{ "version": 1, "spec": "docs/design/2026-06-01-ars-134-conductor-rescope-deterministic-write-guard-spec.md", "source": "docs/design/2026-05-18-ars-v3.9.2-agent-phase-classification.md", "_about": "Machine-readable write-scope manifest for the 23 Bucket A agents (22 single-phase + draft_writer_agent, which carries a documented dual-phase static union — see `_known_multiphase_static_union`). Consumed by the PreToolUse write-scope guard (hooks/ars_write_scope_guard.py) to deny out-of-scope structured-tool writes. Keys are agent frontmatter `name` values (NOT filenames). `allowed_write_globs` is the AUTHORITATIVE scope expression (workspace-root-anchored, matched against the hook's normalized relative path); `phase` is a human-readable label cross-referencing the classification table only (it is skill-relative, not global, so a phase integer is not globally meaningful). Each glob mirrors the agent's own Phase Boundary prompt rule: an agent may write only into its own `phase_*/` directory. The named outputs a few agents emit (see `known_named_outputs`) all live under that same own-phase directory, so the phase-dir glob already permits them; the field is documentation only and is NOT a second enforcement channel (no `**/` anywhere-globs, which would WIDEN scope past the phase dir — a precision regression, not a gain).", "_coverage_claim": "Deterministic for the structured editing tools (Write/Edit/MultiEdit); ALL Bash is denied for a Bucket A agent (it uses the Grep/Glob tools to search and the structured tools to write), so no Bash write path remains for a fenced agent (see spec section 3.3 + the Implementation-outcome note: neither a denylist nor an allowlist of Bash is decidable from a command string, so all-deny is the only zero-fail-open policy). This guard is sound for single-skill runs and for the #133 failure shape (an agent writing into a DIFFERENT phase number than its own). It does NOT disambiguate same-phase-number cross-skill collisions (e.g. academic-paper-reviewer Phase 1 vs deep-research Phase 1 both glob `phase1_*/`) in a hypothetical shared flat workspace — that lower-probability risk is deferred until the full-pipeline workspace layout is first-party confirmed (spec section 7 open item). It also enforces phase ISOLATION, not artifact OWNERSHIP: an agent may still overwrite another file inside its own phase dir. Stated explicitly per no-silent-caps discipline.", "_known_multiphase_static_union": "draft_writer_agent is the ONLY Bucket A entry whose `allowed_write_globs` is a multi-phase static union (`phase4_*/**` + `phase6_*/**`) rather than a single own-phase glob. This is a KNOWN, BOUNDED Slice-1 limitation tracked at issue #330, not an oversight. Why the phase6 leg is load-bearing: draft_writer genuinely operates at Phase 4 (initial drafting) OR Phase 6 (revision-after-review) depending on the caller invocation — both its own `## Phase Boundary` block and the #390 patch-document revision path (which writes `phase6_*/revision_patch_round.json` via the Write tool) exercise the phase6 leg. The PreToolUse payload carries only `agent_type`, never the invocation phase, so the guard cannot distinguish a Phase 4 draft call from a Phase 6 revision call from a single manifest key; a static union of the two phase globs is the only single-key expression that keeps BOTH legitimate write paths open. The cost (stated, not silently capped): a Phase 4 invocation is permitted to write `phase6_*/` and vice-versa — inflation bounded to this one agent and the phase4<->phase6 pair. This weakens draft_writer's Bucket A fence in the same way the spec uses to justify EXEMPTING the Bucket B multi-phase agents (report_compiler_agent shares draft_writer's Phase 4,6 signature but is Bucket B). The DISPOSITION (narrow to `phase4_*/**` now and route phase6 writes elsewhere / reclassify alongside Bucket B / keep the union) is DEFERRED to #330, to be decided when Slice 3 is scoped — the real fix is per-invocation scope grants from the dispatching layer (spec §5 item 3), at which point the static union is no longer needed. Documented here so the limitation is visible at the enforcement surface, not to settle the decision.", "agents": { "research_question_agent": { "bucket": "A", "skill": "deep-research", "phase": "1", "allowed_write_globs": ["phase1_*/**"] }, "research_architect_agent": { "bucket": "A", "skill": "deep-research", "phase": "1", "allowed_write_globs": ["phase1_*/**"] }, "bibliography_agent": { "bucket": "A", "skill": "deep-research", "phase": "2", "allowed_write_globs": ["phase2_*/**"], "known_named_outputs": ["phase2_*/pre_screened_citation_keys_*.txt"] }, "source_verification_agent": { "bucket": "A", "skill": "deep-research", "phase": "2", "allowed_write_globs": ["phase2_*/**"] }, "timeline_extraction_agent": { "bucket": "A", "skill": "deep-research", "phase": "2", "allowed_write_globs": ["phase2_*/**"], "known_named_outputs": ["phase2_investigation/timeline.yaml", "phase2_investigation/citation_provenance.yaml", "phase2_investigation/version_records.yaml"] }, "synthesis_agent": { "bucket": "A", "skill": "deep-research", "phase": "3", "allowed_write_globs": ["phase3_*/**"] }, "editor_in_chief_agent": { "bucket": "A", "skill": "deep-research", "phase": "5", "allowed_write_globs": ["phase5_*/**"] }, "ethics_review_agent": { "bucket": "A", "skill": "deep-research", "phase": "5", "allowed_write_globs": ["phase5_*/**"] }, "risk_of_bias_agent": { "bucket": "A", "skill": "deep-research", "phase": "SR2", "allowed_write_globs": ["phase2_*/**"] }, "meta_analysis_agent": { "bucket": "A", "skill": "deep-research", "phase": "SR3", "allowed_write_globs": ["phase3_*/**"] }, "literature_strategist_agent": { "bucket": "A", "skill": "academic-paper", "phase": "1", "allowed_write_globs": ["phase1_*/**"], "known_named_outputs": ["phase1_*/pre_screened_citation_keys_*.txt"] }, "structure_architect_agent": { "bucket": "A", "skill": "academic-paper", "phase": "2", "allowed_write_globs": ["phase2_*/**"] }, "draft_writer_agent": { "bucket": "A", "skill": "academic-paper", "phase": "4", "allowed_write_globs": ["phase4_*/**", "phase6_*/**"], "_note": "Dual-phase static union (phase4 drafting | phase6 revision, per invocation) — the one Bucket A multi-phase entry. Known bounded inflation, tracked #330; disposition deferred to Slice 3 per-invocation grants. See top-level `_known_multiphase_static_union`." }, "citation_compliance_agent": { "bucket": "A", "skill": "academic-paper", "phase": "5a", "allowed_write_globs": ["phase5_*/**"] }, "abstract_bilingual_agent": { "bucket": "A", "skill": "academic-paper", "phase": "5b", "allowed_write_globs": ["phase5_*/**"] }, "peer_reviewer_agent": { "bucket": "A", "skill": "academic-paper", "phase": "6", "allowed_write_globs": ["phase6_*/**"] }, "formatter_agent": { "bucket": "A", "skill": "academic-paper", "phase": "7", "allowed_write_globs": ["phase7_*/**"], "known_named_outputs": ["phase7_*/paper.md", "phase7_*/paper.tex", "phase7_*/references.bib", "phase7_*/cover_letter.md", "phase7_*/provenance_summary.md"] }, "eic_agent": { "bucket": "A", "skill": "academic-paper-reviewer", "phase": "1", "allowed_write_globs": ["phase1_*/**"] }, "methodology_reviewer_agent": { "bucket": "A", "skill": "academic-paper-reviewer", "phase": "1", "allowed_write_globs": ["phase1_*/**"] }, "domain_reviewer_agent": { "bucket": "A", "skill": "academic-paper-reviewer", "phase": "1", "allowed_write_globs": ["phase1_*/**"] }, "perspective_reviewer_agent": { "bucket": "A", "skill": "academic-paper-reviewer", "phase": "1", "allowed_write_globs": ["phase1_*/**"] }, "devils_advocate_reviewer_agent": { "bucket": "A", "skill": "academic-paper-reviewer", "phase": "1", "allowed_write_globs": ["phase1_*/**"] }, "editorial_synthesizer_agent": { "bucket": "A", "skill": "academic-paper-reviewer", "phase": "2", "allowed_write_globs": ["phase2_*/**"] } } }