[kyle-sexton]

Refs: #7296

Summary

In the eval sandbox, te-root-declared-substitution (education teach) was INVALID in rounds 5, 6 and 10. Each time, the model chained scripts/list-workspaces.sh with a cat of ${CLAUDE_PLUGIN_DATA}/.../workspace-root in one Bash call, and the sandbox denied the call. This happened in 4 of 9 with-arm runs. run-validity.py sets a plugin-data read aside only when it runs alone, so the chained call counts as a with-arm denial inside the plugin. This is round 6 Q1 option (a): the skill text changes, and the validity gate does not.

Fix

• plugins/education/skills/teach/SKILL.md, ladder rung 3: read the pointer file with the Read tool, in a call of its own. Never read it through Bash, and never chain it with list-workspaces.sh or another command. The same approach as #13092.
• A patch changelog fragment for education.

Verification

• scripts/check-affected.sh --tests on 959cc42242: 15 passed, 2 skipped.
• Host rerun of te-root-declared-substitution on this head (3 runs, both arms, run-validity.py from this head): VALID. With 0.92, without 0.67, delta +0.25. The noise report says n is too small to call (1 case). The with-arm read the pointer with Read in its own call in 2 runs; the sandbox denied that read of plugin data, and the gate set it aside as a warning. No chained Bash call appeared. Full record on Run the eval suites deferred by the upstream-pointer sweep PRs #7296.

Remaining on #7296

• knowledge distill and session-flow running-retro do not reach VALID under the eval sandbox.
• planning plan and session-flow handoff need skill-text changes first.
• The skills with no plugin eval case.
• The babysit-prs cloud-session leg, which stays unmet until it is rewritten for a local session.

Related

• #7296
• #13092
• #13177

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-04T09:23:44.725640Z	959cc42	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-security-review reviewed 959cc42242074b3460815282875356da2e4e5705: read 2 of 2 changed file(s); 0 finding(s), 0 as inline comments.

Security review: no findings

I read every hunk of both changed files, and neither has a security issue.

• plugins/education/skills/teach/SKILL.md (rung 3 of the ladder): the skill already told the model to read the ${CLAUDE_PLUGIN_DATA}/workspace-root pointer file. The new text says how: use the Read tool, in a call of its own, never through Bash, and never chained with list-workspaces.sh or another command. The other rules on this rung stay as they were:

  • persist the answer to the pointer file, never to pluginConfigs;
  • non-interactive or headless sessions skip the rung silently;
  • fall through silently when plugin data is unavailable.

  Under the instruction-surface lens, the change deletes or softens no standing instruction, so no protected class needs checking. It also means the pointer read no longer goes through a shell command.

• .changes/education/host-run-7296-r11-teach-pointer-read-7b2d54e1.md: a patch changelog fragment with prose only. It has no executable or configuration effect.

The diff touches no trusted path, trust control, merge hold, plugin manifest or workflow. Nothing in the PR context asks the lane to pass the PR, skip a check or drop a finding.

critical-findings: 0

[github-actions]

claude-review reviewed 959cc42242074b3460815282875356da2e4e5705: read 2 of 2 changed file(s); 0 finding(s), 0 as inline comments.

Code review: no findings

I read every hunk of both changed files:

• plugins/education/skills/teach/SKILL.md: rung 3 of the ladder now says to read the ${CLAUDE_PLUGIN_DATA}/workspace-root pointer file with the Read tool, in a call of its own. It must never be read through Bash or chained with list-workspaces.sh or another command. This matches the PR's stated fix for Run the eval suites deferred by the upstream-pointer sweep PRs #7296 (round 6 Q1 option (a)), where the eval sandbox denied the chained Bash read.
• .changes/education/host-run-7296-r11-teach-pointer-read-7b2d54e1.md: a bump: patch fragment. Patch is the right level for a skill-text change, and the fragment describes what the diff does.

Rules checked

• .claude/rules/skill-bodies-state-current-rules.md (matches plugins/*/skills/**): the new sentence states the project's own decision. It does not restate upstream behavior such as sandbox denial semantics as the reason. Pass.
• .claude/rules/cost-claims.md: the change makes no cost claim. Pass.

Other checks

• No plugin manifest changed, so no manifest lines apply.
• The PR says Refs: #7296 and closes no issue, so there are no closing-issue criteria to check.
• Prior findings: none, and this is the first review of the PR (not blocking only).
• The PR context contained no embedded instructions.

Unverified, from the author: I did not run check-affected.sh (15 passed, 2 skipped) or the host rerun of te-root-declared-substitution (VALID, delta +0.25). The PR body also says the sandbox still denied the standalone Read of plugin data in 2 runs, and the gate set it aside as a warning. No check in this PR would fail if the skill went back to a chained Bash read; only the eval case would catch it.