The implement loop's land stage accepts any non-empty worktree path from the run state file, so a planted state makes `abcd implement step` create `<that path>/.abcd/.work.local` (mode 0700) in a directory the state names.

The implement loop's land stage accepts any non-empty worktree path from the run state file, so a planted state makes abcd implement step create <that path>/.abcd/.work.local (mode 0700) in a directory the state names.

Private security advisory GHSA-qfpj-v8c5-c4fw (draft, severity low). Full text, evidence and reproduction: the security-drain-2026-10-09 run directory in the main checkout's local tier. This record stays uncommitted until its fix lands; the fix commit adds it directly to resolved/.

Evidence (lines at main 7549ca2d5): briefStage refuses a worktree that is not the path laneWorktree derives (internal/core/implement/loop/brief.go:104-105). landStage only checks the string is non-empty and skips syncLane once a landing is recorded (internal/core/implement/loop/land.go:131, :139). landRecords uses that worktree when landing.closes is true (internal/core/implement/loop/land.go:237) and calls fsutil.EnsureRealDirAll there (internal/core/implement/loop/land.go:269). The state file is gitignored, so it arrives in a zip, not a clone. The result is an empty 0700 directory tree; no file body is written and no hook in the other repository runs.

Reproduction: on git 2.39.5, hand-write the state under .abcd/.work.local/run/ for a run whose one lane is at stage land, with full base and head SHAs, a real branch at that tip, landing.closes true and worktree a relative path to another existing git repository; run abcd implement step. <other>/.abcd/.work.local exists mode 0700, then intent.Reconcile fails on the absent spec. A missing branch or a missing landing record returns before the mkdir.