refactor(executing-a-branch-plan): scope Step 8 dispatches to sanctioned call sites

[tvna]

Summary

Give executing-a-branch-plan Step 8's two fresh subagent dispatches
(refactor/simplify pass, adversarial code review) an explicit, sanctioned
agentType/subagent_type -- the refactor pass reuses branch-plan-task
(widened "Sanctioned call sites"), the adversarial review pass reuses the
existing read-only review-persona (from #1559/PR #1599) -- so neither
dispatch silently reuses a definition whose own description states
"never invoke directly for anything else."

Facts

• refactor-and-review-gate.md Step 8 dispatched two subagents with no
  agentType/subagent_type named, distinct from Step 6's task agents
  (branch-plan-task).
• agents/branch-plan-task.md and .claude/agents/branch-plan-task.md
  both stated "Never invoke directly for anything else."
• agents/review-persona.md already exists (refactor(reviewing-an-artifact): add a tool-scoped review-persona agent definition for the 6-persona fan-out #1559, merged as PR refactor(screening-a-low-trust-contribution): isolate diff reasoning into review-persona subagent #1599)
  with a tools: Read, Grep, Glob allow-list and an enumerated
  "Sanctioned call sites" section (3 entries).

Assumptions

• The refactor pass's tool needs (Edit/Write/Read/Grep/Glob/Bash,
  disallowedTools: mcp__github) match branch-plan-task's existing
  shape -- stated as a premise in issue refactor(executing-a-branch-plan): give Step 8's refactor/adversarial-review dispatches their own agent-scope, stop implicit branch-plan-task reuse #1560's own Facts section, not
  independently re-derived here.
• Widening branch-plan-task's description (rather than adding a sibling
  agent definition) was chosen during planning: it follows
  review-persona.md's own established "Sanctioned call sites" pattern
  and avoids duplicating a near-identical tool scope across two files.

Risk / blast radius

Prose-only changes to two agent-definition files and three
executing-a-branch-plan skill/reference files. No change to Step 6's
existing task-dispatch behavior, tool scope, or hooks. No change to
review-persona's existing three call sites or its tool allow-list.
Blast radius is limited to Step 8 of executing-a-branch-plan, a skill
already gated by its own Authorization/threat-model steps before any of
this ever dispatches.

Rollback

git revert this PR's merge commit. No data/schema change, no external
side effect beyond the edited files themselves.

Verification

Criterion	Proof method	Result
The refactor pass's dispatch does not contradict branch-plan-task's "never invoke directly for anything else" scope	Static review of the widened description/"Sanctioned call sites" section in both variants; uv run --frozen python3 -m pytest --no-cov -q and uv run --frozen python3 .github/scripts/gitapex_gate_local_preflight.py green	PASS -- 7885 tests passed, 44/44 gates passed (see Execution log)
The adversarial review pass runs under a read-only tool boundary	review-persona.md's "Sanctioned call sites" gains a 4th entry (Step 8 adversarial review); existing 3 entries unchanged	PASS -- entry added, entries 1-3 and tools: allow-list byte-identical
The "Findings -> verify -> fix confirmed -> validate" text states fixes happen outside the read-only dispatch	Text review of refactor-and-review-gate.md against review-persona.md's own tools: list (no Write/Edit)	PASS -- sub-step 2 rewritten to state this explicitly; further tightened during Step 8's own adversarial review to remove a self-contradiction (see Execution log)
Both dispatches' existing model/effort pins survive the change	Diff review confirming the pin text in refactor-and-review-gate.md is unchanged	PASS -- Model/effort pin paragraph (L46-55) confirmed byte-identical

Checklist

• Tests pass locally
• Docs updated if behavior changed
• Issue number cited in every commit
• If this PR adds/modifies a skills/*/SKILL.md, a docs/superpowers/specs/*.md design doc, a security-relevant skill, or a deterministic checker script (skills/*/scripts/*.py, evals/scripts/*.py, .github/scripts/*.py), a ## Skill audit evidence section discloses the required verdicts/waivers (see .github/scripts/gitapex_gate_skill_audit_disclosure.py)
• If this PR adds a new Kept-edit-log entry to any evals/*/split.md, that entry discloses a Transfer check line (see .github/scripts/gitapex_gate_transfer_check_disclosure.py)
• If this PR adds or increases a skills/*/SKILL.md's Stop-boundary bullets or named dispatch branches, evals//tasks/*.yaml gained at least as many new fixtures (see .github/scripts/gitapex_gate_skill_branch_fixture_coverage.py)

Skill audit evidence

skills/executing-a-branch-plan/SKILL.md is modified by this diff (its
references/refactor-and-review-gate.md and
references/execution-and-dispatch.md also change). Frontmatter
(name/description) is byte-identical before/after --
gitapex_compute_skill_audit_flags.py --base-ref origin/main --head-ref HEAD reports description-changed-skills: "" -- so neither audit is
required to file a real verdict under issue #427's stricter rule.

