fix(agents): apply harness review findings

[furedea]

Summary

Applies the agents/ harness review findings tracked in #148, apart from the items listed under Departures.

Hook adapters

• Moved the logic shared by the Codex, Devin, pi, and Hermes adapters into agents/hooks/lib/provider_adapter.py. Each adapter now only declares a Profile.
• Made the Devin adapter executable. It was mode 100644, so its hooks could not run.
• Fixed where the adapters had drifted apart:
  • All four now pass normalized payloads.
  • The secret-path label is renamed to guard_secret_paths.sh.
  • Hermes no longer mutates its input.
  • Devin and Hermes log session-start compaction only for compact/resume sources.
  • pi compaction events are now recorded.
• The Claude file guard and lint now cover NotebookEdit. The read guard covers Grep when its path is a single file.

Sandbox and permissions

• Claude: sandbox.allowUnsandboxedCommands is now false.
  • The sandbox write allowance used $HOME/.cache/nix, which Claude does not expand, so it never applied. It is now ~/.cache/nix, and ~/.cache/uv is added.
  • gh runs outside the sandbox because it needs hosts.yml. herdr also runs outside because its socket is denied.
  • herdr commands that drive other panes now ask first. The earlier send rules did not match send-text or send-keys, and agent prompt had no rule, so another agent's approval dialog could be answered without asking.
  • ~/.local/state/agent-harness (verification records) and the dprint cache are writable, so verify runs inside the sandbox.
  • lefthook moves to 2.x (nixpkgs-unstable). 1.13.6 always ran hook commands under a pty, and the sandbox denies that. Verified inside the sandbox: pre-commit and commitlint run under lefthook 2.1.10.
• The secret read denials **/*key* and **/*token* also matched source files such as .venv/.../pygments/token.py, so pytest could not start in the sandbox. They are now limited to credential-shaped names (*.key, *_token, *token*.json, *.pem, and so on).
• docker build moves from allow to ask.
• Codex:
  • Removed the unknown remote_connections feature.
  • Kept external_migration, because codex 0.155.1 still reads it.
  • Enabled multi_agent_v2 so its wait timeouts take effect.
• Added git to the manifest runtime_commands.

Nix

• git cc: codex exec --full-auto became -s read-only, because the flag was removed.
• Removed the unguarded opencode package.
• New contracts check both changes.

Skills

• project-setup can now be loaded implicitly.
• PRs are created with an explicit body.
• adr's triggers are now in its description.
• The Issue body, glossary, and completion rules each have a single owner.
• Removed generic or drifted content from tsdd, nix-dotfiles, python-style, rust-style, bash-style, and github-actions-style.
• verify_page.py now detects SVG image/use, embed, track, input type=image, and meta refresh loads.
• test_workflow_skill_layout.py was tied to past changes. It now runs contract tests over every skill: frontmatter, links and anchors, and handoff targets.

Verification selection

• If every changed source of a language is explicitly mapped to another language's tests, that language is no longer planned. For example, agent-harness hook_bridge.ts is embedded with include_str! and tested by Rust. Unmapped sources still require their own runner and fail closed.

Refs #148

Verification

• verification_session.py verify: pytest 1490 passed (full suite), bats 13 passed.
• nix build of the home activation package plus the home-configuration and host-configuration checks succeeded.
• lefthook pre-commit passed on every commit.

Departures

• The AGENTS.md function-size rule was reviewed with the user before it was changed, as a separate step. The 2-4 line and one-level nesting quotas become an intent-based extraction rule, with nesting kept to about two levels.
• Protecting provider files other than Claude/Codex, and isolating the pi bridge interpreter, are handled in fix: protect every rendered provider file and isolate the pi hook bridge agent-harness#140. flake.lock needs a bump after that PR merges.
• herdr-delegation was not split into references/. That item was optional.

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.