Remove static writePaths lock; detect concurrent lane overlap at spawn

Deletes DirectorPackage.writePaths / AgentProfile.writePaths and the
gate.ts enforcement that read them (write-path-policy.ts and its test
are now dead and removed). No shipped director ever set a non-empty
writePaths, so this was already unenforced-in-practice authz machinery
that read as active.

Replaces it with a non-blocking conflict detector in the task tool:
each running dispatch is tracked by call id and resolved cwd; a new
dispatch that shares a still-running lane's cwd is recorded (not
blocked) as a concurrent-lane-overlap intervention. A completed lane
is removed before the next dispatch starts, so sequential work against
the same cwd never triggers it.

Judgement calls:
- task() has no field for a caller to declare which paths a dispatch
  will touch, so cwd is the only intended-scope signal honestly
  available at spawn. Worktree-isolated lanes get distinct cwds by
  construction and can never collide here; this only fires in the
  shared-cwd fallback, which is the one case where two lanes can
  really overwrite each other.
- Warn/record, not block: cwd equality does not prove two lanes touch
  the same files, only that they could, so refusing the spawn would
  invent precision the signal does not have.
- Recorded in intervention-log.ts (new "conflict" class) rather than a
  separate mechanism, alongside the existing parent-side refusal/outcome
  records it already keeps for this task tool instance.

Author: TheGreatAxios

src/agent/directors/brand-reviewer/package.test.ts

@@ -21,11 +21,10 @@ describe("brandReviewerPackage", () => {
     expect(brandReviewerPackage.spawn.maySpawn).toBe(false);
   });
 
-  test("tools.allow includes write tools; writePaths is omitted", () => {
+  test("tools.allow includes write tools", () => {
     const allow = brandReviewerPackage.tools?.allow ?? [];
     expect(allow).toContain("write_file");
     expect(allow).toContain("edit_file");
-    expect(brandReviewerPackage.writePaths).toBeUndefined();
   });
 
   test("systemPrompt mentions DESIGN.md", () => {

src/agent/directors/bruckheimer/package.test.ts

@@ -22,11 +22,10 @@ describe("bruckheimerPackage", () => {
     expect(bruckheimerPackage.spawn.maySpawn).toBe(false);
   });
 
-  test("tools.allow includes write tools; writePaths is omitted", () => {
+  test("tools.allow includes write tools", () => {
     const allow = bruckheimerPackage.tools?.allow ?? [];
     expect(allow).toContain("write_file");
     expect(allow).toContain("edit_file");
-    expect(bruckheimerPackage.writePaths).toBeUndefined();
   });
 
   test("report requires envelope sections", () => {

src/agent/directors/registry.test.ts

@@ -107,7 +107,6 @@ describe("director registry", () => {
     expect(grey.maxTurns).toBe(DIRECTOR_REGISTRY.greybeard.nudge?.maxTurns);
 
     const shakespeare = packageToProfile(DIRECTOR_REGISTRY.shakespeare);
-    expect(shakespeare.writePaths).toBeUndefined();
     expect(shakespeare.capabilities?.mode).toBe("allow");
     expect(shakespeare.capabilities?.tools).toContain("write_file");
   });
@@ -147,13 +146,6 @@ describe("director registry", () => {
     }
   });
 
-  test("no shipped director in DIRECTOR_IDS has a non-empty writePaths", () => {
-    for (const id of DIRECTOR_IDS) {
-      const paths = DIRECTOR_REGISTRY[id].writePaths;
-      expect(paths === undefined || paths.length === 0).toBe(true);
-    }
-  });
-
   test("build mounts product writes; intern is shell-only; other leaves do not spawn", () => {
     expect(DIRECTOR_REGISTRY.build.tools?.allow).toEqual(
       expect.arrayContaining(["write_file", "edit_file", "delete_file", "apply_patch"]),
@@ -181,15 +173,6 @@ describe("director registry", () => {
     expect(s.spawn.allowlist).toHaveLength(15);
   });
 
