ungate the permission-mode precheck from the code-task heuristic

[bborbe]

The bug

v0.110.0 added a permission-mode precheck to work-on-task-assistant, but placed it inside Phase 5, which is gated on a code-task title heuristic:

## Phase 5: Coding guidelines (MANDATORY for code tasks)
Heuristic: title or description contains "fix", "implement", "refactor", "add", "bug", "deploy", "build" …
If code task:
  … - **Permission-mode precheck.** …      ← never reached for ops tasks
If not a code task: skip.

A task whose entire body is kubectl delete matches none of those keywords. Phase 5 skips wholesale, and the precheck with it.

The exclusion is exactly inverted: deploy X would have been covered, while every decommission / renew / rebuild / migrate task — the ops work that actually needs the mode switch — was silently skipped.

How it was caught

By exercising v0.110.0 on "Decommission MinIO on Hell" the same day it shipped, per the plugin four-step deploy check.

The run did print a permission-mode note, which at a glance reads as a pass. It wasn't the new line — the assistant said so itself: "not from a Development Guide — from your own operational rules". It had produced the note from the global CLAUDE.md. The added line never executed.

Worth noting because the failure was disguised: the desired behaviour appeared, from a different source, at lower reliability. Without checking attribution this would have been recorded as verified.

The fix

New Phase 5.5, outside the code-task gate:

• runs for every task
• keys on the task's own commands — make apply/buca, kubectl writes (apply/delete/annotate/patch/rollout restart/scale), helm install/upgrade, ssh deploys, prod runbook steps
• emits nothing for read-only or docs-only tasks

Keying on what the task will actually run, rather than on how its title is phrased, is what makes it robust.

Verification

make precommit passes (tests, golangci-lint 0 issues, vuln scan, CHANGELOG, formatting — 31.2s).

Behavioural check after release + restart: work-on-task on an ops task with no code-task keyword (e.g. "Decommission MinIO on Hell") must show the 🔐 line; a docs-only task must not.

[ben-s-pull-request-reviewer]

Now I have everything needed for the in-session classification and adjudication.

Step 4c-sel CLASSIFY:

rule-id	decision	reason
changelog/conventional-prefix-required	applicable	CHANGELOG.md is changed; rule triggers on that file
agent-cmd/agent-frontmatter	applicable	agents/work-on-task-assistant.md is changed; rule triggers on agents/**/*.md
agent-cmd/command-thin	applicable	agents/**/*.md in trigger; file is substantially changed (new Phase 5.5 added)

All other judgment rules have triggers (**/*.go, go.mod, Makefile, etc.) that don't match either changed file.

Step 4d-sel ADJUDICATE:

1. changelog/conventional-prefix-required — CHANGELOG.md new bullet is fix: ... ✓ — correct conventional prefix.
2. agent-cmd/agent-frontmatter — name, description, model, tools, color fields all present ✓ — frontmatter is complete.
3. agent-cmd/command-thin — The new Phase 5.5 block (~30 lines) is proportionate to the fix it documents. It reads as instructional prose about when and why to emit a permission-mode warning — not business logic, detection algorithms, or quality rules leaked into the command. The concern raised in the Plan about "pattern completeness" is a design question for the author, not a structural violation of the thin-command rule. No violation.

Step 3a: LICENSE file check — LICENSE exists at repo root ✓

---

PR Review: ungate the permission-mode precheck

Verdict: approve

Summary: The fix correctly extracts the permission-mode precheck from Phase 5 (gated on the code-task heuristic) into its own Phase 5.5 that runs for all tasks and keys on the task's own commands. CHANGELOG entry uses the correct fix: prefix. Agent frontmatter is complete and valid. The new phase is appropriately sized prose documentation.

---

Must Fix (Critical)

None.

Should Fix (Important)

None.

Nice to Have (Optional)

None.

---

Traceability Report (selector mode)

• Candidates: 3 rules matched by Step 4b-i glob filter
• Applicable: 3 rules selected by Step 4c-sel (all triggered by diff)
• Skipped: 0 (no non-applicable candidates)

---

Step 6: Next Steps Recommendation

No test coverage gaps identified. No Go code changed.

---

{
  "verdict": "approve",
  "summary": "The fix correctly ungates the v0.110.0 permission-mode precheck from Phase 5's code-task heuristic into a standalone Phase 5.5 that runs for all tasks and keys on the task's own commands — addressing the exact failure mode observed on 'Decommission MinIO on Hell'. CHANGELOG uses the correct 'fix:' prefix. Agent frontmatter is complete and valid. No structural, architectural, or rule violations found.",
  "comments": [],
  "concerns_addressed": [
    "correctness: Phase 5.5 command-pattern matching — reviewed the operator-run mutation list (make apply/buca, kubectl writes, helm install/upgrade, ssh deploys, prod runbook steps); the list is reasonable and the false-positive/false-negative risk is an author-design choice, not a structural defect",
    "correctness: read-only/docs-only tasks emit nothing case — the spec explicitly says 'If none are present, emit nothing — do not warn on read-only or docs-only tasks', which is correct",
    "correctness: version reference in 'Why this is its own phase' block references v0.110.0 and 2026-08-16 — both are accurate to the prior release and observed incident date"
  ]
}