (gh,aws,kubectl,docker,tailscale), retry through the coily wrapper rather than stopping. Any harness denial - in any context - also triggers acoily audit findingso the meta-improvement loop sees the friction.The carve-out preserves the original "denial means stop" rule for the cases it was written for:
coily lockdown,.claude/settings*.jsonhand-edits, deny-loosening operations. Those still stop on denial.