# Claude Worktree Guard Recognition

audience: AI coding agents first.

## Outcome

Treat registered `.claude/worktrees/<slug>` paths as isolated worktrees in main-checkout and ownership guards. Keep shared-checkout and deploy-clone protection fail-closed.

## Status

`ACTIVE`

## Task IDs

- Press.Zone Slice 1 infrastructure blocker

## Source request

Resume multilingual Slice 1 autonomously and continue until every task is complete on `origin/master`. Do not make owner operate infrastructure or source control.

## Acceptance criteria

- `wt_slug_for` recognizes `.worktrees/<slug>` and `.claude/worktrees/<slug>`.
- `wt_is_main_checkout_path` excludes both supported worktree roots.
- Regression test proves Edit allowed under both roots while existing shared-checkout and deploy-clone denials remain green.
- Change lands on Overdeck `origin/main` through canonical controller.
- Canonical post-land deployment installs exact landed guard.
- Real Edit or Write in Press.Zone Claude-managed worktree succeeds.

## Preserved WIP / ref / path

- Worktree: `/home/user/Projects/overdeck/.worktrees/fix-claude-worktree-recognition`
- Branch: `wt/fix-claude-worktree-recognition`
- Press.Zone WIP remains in `/home/user/Projects/Press.zone/wordpress/wp-content/.claude/worktrees/multilingual-slice1-claudex`.

## Constraints

- NEVER weaken shared-checkout or deploy-clone protection.
- Reviewer MUST inspect and decide personally. Reviewer MUST NOT delegate, spawn subagents, or hand review to another model.
- Use canonical Overdeck landing and deployment path; `packaging/deploy-local.sh` deploys landed `origin/main` only.
- Do not rerun unchanged broad gates.
- Commit message MUST be one short imperative sentence with no co-author trailer.

## Execution steps

1. Add both supported roots to guard classification.
2. Add focused regression coverage.
3. Run focused guard suite.
4. Run independent review.
5. Commit, land, push, and deploy via canonical controller.
6. Verify installed behavior against real Press.Zone Claude worktree.

## Current receipt

2026-08-14: source and regression test changed. Independent security review found and reproduced two prefix/candidate-local trust bypasses; both were corrected by requiring an exact canonical path from the main repository's trusted `git worktree list --porcelain -z`. Regression now uses real registered worktrees and a hostile unregistered directory with forged `.git` metadata. Focused guard suite passed 68/68. Main agent reviewed the final diff directly; no subagent delegation is permitted for remaining work. Full deploy attempt stopped after discovering canonical deploy script intentionally waits for and deploys landed `origin/main`; no live source was overwritten.

## Next executable action

Commit and submit through canonical ship controller, deploy, verify installed behavior, then resume multilingual Slice 1 without subagents.