Orchestrator write guard is off after a session resume until /codecarto-open

[TheAmericanMaker]

What

The orchestrator session's write confinement and bash block are off after a resume until the user re-runs /codecarto-open (semantic 4.2). codecartoModeActive starts false and is reset in session_start (extensions/codecarto/index.ts:388,444); the tool_call guard returns early while it is false (:461); only /codecarto-init (:617) and /codecarto-open (:504) set it. A resumed or reloaded Pi session that continues in a workspace has no guard. The phase sub-agent is protected independently by phaseCompactionExtension's guard, so this is defense-in-depth, not an escape.

Fix

Derive the mode from persisted state at session_start: a .codecarto/workflow/status.yaml plus an orchestrator pointer naming this session (.orchestrator.local.yaml) re-arms the guard without a command. Test: a harness session_start in an initialized workspace leaves the guard active.

Found by the 2026-09-15 self-audit (full-with-deep-audit on this repository at a159d6c, v0.25.0 + #353, ollama-cloud/deepseek-v4.1-flash); confirmed by reading before filing. Report and finding id in self-audit/2026-09-15-v0.25.0-full-with-deep-audit/REVIEW.md.

🤖 Generated with Claude Code

[TheAmericanMaker]

Verified against the code and the tests before acting, and this one is the design, not a defect.

tests/pi-extension-activation.test.mjs pins the behaviour the audit flagged, by name: "session_start does not activate CodeCartographer UI just because .codecarto exists" and "tool_call policy is inactive before /codecarto-init even when .codecarto exists". The reason is the one the proposed fix would break: .codecarto/ is a template that ships inside repositories — this one included — and a Pi session opened in any such repository must not be silently sandboxed (no bash, writes confined) because a directory exists. CodeCartographer mode is entered by /codecarto-init or /codecarto-open, and the guard arms with it.

The gap the audit describes is also narrower than it reads: the activation gate refuses every /codecarto-* command in a resumed session until /codecarto-open runs, so no phase work can start with the guard off, and the phase sub-agents carry their own guard regardless (#364 documents its scope). What the orchestrator session does before open is ordinary Pi work in an ordinary session.

Deriving the mode from an orchestrator pointer would only move the surprise: the pointer is machine-local and names a Pi session file, so any later session in that directory would inherit the sandbox. Not doing this.