@@ -4,7 +4,19 @@ description: >-
   Implementation specialist for GitHub issues. Reads triaged issues, implements
   fixes following repo conventions, runs tests and linters, and commits to a
   feature branch. Use when implementing a fix or feature from a triaged issue.
-disallowedTools: Bash(sed *), Bash(awk *), Bash(git push *), Bash(git add -A *), Bash(git add --all *), Bash(git add . *), Bash(git commit --amend *), Bash(gh pr create *), Bash(gh pr edit *), Bash(gh pr merge *), Bash(gh issue edit *), Bash(gh issue comment *)
+disallowedTools: >-
+  Bash(sed *), Bash(sed),
+  Bash(awk *), Bash(awk),
+  Bash(git push *), Bash(git push),
+  Bash(git add -A *), Bash(git add -A),
+  Bash(git add --all *), Bash(git add --all),
+  Bash(git add . *), Bash(git add .),
+  Bash(git commit --amend *), Bash(git commit --amend),
+  Bash(git reset --hard *), Bash(git reset --hard),
+  Bash(git rebase *), Bash(git rebase),
+  Bash(gh pr create *), Bash(gh pr edit *), Bash(gh pr merge *),
+  Bash(gh issue edit *), Bash(gh issue comment *),
+  Bash(gh api *)
 model: opus
 skills:
   - code-implementation
 
@@ -226,7 +226,11 @@ The code agent definition ([`agents/code.md`](../agents/code.md)) and its implem
 
 **Stream editors blocked.** `sed` and `awk` are disallowed for source file modification. The agent must use structured Write/Edit tools, which produce cleaner diffs and avoid silent corruption from regex misfires.
 
-**Protected paths.** The agent cannot modify CODEOWNERS, CI workflows, agent configurations, harness definitions, sandbox policies, or pre/post scripts — preserving the integrity of its own guardrails.
+**Protected paths.** The agent cannot modify CODEOWNERS, CI workflows, agent configurations, harness definitions, sandbox policies, or pre/post scripts — preserving the integrity of its own guardrails. Protected-path enforcement is layered: the agent definition declares which paths are off-limits, `disallowedTools` catches obvious violations at the tool level, and the post-script independently verifies that no protected files appear in the commit diff before pushing. The post-script check is the authoritative gate — the agent cannot be trusted to police its own constraints.
+
+**Defense-in-depth model.** No single enforcement layer is airtight. Security relies on the combination of four layers: (1) agent instructions (prose constraints the model follows), (2) `disallowedTools` patterns (belt-and-suspenders catch for obvious violations — pattern-matching has known limitations around argument reordering and subshell wrapping), (3) sandbox network policy (the authoritative control for preventing exfiltration and unauthorized API access), and (4) post-script validation (independent verification of the agent's output before it leaves the sandbox boundary). Sandbox-level enforcement and post-script validation are the load-bearing layers; agent instructions and `disallowedTools` are defense-in-depth.
+
+**Three-layer secret scanning.** Secret scanning runs at three points: (1) a file-level scan during development (step 9a — early warning), (2) a staged-content scan before commit (step 10b — catches anything that slipped through or changed after the first scan), and (3) a post-script scan before push (the authoritative gate, independent of the agent). Layers 1 and 2 run inside the sandbox under agent control; layer 3 runs outside the sandbox under the automation layer's control.
 
 ### 9. PR sandbox / CI mirror
 
 
@@ -2,23 +2,38 @@
 # Run secret scanning against specified files or the current staging area.
 #
 # Usage:
-#   scan-secrets file1 [file2 ...]   Stage files, scan, unstage (for step 8a)
-#   scan-secrets --staged             Scan already-staged files in place (for step 9b)
+#   scan-secrets file1 [file2 ...]   Stage files, scan, unstage (for step 9a)
+#   scan-secrets --staged             Scan already-staged files in place (for step 10b)
 #
 # Self-bootstrapping: if gitleaks is not on PATH, the script downloads it
 # to a temporary directory. Works on any Linux/macOS runner (GitHub Actions,
 # Tekton, GitLab CI, local) — requires only curl or wget plus tar.
 #
-# Prefers gitleaks (protect --staged); falls back to pre-commit hooks if
-# a .pre-commit-config.yaml exists in the repo.
+# Prefers gitleaks (protect --staged); falls back to the gitleaks
+# pre-commit hook if a .pre-commit-config.yaml exists in the repo.
 # Exits non-zero if secrets are detected or no scanner can be obtained.
 set -euo pipefail
 