-  test("writePaths guards: a director with non-empty writePaths never allows run_shell", () => {
-    for (const id of DIRECTOR_IDS) {
-      const pkg = DIRECTOR_REGISTRY[id];
-      if (!pkg.writePaths || pkg.writePaths.length === 0) continue;
-      const allow = pkg.tools?.allow ?? [];
-      expect(allow).not.toContain("run_shell");
-    }
-  });
-
   test("every director profile declares matching agent id in system prompt", () => {
     for (const id of DIRECTOR_IDS) {
       const profile = packageToProfile(DIRECTOR_REGISTRY[id]);

src/agent/directors/registry.ts

@@ -127,9 +127,6 @@ export function packageToProfile(pkg: DirectorPackage): AgentProfile {
     orchestrator: pkg.spawn.maySpawn,
     ...(pkg.nudge?.maxTurns !== undefined ? { maxTurns: pkg.nudge.maxTurns } : {}),
     ...(capabilities !== undefined ? { capabilities } : {}),
-    ...(pkg.writePaths !== undefined && pkg.writePaths.length > 0
-      ? { writePaths: [...pkg.writePaths] }
-      : {}),
   };
 }
 

src/agent/directors/shakespeare/package.test.ts

@@ -32,11 +32,10 @@ describe("shakespearePackage", () => {
     expect(shakespearePackage.spawn.maySpawn).toBe(false);
   });
 
-  test("tools.allow includes write tools; writePaths is omitted", () => {
+  test("tools.allow includes write tools", () => {
     const allow = shakespearePackage.tools?.allow ?? [];
     expect(allow).toContain("write_file");
     expect(allow).toContain("edit_file");
-    expect(shakespearePackage.writePaths).toBeUndefined();
   });
 
   test("report.requiredSections includes Summary, Findings, Blockers, Paths", () => {

src/agent/directors/tool-sets.ts

@@ -34,9 +34,8 @@ export const BUILD_TOOLS = [
 
 /**
  * Docs leaves: read/search/lsp/web + file writes — no run_shell, no delete_file.
- * Envelope policy, not a writePaths lock: docs leaves omit shell so they cannot
- * mutate via the terminal. Optional package writePaths, when a profile sets it,
- * is still enforced by the permission gate on path-keyed write tools.
+ * Envelope policy only: docs leaves omit shell so they cannot mutate via the
+ * terminal. There is no separate path-level lock on top of the tool envelope.
  *
  * Composed from READ_TOOLS minus run_shell so it tracks the read surface
  * automatically; only the write tools are added explicitly. `apply_patch` is

src/agent/directors/types.ts

@@ -69,15 +69,6 @@ export interface DirectorPackage {
   /** Optional skills the worker may load dynamically (ordered). */
   readonly optionalSkills?: readonly string[];
   readonly tools?: ToolEnvelope;
-  /**
-   * Authz write-path allowlist for write_file/edit_file/delete_file.
-   * Enforced by the permission gate (not prompt policy). A bare filename (no
-   * slash) matches only at the workspace root; a glob matches the resolved
-   * workspace-relative path; anything outside the worker cwd is denied. yolo
-   * mode bypasses this gate. Omitted = no path lock (tool allow/deny alone
-   * decides whether writes exist).
-   */
-  readonly writePaths?: readonly string[];
   readonly spawn: SpawnRights;
   readonly nudge?: NudgePolicy;
   readonly report: ReportContract;

src/agent/profile-types.ts

@@ -55,11 +55,6 @@ export interface AgentProfile {
   inference?: InferenceSpec;
   // Optional tool restriction. Controls which tools the sub-agent can call.
   capabilities?: CapabilityFilter;
-  /**
-   * Authz write-path allowlist for write_file/edit_file/delete_file (director
-   * packages). Enforced by the permission gate, not prompt policy.
-   */
-  writePaths?: readonly string[];
   // Appended to the sub-agent's base system prompt to specialize its behavior.
   systemPromptRole?: string;
   // Relative path to a markdown file whose content is loaded as systemPromptRole

src/permission/gate.test.ts

@@ -163,73 +163,6 @@ describe("grant coverage rebinds relative paths to the request process cwd", ()
   });
 });
 
