What
The child-session write guard in extensions/codecarto/phase-compaction.ts:78-88 says "Same containment as the parent extension's hook (#223)" but permits only ctx.cwd/.codecarto — it omits the configured-library root the parent guard adds (extensions/codecarto/index.ts:477-482) (semantic 5.1). A phase that legitimately writes to the library is refused there, and the contracts describe one guard policy.
Fix
One shared guard policy used by both scopes (a core helper returning the allowed roots), or correct the comment and the contract if the narrower child guard is intended. Test: the child guard admits a write under the configured library root.
Found by the 2026-09-15 self-audit (full-with-deep-audit on this repository at a159d6c, v0.25.0 + #353, ollama-cloud/deepseek-v4.1-flash); confirmed by reading before filing. Report and finding id in self-audit/2026-09-15-v0.25.0-full-with-deep-audit/REVIEW.md.
🤖 Generated with Claude Code
What
The child-session write guard in
extensions/codecarto/phase-compaction.ts:78-88says "Same containment as the parent extension's hook (#223)" but permits onlyctx.cwd/.codecarto— it omits the configured-library root the parent guard adds (extensions/codecarto/index.ts:477-482) (semantic 5.1). A phase that legitimately writes to the library is refused there, and the contracts describe one guard policy.Fix
One shared guard policy used by both scopes (a core helper returning the allowed roots), or correct the comment and the contract if the narrower child guard is intended. Test: the child guard admits a write under the configured library root.
Found by the 2026-09-15 self-audit (
full-with-deep-auditon this repository ata159d6c, v0.25.0 + #353,ollama-cloud/deepseek-v4.1-flash); confirmed by reading before filing. Report and finding id inself-audit/2026-09-15-v0.25.0-full-with-deep-audit/REVIEW.md.🤖 Generated with Claude Code