Development record
2026-09-25 — iss-2609251522588539 (the foreign-uid paragraph overstated the refusal) is deferred past v0.10.0 with its wording corrected (lane implementer, autonomous run A, fix round 1, after the tier2 review's finding 7). AGENTS.md and the marker block `ahoy` writes now say the refusal bounds the walk and a `.abcd/` at the working directory is still read. Making that read refuse too is the posture change on the unmerged branch feat/ruled-security-forks (da3efea6: an empty root with PerRepo false, refused by every loader), which touches the rules loader, the guard and the banlist; a second, partial form of it in a fix round would diverge from that branch rather than land it. The capture carries `deferred_after: v0.10.0` and returns at the next anchor.
2026-09-25 — iss-2609251522588539 (the foreign-uid paragraph overstated the refusal) is deferred past v0.10.0 with its wording corrected (lane implementer, autonomous run A, fix round 1, after the tier2 review's finding 7). AGENTS.md and the marker block ahoy writes now say the refusal bounds the walk and a .abcd/ at the working directory is still read. Making that read refuse too is the posture change on the unmerged branch feat/ruled-security-forks (da3efea6: an empty root with PerRepo false, refused by every loader), which touches the rules loader, the guard and the banlist; a second, partial form of it in a fix round would diverge from that branch rather than land it. The capture carries deferred_after: v0.10.0 and returns at the next anchor.
Frontmatter
| id | dcn-2609250000000011 |
|---|---|
| type | decision |
| date | 2026-09-25 |
.abcd/work/decisions/dcn-2609250000000011-iss-2609251522588539-the-foreign-uid.md
open on GitHub ↗ · commit history ↗
mentions1
- iss-2609251522588539AGENTS.md's Foreign-uid roots paragraph says a refused foreign-owned root sends the session to its own working directory on the bundled defaults, but rules.Resolve returns Resolution{Root: cwd} on that refusal (internal/core/rules/root.go:138), so when the working directory is the refused root, or lies inside it and carries its own .abcd/, that directory's .abcd/rules.json, .abcd/guard.json and .abcd/config/oracle-routing.json are read. The ownership gate bounds the upward walk, not the read at cwd. layered.RootsFor's comment states this correctly. The posture fix (an empty root with PerRepo false, so no per-repo .abcd is read in any geometry) is on the unmerged branch feat/ruled-security-forks (da3efea6), not on main.