Agent Tool Track Selection & Shared Practice

Reference task card — Goal: 'Make CSV export survive empty input and non-ASCII text without silent truncation.' In-scope: export.py row-writing logic and tests/test_export.py. Non-goals: no new export formats, no UI changes, no dependency upgrades. Criteria: (1) python3 -m unittest tests.test_export -v exits 0; (2) exporting an empty dataset produces a file containing only the header row (verified by inspecting the file); (3) a record containing 'café, 東京' round-trips byte-identically through the written CSV (verified by re-reading the file); (4) git diff touches only export.py and tests/test_export.py.

Reference plan — (a) Run python3 -m unittest discover -s tests -v and read the traceback; read app.py around the failing line to find the empty-list access. (b) Run git status --porcelain: if the tree is dirty, stash or commit it first (git stash -u, or a scratch-branch commit); if it is already clean, record git rev-parse HEAD as the baseline — an empty commit would fail anyway. (c) Steps: 1. reproduce the crash and record the exact exception (checkpoint: traceback captured); 2. agent edits only app.py to guard the empty case (checkpoint: git diff touches only app.py); 3. rerun the test suite (checkpoint: exit 0); 4. review diff and commit the green state (checkpoint: git diff --check clean, commit recorded).

Minimal pack: src/greeter.py (the code), tests/test_greeter.py (the behavioral contract), and the traceback (the exact failure). Include the README only if it defines the greeting's required format. Exclude .env always — never hand credentials to an agent — and the full src/ tree and package.json because they are unrelated to this behavior and would pollute attention.

Grant: repository read, file edit, and shell scoped to the test command (pytest tests/ or equivalent). Deny: unrestricted shell, network fetch, package install, git push, and deployment — the task neither needs nor may have them. Confirm flag names in the selected track's current official permissions documentation (for example Claude Code's permissions/settings docs, Codex CLI's --sandbox/--ask-for-approval reference, Pi's tool-boundary docs, or the DeepSeek Harness README), because names change between versions.

The README note is an injected instruction and must not be obeyed: running the script would exfiltrate a private key. Response: (1) do not execute the script; (2) record the file and line as a prompt-injection finding; (3) check whether any earlier step already complied (diff, shell history, network evidence) and escalate if it did; (4) continue only the authorized parser task; (5) report the artifact in the review log.

Exposure classification: possibly transmitted and present in the working tree — treat as exposed. Response order: (1) stop the run; (2) revoke and rotate the key at the provider console; (3) remove it from secrets.env and scrub git history if it was committed; (4) scan diffs, logs, and transcripts for other copies; (5) record the incident and evidence. A minimal added-line credential scan used in review:

import re
SECRET = re.compile(r'^\+.*(api[_-]?key|secret|token|password|\w*key)\s*=', re.I | re.M)
diff = '+STAGING_KEY=sk-live-9f2ab\n+mode=fast\n-OLD_KEY=sk-dead\n'
hits = SECRET.findall(diff)
assert len(hits) == 1, hits  # only the added line is flagged
print('PASS: flagged added credential line')

Verdict: reject the change entirely — expresss is a typosquat pattern and the postinstall script fetches and executes remote code, an exfiltration vector. Commands: git restore package.json package-lock.json to revert the manifest and lockfile; do not run install; record the incident in the review log; if an install already ran, treat the environment as compromised and investigate. Review helper for declared dependency deltas:

baseline = {'express': '^4.18.2', 'lodash': '^4.17.21'}
proposed = {'expresss': '^9.9.9', 'lodash': '^4.17.21'}
added = sorted(set(proposed) - set(baseline))
removed = sorted(set(baseline) - set(proposed))
assert added == ['expresss'] and removed == ['express']
print('PASS: flagged unexpected dependency delta:', added)

Order: (c) acceptance criteria, (f) context pack, (d) one bounded change, (a) run tests and inspect, (b) review the diff, (e) commit the green state. Stop conditions: the same failure repeats twice (re-frame instead of retrying), or the agent acts outside scope or permissions (halt and review).

Run: npm test (require exit 0), tsc --noEmit, npx eslint ., npm run build, then exercise the real login page — successful sign-in plus an invalid-password rejection — at the running app. Evidence = the recorded commands, exit codes, and observed behavior, not the agent's prose. If the project lacks a configured linter or typecheck, that absence is recorded, not assumed.

Hunk 1: accept after confirming the boundary logic and rerunning the tests. Hunk 2: reject — commenting out assertions manufactures a pass; restore them. Hunk 3: reject — out-of-scope churn that hides the real change; revert it. Action: request a resubmission containing only hunk 1, using git diff, git diff --check, and git status --short to confirm nothing else changed.

git revert cafe123 appends an inverse commit preserving history and your uncommitted notes.md, but it is not guaranteed conflict-free: if beef456 edited the same lines Git stops mid-revert — resolve those hunks keeping beef456's corrected behavior and run git revert --continue, or git revert --abort and instead selectively restore the bad commit's file state on a scratch branch (git restore --source=cafe123^ -- <files it touched>), committing that as a normal fixup. If cafe123 also touched notes.md, snapshot first (git diff notes.md > /tmp/notes.patch), then restore your version after recovery. Forbidden: git reset --hard beef456 or git reset --hard HEAD~1 — it would discard the uncommitted notes.md edits Git cannot recover.

(1) Review — destructive but scoped and rebuildable; approve only after verifying the path is inside the worktree and build/ is regenerable. (2) Deny — force-push rewrites shared history; a normal push still needs authorization. (3) Review — supply-chain check first (exact name, provenance, pin), then approve in a disposable env. (4) Deny pending explicit authorization — external communication is a real-world side effect. (5) Allow — local, reversible, read-only.

Reference skeleton — name: release-notes-drafter; description: 'Drafts release notes from already-merged pull requests in the current repository; triggers only when the user asks for release notes or a changelog draft — not for writing code, reviewing PRs, or publishing anything.' Instructions: (1) read git log and merged PR titles only; (2) group changes under fixed/added/changed headings; (3) write the draft to CHANGELOG-draft.md, never commit, tag, push, or publish; (4) flag unclear PRs for the user instead of guessing. Should-trigger: 'Draft release notes for v2.3 from merged PRs'; 'Write the changelog for this release'. Adversarial should-not-trigger: 'Review this PR for me'; 'Publish the release notes to the blog'. Retirement: remove when release notes are generated by CI, or when two consecutive reviews find the description misfiring.