-describe("director writePaths authz on evaluate", () => {
-  const cwd = mkdtempSync(join(tmpdir(), "gate-writepaths-"));
-
-  test("denies write_file outside allowlist under ALS identity", async () => {
-    const { runWithSubAgentIdentity } = await import("../subagent/identity-context.js");
-    const gate = createPermissionGate({
-      approvals: [{ tool: "write_file", pattern: "*" }],
-      interactive: false,
-      skipPermissions: false,
-      cwd,
-    });
-    const verdict = await runWithSubAgentIdentity(
-      { description: "shakespeare", cwd, writePaths: ["PRODUCT.md"] },
-      () =>
-        gate.evaluate({
-          id: "w1",
-          name: "write_file",
-          arguments: { path: "src/hack.ts", content: "nope" },
-        }),
-    );
-    expect(verdict.allowed).toBe(false);
-    if (!verdict.allowed) {
-      expect(verdict.reason).toMatch(/authz allowlist/i);
-    }
-  });
-
-  test("allows write_file matching bare basename allowlist", async () => {
-    const { runWithSubAgentIdentity } = await import("../subagent/identity-context.js");
-    const gate = createPermissionGate({
-      approvals: [{ tool: "write_file", pattern: "*" }],
-      interactive: false,
-      skipPermissions: false,
-      cwd,
-    });
-    const verdict = await runWithSubAgentIdentity(
-      { description: "shakespeare", cwd, writePaths: ["PRODUCT.md"] },
-      () =>
-        gate.evaluate({
-          id: "w2",
-          name: "write_file",
-          arguments: { path: "PRODUCT.md", content: "ok" },
-        }),
-    );
-    expect(verdict.allowed).toBe(true);
-  });
-
-  test("yolo (skipPermissions) bypasses writePaths", async () => {
-    const { runWithSubAgentIdentity } = await import("../subagent/identity-context.js");
-    const gate = createPermissionGate({
-      approvals: [],
-      interactive: false,
-      skipPermissions: true,
-      cwd,
-    });
-    const verdict = await runWithSubAgentIdentity(
-      { description: "shakespeare", cwd, writePaths: ["PRODUCT.md"] },
-      () =>
-        gate.evaluate({
-          id: "w3",
-          name: "write_file",
-          arguments: { path: "src/hack.ts", content: "yolo" },
-        }),
-    );
-    expect(verdict.allowed).toBe(true);
-  });
-});
-
 // CL-5638: an Always-allow grant minted for `git worktree *` must cover a later
 // worktree command whose destination is a sibling directory the operator has
 // already implicitly approved under that pattern, without a second prompt.

src/permission/gate.ts

@@ -26,12 +26,7 @@ import { splitChainedCommand, isShellCommentOnly, stripCommentLines } from "./co
 import { createPathRestriction } from "./path-restriction.js";
 import { createWorktreeRootsProvider, type RootsProvider } from "./worktree-roots.js";
 import { getSubAgentIdentity } from "../subagent/identity-context.js";
-import { matchesWritePathAllowlist, writePathDeniedReason } from "./write-path-policy.js";
-import {
-  isProductMutationTool,
-  productMutationPaths,
-  PRODUCT_MUTATION_TOOLS,
-} from "../agent/product-mutation-tools.js";
+import { PRODUCT_MUTATION_TOOLS } from "../agent/product-mutation-tools.js";
 
 import {
   createMcpToolPermissionRegistry,
@@ -432,31 +427,6 @@ export function createPermissionGate(options: PermissionGateOptions): Permission
     const subAgentIdentity = getSubAgentIdentity();
     const effectiveCwd = subAgentIdentity?.cwd ?? resolvedCwd;
 
-    // Director write-path authz (not prompt policy). Leaves with writePaths only
-    // mutate matching subjects. auto mode still enforces; yolo already returned.
-    if (
-      subAgentIdentity?.writePaths !== undefined &&
-      subAgentIdentity.writePaths.length > 0 &&
-      isProductMutationTool(call.name)
-    ) {
-      const paths = productMutationPaths(call.name, call.arguments);
-      // Fail-closed: no extractable subject is the same as an empty path deny.
-      if (paths.length === 0) {
-        return {
-          allowed: false,
-          reason: writePathDeniedReason("", subAgentIdentity.writePaths),
-        };
-      }
-      for (const path of paths) {
-        if (!matchesWritePathAllowlist(path, subAgentIdentity.writePaths, effectiveCwd)) {
-          return {
-            allowed: false,
-            reason: writePathDeniedReason(path, subAgentIdentity.writePaths),
-          };
-        }
-      }
-    }
-
     const isRestrictedHere = bindRestrictedToProcessCwd(isRestricted, effectiveCwd);
     // A call targeting a restricted path (outside the workspace, or a write
     // under the session state root) drops from allow to ask, so it never auto-allows on