Both authored in good faith, both logging as if they worked, both inert in production. The #3307 theme, again: writes to CC contracts nobody verified against the binary.
#3310 context-gate "blocked" spawns with a PreToolUse envelope
on a SubagentStart event — CC reads NOTHING of that shape.
The cap has never fired. Once.
#3311 a full sandbox block: failIfUnavailable, filesystem denies,
20 blocked egress domains — and the key "enabled" is ABSENT.
All of it inert. And 0 of 21 permission denies were Read().
Over-limit paths now ADVISE via { continue:true, systemMessage }, a shape CC
accepts on every event. CC's own caps (16 concurrent / 1000 per run) govern; the hook's
value is telling the model it is over budget, which a dead deny never did.
The escape valve was equally dead: try a cwd below.
test file: context-gate-envelope.test.ts against pre-fix code 3 failed | 2 passed (the DoD red) against this change 5 passed
| change | effect |
|---|---|
| sandbox.enabled: true | the authored artifact stops lying about itself |
| 5 × Read() credential denies | ~/.ssh, ~/.aws/credentials, ~/.gnupg, ~/.netrc, ~/.npmrc — the gap where nothing blocked a read of an SSH key |
Not claimed: activation. CC reads only agent and
subagentStatusLine from a plugin's settings.json, so this file is what
ork:configure copies into user settings, not something CC consumes directly.
Turning the sandbox ON for a machine is an operator step (it changes every Bash call),
left deliberately out of this PR and documented on the issue.