[unohee]

Why

claude, codex and cursor hand the whole tool loop to another program. OpenSwarm's publication fence, protected files, role tool limits and (since #840/#841) the credential-free, loopback-only shell therefore never reach them. base.ts can only log that they were dropped, and claude runs with --permission-mode bypassPermissions. An unattended worker on one of them has no fence at all — the AGT-4783 incident class (AGT-4444).

This is cycle 1 of the factory-stability loop; check C2 of the stability harness.

What changes

• New src/adapters/unattendedPolicy.ts. It scans every place the daemon can pick an adapter:
  • top-level adapter;
  • autonomous.defaultRoles;
  • per-project roles;
  • adapterRouting primary and fallbacks;
  • orchestrator;
  • loopAdvisor.
    A role the operator switched off is skipped.
• service.ts: startup throws before anything starts, naming each offending setting, the safe alternatives and the opt-out. The check runs whenever an autonomous section exists, heartbeat on or off, because an explicit dispatch runs the same workers. Interactive CLI use is unaffected.
• autonomous.allowDelegatedAdapters (default false): the operator's explicit acceptance. Schema, type and the hand-written transformConfig mapping are all updated, since a schema field alone does not reach callers.
• One thing worth knowing: the adapterRouting.fallbacks schema default is ['cc-router', 'cursor']. A bare adapterRouting: block already routed to cursor, so it is now refused unless fallbacks are set explicitly.
• CHANGELOG: merged the duplicated ### Changed / ### Added headings that fix(worker): withhold credentials from worker bash and fail closed without a sandbox (AGT-4783) #840 and feat(worker): loopback-only network for worker bash and a per-project setup step (AGT-4798) #841 left in Unreleased. No entry was dropped (11 bullets before and after).

Verified

• unattendedPolicy.test.ts (17): each configuration surface on its own, every adapter name in ADAPTER_NAMES, disabled roles, opt-in handling (=== true only).
• service.test.ts: a wiring test proves startup refuses and startAutonomous is never called. 11 existing tests used adapter: 'claude' with an autonomous section; they now opt in explicitly, because they test boot behaviour, not adapter policy.
• Mutation checks, each reverted:
  • fallbacks unscanned → 3 fail;
  • disabled role not skipped → 1 fail;
  • opt-in ignored → 1 fail;
  • always opted in → 10 fail;
  • service not wired → 1 fail.
• Stability harness C2: 0/2 → 2/2; C1 stays 4/4.
• src/adapters, src/core, osSandbox, workerSetup: 1227 passed. typecheck, lint.
• The live config.yaml uses adapter: ollama-cloud and no adapterRouting, so it is unaffected.

Not covered

• periodicReviews[].adapter (read-only review profiles) is not checked.
• The runtime base.ts warning is unchanged for runs that do not go through the daemon.