Development record
2026-08-19 — Review agents keep their Bash grant: running the project's tests is
decisiondcn-2608190000000002
2026-08-19 — Review agents keep their Bash grant: running the project's tests is part of what makes their reviews evidence, and the exposure that motivated the question is closed by the intake rule that external-contribution review runs only in CI or a network-less container (.abcd/work/intake.md S4). iss-278 narrows to the unbuilt PQ linter. Maintainer decision.
Frontmatter
| id | dcn-2608190000000002 |
|---|---|
| type | decision |
| date | 2026-08-19 |
.abcd/work/decisions/dcn-2608190000000002-review-agents-keep-their-bash-grant.md
open on GitHub ↗ · commit history ↗
mentions2
- iss-278Five agent prompts read attacker-influenceable input without the itd-5 contract (ruthless-reviewer, security-reviewer, docs-currency-reviewer, intent-auditor, sota-researcher) and agents/ sits outside both lint roots, so no detector exists for the class; the PQ linter (agents/README.md) is the missing detector
- iss-2608271702469341intake.md graduates to the durable record when the contribute-triage verb ships: .abcd/work/intake.md stays in the working tier today as the live S1-S6 external-contribution runbook (the 2026-08-27 structural review re-adjudicated its placement: live operating state, cited in force by [dcn-2608190000000002](../../decisions/dcn-2608190000000002-review-agents-keep-their-bash-grant.md) and filed-against by ledger records), but its own header declares it the script-first MVP rung that a future 'abcd contribute triage' verb absorbs. When that verb ships, the protocol content is no longer working state and the document's home moves up: promote the durable protocol description into .abcd/development/ (brief surface or discipline record) in a change that says why, leave or redirect the working-tier path for in-flight citers (iss-276 and resolved iss-2608261533173466 cite found_at .abcd/work/intake.md; [dcn-2608190000000002](../../decisions/dcn-2608190000000002-review-agents-keep-their-bash-grant.md) cites its S4 rule), and record the supersession of the highlight-not-inventory adjudication ([dcn-2608210000000001](../../decisions/dcn-2608210000000001-bug-hunt-round-4-branch-bughunt-b.md), [dcn-2608220000000001](../../decisions/dcn-2608220000000001-bug-hunt-round-7-branch-bughunt-b.md)) for this file. Trigger is the verb shipping, not a date.