-GITLEAKS_VERSION="${GITLEAKS_VERSION:-8.30.1}"
+# Self-bootstrap version — used only when gitleaks is not already on PATH
+# (e.g. local dev, CI without a pre-built image).  When running inside a
+# sandbox image, the image-provided gitleaks takes precedence and this
+# version is never consulted.  To update: bump the version here and
+# refresh the checksums from the gitleaks release page.
+GITLEAKS_VERSION="8.30.1"
+
+# Pinned checksums for the supported platforms.  Source:
+#   https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_checksums.txt
+declare -A GITLEAKS_SHA256=(
+  [linux_x64]="551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb"
+  [linux_arm64]="e4a487ee7ccd7d3a7f7ec08657610aa3606637dab924210b3aee62570fb4b080"
+  [darwin_x64]="dfe101a4db2255fc85120ac7f3d25e4342c3c20cf749f2c20a18081af1952709"
+  [darwin_arm64]="b40ab0ae55c505963e365f271a8d3846efbc170aa17f2607f13df610a9aeb6a5"
+)
 
 # --- locate or install gitleaks -------------------------------------------
 
 resolve_gitleaks() {
+  # Prefer a pre-installed binary (e.g. baked into a sandbox image).
   if command -v gitleaks &>/dev/null; then
     echo "gitleaks"
     return
@@ -40,7 +55,14 @@ resolve_gitleaks() {
     *) echo "error: unsupported architecture $(uname -m)" >&2; return 1 ;;
   esac
 
-  local url="https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_${os}_${arch}.tar.gz"
+  local platform_key="${os}_${arch}"
+  local expected_sha="${GITLEAKS_SHA256[${platform_key}]:-}"
+  if [[ -z "${expected_sha}" ]]; then
+    echo "error: no pinned checksum for ${platform_key}" >&2
+    return 1
+  fi
+
+  local url="https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_${platform_key}.tar.gz"
   local tmp
   tmp="$(mktemp -d)"
   trap 'rm -rf "${tmp}"' RETURN
@@ -54,7 +76,26 @@ resolve_gitleaks() {
     return 1
   fi
 
-  tar -xzf "${tmp}/gitleaks.tar.gz" -C "${tmp}" gitleaks
+  local actual_sha
+  if command -v sha256sum &>/dev/null; then
+    actual_sha="$(sha256sum "${tmp}/gitleaks.tar.gz" | cut -d' ' -f1)"
+  elif command -v shasum &>/dev/null; then
+    actual_sha="$(shasum -a 256 "${tmp}/gitleaks.tar.gz" | cut -d' ' -f1)"
+  else
+    echo "error: no sha256 tool available (need sha256sum or shasum)" >&2
+    return 1
+  fi
+  if [[ "${actual_sha}" != "${expected_sha}" ]]; then
+    echo "error: gitleaks tarball checksum mismatch — possible tampering" >&2
+    echo "  expected: ${expected_sha}" >&2
+    echo "  actual:   ${actual_sha}" >&2
+    return 1
+  fi
+
+  tar -xzf "${tmp}/gitleaks.tar.gz" -C "${tmp}" gitleaks || {
+    echo "error: failed to extract gitleaks from tarball" >&2
+    return 1
+  }
   mkdir -p "${cache_dir}"
   mv "${tmp}/gitleaks" "${cached}"
   chmod +x "${cached}"
@@ -105,10 +146,10 @@ if [[ -n "${GITLEAKS}" ]]; then
     scan_exit=1
   fi
 else
-  if ! pre-commit run gitleaks --files "${files[@]}" 2>/dev/null; then
-    if ! pre-commit run --files "${files[@]}"; then
-      scan_exit=1
-    fi
+  # Pre-commit fallback: only accept a gitleaks hook, not generic hooks.
+  if ! pre-commit run gitleaks --files "${files[@]}"; then
+    echo "error: pre-commit gitleaks hook failed or not found — cannot verify secrets" >&2
+    scan_exit=1
   fi
 fi
 
 
@@ -28,8 +28,7 @@ Commands you will need during this procedure:
 - `pre-commit run --files <files>` — linting and secret scanning
 - `go build ./...`, `go vet ./...` — compilation checks
 
-Use `Read`/`Write`/`Grep`/`Glob` for file operations. Do not use `sed` or
-`awk` for edits.
+Use `Read`/`Write`/`Grep`/`Glob` for file operations.
 
