Sandboxed worker sessions can now run read-only gh commands (api GET, run, pr, issue, workflow, release, repo views, and search) through the repository bot without holding a token. The route is fully wired but stays off until the unsigned v20 routing manifest is signed; v19 head-session behavior is unchanged.
Worker read path
Only daemon-proven workers with a verified active v20 checkout binding are eligible; native gh is refused for workers and jailed callers, even after env -i or ticket removal.
Reads are bounded to the checked-out repository by the ticket's immutable repository snapshot; oversized ranges, GraphQL/payload arguments, and unsafe search operators are refused.
Plexus selects the bot from the stamped route; only the ticket and a validated read request cross the daemon boundary.
Jailing and credential isolation
The shim identifies AFT's worker jail by a kernel-denied canary file, so containers, CI runners, systemd units, and bubblewrap sandboxes keep native gh passthrough.
Canary denial plus daemon-proven scope gate refusal: unconfined heads with unknown scope keep passthrough, a positive canary overrides head attribution, and marked shells refuse even when the daemon lookup is unavailable.
Strict and relaxed worker profiles deny credential stores (GitHub, SSH, cloud, GnuPG, netrc, Git) under both account home and daemon HOME; unresolvable environment overrides now refuse launch instead of silently dropping a deny.
Output rendering is platform-consistent: Windows relaxed workers report the missing fence as unenforced in captured diagnostics, and jq output preserves line endings by platform.
Head shells retain v19 passthrough, and a pinned v19 classifier oracle guards against regressions.
Confidence Score: 5/5
The changes appear safe to merge, with no new actionable issues found.
Summary
The PR routes worker GitHub reads through the repository bot, gated on a signed v20 manifest. It also adds worker-only checks before native gh runs and expands credential-file protection.
Worker shells can read GitHub through the bot for their checked-out repository.
Worker jail shells block native gh and report when that fence is missing.
Diagram
%%{init: {'theme': 'neutral'}}%%
flowchart TD
Command[Worker gh command] --> Gate{Signed v20 read class?}
Gate -- Yes --> Ticket[Daemon checks ticket and worker scope]
Ticket --> Repo[Check repository captured with ticket]
Repo --> Plexus[Plexus selects repository bot]
Plexus --> Read[Read GitHub and render reply]
Gate -- No --> Guard[Check before running native gh]
Guard --> Refuse[Refuse proven workers and jailed callers]
