[HugoXK]

Row 1 of #1082 (#963 remainder): apply obeys the operator's write allowlist.

What changed (20a75044, on 0c9e936d)

• agentdescent/cli.py: _operator_write_guard() builds a check_write from surface_common.ensure_write_path (SurfaceError → RunStoreError, exit 2) and cmd_apply passes it into the one existing apply_with_target call. _check_apply_paths already checks the destination, every written leaf and the .bak-N slot before anything is written, so the refusal lands before disk is touched — file and tree/skill-library, --from, --install-to included.
• show writes nothing, so --diff still renders; _refuse_plan_outside_write_dirs() makes its apply_plan report the same refusal instead of promising a write that apply would reject.

Semantics — three states, not two

AGENTDESCENT_SURFACE_WRITE_DIRS	behaviour
set, non-empty	exactly those roots
set, empty	every write refused, including inside the cwd
unset, AGENTDESCENT_NESTED=1	defaults to the MCP boundary: cwd + $AGENTDESCENT_HOME
unset, not nested	today's behaviour (allow=None)

The nested default is the amendment on the plan: a host worker that is handed no variable must not be free to write anywhere, which is the escape #963 is about. Interactive CLI behaviour is unchanged.

Red at base 0c9e936d

Clean tree at the base this PR was cut from, with only tests/test_mcp_write_confinement.py present: 6 failed, 17 passed -- every new refusal row red, the two positive rows green as they should be. Live main has moved on (c94e9d67); this PR's base is 0c9e936d and the branch is not refreshed.

Verification at the tip

Tip SHA: 20a7504

Ran:

• pytest -q tests/test_mcp_write_confinement.py at the tip -> pass (23 passed)
• apply/surface set at the tip, 11 files (test_apply_backup_away_from_skills, test_apply_from, test_apply_noop, test_apply_symlink_dest, test_cli_surface_error_envelope, test_cli_surface_p1, test_public_surface, test_rsi_surface_integration, test_skill_library_apply_install, test_surface_governed_integrity, test_surface_out_link_guard) -> 102 passed, 7 failed; the same 11 files on a detached tree at base 0c9e936d -> 102 passed, 7 failed, the same ids, every one OSError: [Errno 30] Read-only file system: '/home/xuke/.agentdescent' (these tests write ~/.agentdescent behind a read-only HOME), so none of the 7 is this diff
• pytest -q tests -k "apply or surface" at the tip -> 168 passed, 7 failed, 7237 deselected (the same 7 ids)
• red row above, measured in a detached worktree at 0c9e936d with only the new test file copied in
• python -m tools.gen_api_docs --check -> pass (docs/api.md is up to date)
• python -m tools.changelog_fragments check -> pass (34 fragment(s) OK)

Not run:

• full pytest -q at this tip -> not run in this pass; CI test (3.9)--(3.13) is green at 20a750447ccf, and the base red above is the fail-on-main evidence
• mkdocs build --strict -> not run in this pass; CI build is green at the tip
• the docker sandbox and any live-model leg -> not available on this host

Docs/notes

• docs/plugins.md gains the worker-default rule; docs/dsh-super-agent.md notes it next to the long-run page; changelog.d/1082-cli-write-dir-enforcement.md.
• Known consequence, intended: in a nested worker an unset allowlist now also refuses apply --install-to <host dir> for host directories outside cwd + $AGENTDESCENT_HOME.

Partial: #1082 — rows 2 (per-Ticket budget caps) and 3 (child-env scrub test) are still open.

[Birfy]

Verdict: PASS

Tip SHA: 20a750447ccfc7dff4eba120b24a65eb8a1b9ec2 · Risk tier: T2 (risk_gate.py from main c94e9d67)

Ran:

• pytest tests/test_mcp_write_confinement.py on the tip → 23 passed (new CLI cases: outside dest/tree refused with exit 2, inside allowed, unset unchanged, .bak-N slot refused before the destination changes, empty value fails closed, nested default = cwd + $AGENTDESCENT_HOME, show reports the refusal in apply_plan).
• Read _operator_write_guard: unset + not nested returns None, so terminal apply --to keeps today's behaviour; it reuses the existing check_write hook of apply_with_target, so the refusal lands before any write.
• Required CI green on this tip.

Not run: a real dsh-superagent worker end-to-end.