 ### Secret scanning
 
@@ -97,7 +96,7 @@ code before relying on it.
 ### 3. Discover repo conventions
 
 Before writing any code, understand how this repository works. Use `Read`
-and `Glob` — not `cat` or `ls` — to inspect project configuration:
+and `Glob` to inspect project configuration:
 
 1. **Read project-level instructions.** Use `Read` on `CLAUDE.md`,
    `CONTRIBUTING.md`, and `AGENTS.md` (if they exist).
@@ -131,7 +130,12 @@ issue from a previous run:
 git branch -a | grep "agent/<number>-"
 ```
 
-**If a branch exists:** Check it out and work on top of it.
+**If a branch exists:** Check it out and work on top of it. Previous runs
+may have left commits that were later rejected by the review agent. Before
+building on top, read the existing commits (`git log --oneline origin/<target>..HEAD`)
+and understand the delta from the target branch. If a previous commit
+introduced a problem the review agent flagged, fix it in your new commit
+rather than amending.
 
 **If no branch exists:** Proceed to step 5.
 
@@ -198,8 +202,10 @@ Before writing code, form a concrete plan:
 4. **Follow cross-repo references** — if the issue, docs, or triage comments
    link to other repos (e.g., an e2e test suite, a dependent service, a
    related PR in another repo), read those references to understand the full
-   picture. Use `gh issue view`, `gh pr view`, or
-   `gh api repos/{owner}/{repo}/contents/{path}` to fetch what you need.
+   picture. Use `gh issue view`, `gh pr view`, or `gh pr diff` to fetch
+   what you need. For files in other repos that are not part of an issue
+   or PR, use `Read` on a local clone if available, or note the gap in
+   your plan and proceed with the context you have.
    Do not chase every import — focus on references that the issue context
    points you toward.
 5. **Identify what to change** — list the specific files and functions you will
@@ -258,7 +264,12 @@ make lint        # or: pre-commit run --files <changed-files>
 1. Read the failure output. Identify the root cause.
 2. Fix the issue in your implementation. Do not weaken or skip tests.
 3. Re-run secret scan (9a), then tests. This consumes one retry iteration.
-4. Repeat until tests pass or the retry limit (default: 2) is reached.
+4. Repeat until tests pass or the retry limit is reached.
+
+The retry limit is read from the `MAX_RETRIES` environment variable
+(default: 2 if unset). The harness may also enforce a hard timeout
+independently — if the harness kills the session, your retry count is
+irrelevant.
 
 If the retry limit is reached and tests still fail, do not commit. Stop.
 
@@ -274,8 +285,8 @@ Read every line. Check for:
 
 - Changes that don't serve the issue (scope creep, unrelated formatting)
 - Accidental artifacts: debug prints, commented-out code, TODO comments
-- Forbidden files in the diff: `.env`, `*.pem`, `*.key`, `credentials.json`,
-  `CODEOWNERS`, `.github/workflows/`
+- Secret material: `.env`, `*.pem`, `*.key`, `credentials.json`
+- Protected-path files (see agent definition for the authoritative list)
 
 If you added more than necessary, revert the extras before staging.
 
@@ -338,6 +349,15 @@ it also fails on the base branch before skipping it.
 **Do not push the branch.** The post-script handles pushing, PR creation,
 and failure reporting.
 
+## Partial work
+
+If you hit a token limit or context window boundary before completing the
+implementation, and the tests pass on the partial work: commit what you have.
+The review agent downstream will evaluate completeness — incomplete-but-passing
+code is caught at the review stage, not the implementation stage. The commit
+message should note that the work is partial (e.g., "partial implementation"
+in the description) so the review agent and post-script can act accordingly.
+
 ## Constraints
 
 The agent definition (`agents/code.md`) is the authoritative list of