[ptr727]

Summary

This answers the second round of review findings on the promotion pull request #3521, both on the model-tier guard. The code is unchanged. The docs stated more than it does.

• The allowance and a missing mapping. Requirement 10, the Claude kit README, and the guard's docstring each said an unreadable tier mapping refuses every dispatch naming a model. classify() returns allow first when FLEET_ALLOW_HIGHEST=1. That is correct, since a session launched with the allowance blocks no model and so needs no mapping. Each now says so.
• A nested session an agent launches. The guard bounds a good-faith agent's mistake rather than an adversary, so it does not tell such a session apart, per GOVERNANCE.md "Trust Boundaries and Hardening Effort". The docs now name that bound. They no longer claim an agent cannot set the allowance for itself, only that a tool call cannot change its own session's launch environment. Requirement 10 states the agent's side as a conduct rule. Requirement 3 and the Claude kit README make the same narrowing for GH_WRITE_GUARD_ALLOW.

Pre-existing findings, not filed

• host-setup/agent-safety/claude/gh-write-guard.py:1057 and .agents/skills/repo-worktree/SKILL.md:155 make the same "an agent cannot set it for itself" claim about GH_WRITE_GUARD_ALLOW, in files this change does not touch. (pre-existing, wording)

Dropped findings

• host-setup/agent-safety/README.md:35 and host-setup/agent-safety/claude/README.md:15 carry sentences over 25 words that this change did not write. (style)

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: ptr727/ProjectTemplate
• Branch: promotion-3521-allowance-docs
• File: .coderabbit.yaml
• Commit: 625810e
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 1672f919-d35d-4cf3-b99a-9319db2b8d13

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[ptr727]

A recorded local strict-review pass covers head 625810e070cfb29c9dc92967020b2173d176e660, the content this pull request carries at that commit against develop, and it recorded 0 findings.

[Copilot]

🟢 Approval recommended

The documentation changes align with the existing implementation, and no unresolved review issues remain.

No open issues 🎉

What changed in this PR

This documentation-only pull request aligns the host-safety specification and Claude model-tier guard documentation with the guard’s existing allowance behavior and nested-session boundary.

Changes:

• Clarifies that FLEET_ALLOW_HIGHEST=1 bypasses model checks without requiring a tier mapping.
• Documents that tool calls cannot alter their current session’s launch environment.
• Clarifies that nested sessions launched with the allowance are outside the guard’s good-faith mistake boundary.

File	Description
host-setup/​agent-safety/​README.md	Updates requirements 3 and 10 to document allowance behavior and nested-session limits.
host-setup/​agent-safety/​claude/​README.md	Aligns Claude kit documentation with the guard’s allowance and mapping behavior.
host-setup/​agent-safety/​claude/​model-tier-guard.py	Updates the guard docstring to accurately describe allowance precedence and scope.

_{Review effort: Lite}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 81.54%. Comparing base (6a751a2) to head (625810e).

Additional details and impacted files

@@           Coverage Diff            @@
##           develop    #3523   +/-   ##
========================================
  Coverage    81.54%   81.54%           
========================================
  Files           26       26           
  Lines         8967     8967           
========================================
  Hits          7312     7312           
  Misses        1655     1655           

Flag	Coverage Δ
python-3.13	81.54% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.