fix(settings): retire the Write memory deny the harness cannot match #1244

Merged

coilyco-ops merged 1 commit from aos/claude/sy55 into main

2026-08-25 23:16:49 +00:00

coilyco-ops commented

2026-08-25 23:13:49 +00:00

Owner

Claude Code matches file permission rules on the Edit(path) spelling, which covers Write, Edit, MultiEdit, and NotebookEdit alike. Write(path) matches nothing, so the fleet deny list carried a dead rule that the harness warned about at every session start while the sibling Edit rule did all the work.

Dropping it from BASE_DENIED_PERMISSIONS is not enough on its own, because the merge is append-only and every host that already converged the rule keeps it forever. RETIRED_DENIED_PERMISSIONS is the narrow counterpart: an explicit list of dead spellings the merge prunes, leaving operator rules untouched.

Enforcement is unchanged. The memory directory stays denied through the Edit rule, which is the spelling the file permission check actually reads.

Verified with a --dry-run against a converged host: the merged deny list comes back with the Edit rule alone. just test is green at 719 passed, and the full pre-commit suite passes.

The matching one-line removal in infrastructure/.claude/settings.json goes up separately, since that repo carries its own repo-local copy.

Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com

Claude Code matches file permission rules on the `Edit(path)` spelling, which covers Write, Edit, MultiEdit, and NotebookEdit alike. `Write(path)` matches nothing, so the fleet deny list carried a dead rule that the harness warned about at every session start while the sibling `Edit` rule did all the work. Dropping it from `BASE_DENIED_PERMISSIONS` is not enough on its own, because the merge is append-only and every host that already converged the rule keeps it forever. `RETIRED_DENIED_PERMISSIONS` is the narrow counterpart: an explicit list of dead spellings the merge prunes, leaving operator rules untouched. Enforcement is unchanged. The memory directory stays denied through the `Edit` rule, which is the spelling the file permission check actually reads. Verified with a `--dry-run` against a converged host: the merged deny list comes back with the `Edit` rule alone. `just test` is green at 719 passed, and the full pre-commit suite passes. The matching one-line removal in `infrastructure/.claude/settings.json` goes up separately, since that repo carries its own repo-local copy. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

coilyco-ops added 1 commit

2026-08-25 23:13:49 +00:00

fix(settings): retire the Write memory deny the harness cannot match

ci / aos-cli-tests (pull_request) Successful in 18s

Details

ci / aos-eval-tests (pull_request) Successful in 6s

Details

ci / ward-doctor (pull_request) Successful in 5s

Details

ci / gate (pull_request) Successful in 45s

Details

4fbd17d8d8

Claude Code matches file permission rules on the Edit(path) spelling, which
covers Write, Edit, MultiEdit, and NotebookEdit alike. Write(path) matches
nothing, so the fleet deny list carried a dead rule that the harness warned
about at every session start while the sibling Edit rule did all the work.

Dropping it from BASE_DENIED_PERMISSIONS is not enough on its own, because
the merge is append-only and every host that already converged the rule keeps
it forever. RETIRED_DENIED_PERMISSIONS is the narrow counterpart: an explicit
list of dead spellings the merge prunes, leaving operator rules untouched.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: Kai Siren <coilysiren@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>
Agent-Role: platform

coilyco-ops referenced this pull request from coilyco-flight-deck/infrastructure

2026-08-25 23:16:19 +00:00

fix(claude): drop the Write memory deny the harness cannot match #936

coilyco-ops merged commit 52f536247d into main

2026-08-25 23:16:49 +00:00

coilyco-ops deleted branch aos/claude/sy55

2026-08-25 23:16:50 +00:00

coilyco-ops referenced this pull request from a commit

2026-08-25 23:16:50 +00:00

fix(settings): retire the Write memory deny the harness cannot match (#1244)

coilyco-ops referenced this pull request from coilyco-flight-deck/infrastructure

2026-08-25 23:17:36 +00:00