• battle-testing-a-skill: WAIVED: no new SKILL.md authored and no
  frontmatter/description change in this diff -- the change is limited to
  Step 8's own procedure prose (naming the two dispatches' already-existing
  agentType/subagent_type identifiers explicitly, and fixing a
  self-contradiction the pipeline's own Step 8 adversarial-review pass
  found in this same PR's first commit -- see Execution log). Adversarial
  stress-testing of the skill's own robustness is disproportionate to this
  narrow blast radius (see Risk / blast radius above). Deterministic shape
  checker run instead: gitapex_check_skill_shape.py --allowed-root skills skills/executing-a-branch-plan -- 61/61 checks PASS.
• evaluating-skill-quality: WAIVED: same narrow scope as above --
  description/frontmatter untouched, no new skill authored, no change to
  invocation mode, portability (Mixed), or capability-assumption
  (Adaptive) declarations. A full 9-dimension probabilistic-maturity
  review (this skill's own Procedure requires a fresh, isolated subagent
  dispatch for it) is disproportionate to a Step-8-prose-only clarification.
  Deterministic checks run directly instead: gitapex_check_skill_shape.py
  (61/61 PASS, above) and the companion
  gitapex_scan_execution_requirements_drift.py skills/executing-a-branch-plan,
  which reports 4 pre-existing findings (declared
  executionRequirements.tools.write/shell: [] vs. mutating/shell
  language in SKILL.md and a bundled script) that predate this PR and are
  already documented as a deliberate declaration in
  metadata/gitapex.yaml's own references entry for issue gate-proposal: retro #1475 repair 2: Full local verification suite not required inside each task worktree before merge-back #1476 ("the new
  script's subprocess/write calls run only inside Claude Code's own hook
  runner, never a step this skill's orchestrating instructions direct a
  calling session to perform"); this diff does not touch
  metadata/gitapex.yaml or that script, so this pre-existing,
  already-documented drift is disclosed here rather than re-litigated.

Merge gate: independent review

This PR is also subject to the independent-review-pending required
status check (see .github/workflows/independent-review-pending.yml /
.github/scripts/gitapex_gate_independent_review_pending.py). It stays
pending/failing until a ## Independent review verdict section naming
this PR's current head commit is recorded in this body --
drafting-a-pr-to-merge's own Step 8 records it once its independent
review completes. There is nothing for you to do here now: do not
pre-fill this section yourself, and do not remove this note.

Independent review verdict

Outer layer (GitHub-native reviewer). No confirmation that Anthropic's
"Claude Code Review" GitHub App is installed on this repository; no check
run bearing that name appears anywhere in this PR's own check-run history
(46 check runs inspected, none named accordingly). Falling back to GitHub
Copilot's copilot-pull-request-reviewer[bot] per this step's own
fallback rule: requested via request_copilot_review at approximately
2026-09-02T23:44Z. As of this recording (2026-09-03T03:51Z, roughly 4
hours later -- well past the 30-minute unreachable threshold),
pull_request_read methods get_reviews and get_comments show no
Copilot response -- treated as unreachable for this step, per
drafting-a-pr-to-merge Step 8's own rule. Disclosed regardless of
response: Copilot's review is Comment-only with no pass/fail signal of
its own, a materially weaker guarantee than the Claude Code Review App's
severity summary.

Inner layer (reviewing-an-artifact, effort: low; always runs).
Fetched the PR's live diff via pull_request_read method get_diff
(head commit 7672cb0d, 9 files changed). Step 0's eligibility check
found a mixed target: three files are Subagent-definition instruction
channels (agents/branch-plan-task.md, .claude/agents/branch-plan-task.md,
agents/review-persona.md) and three are a SKILL.md plus its
references/ (skills/executing-a-branch-plan/SKILL.md,
references/execution-and-dispatch.md,
references/refactor-and-review-gate.md) -- both specialist-owned target
types per this skill's own Step 0 deferral list, deferred rather than
re-reviewed here:

• SKILL.md + references -> evaluating-skill-quality (already disclosed
  above under "Skill audit evidence": WAIVED, reason recorded there --
  narrow, non-frontmatter scope).
• The three agent-definition files -> evaluating-context-channel-maturity.
  Not run this round: judged disproportionate to the actual change (each
  file's edit is a single new "Sanctioned call sites" entry following an
  already-established pattern used 3 times before in review-persona.md
  alone), the same proportionality basis already applied to the
  skill-quality waiver above. Residual risk, disclosed rather than
  silently assumed clear: a full five-point maturity review (ownership/
  review gating, bounded growth, placement/disclosure fit,
  enforcement-fit, provenance/adversarial independence) of these three
  files has not actually run.

Remainder (.gitignore, tests/test_gitapex_gitignore_settings_local.py,
docs/superpowers/plans/2026-09-02-claude-pr-1560-prep-o93l5b.md)
classified safe at Step 1 (a config addition, an added test, a doc
update) -- no security-tier signal found anywhere in these three files,
so Steps 2-5's persona fan-out was skipped per this skill's own Step 1
rule. 0 confirmed findings, 0 unconfirmed-concern findings.

• Verdict: CLEAN
• Verified commit: 7672cb0

Related Issue

Closes #1560

Acceptance Criteria Map

Criterion	Interpretation	Planned ops	Proof method	Residual risk
The refactor pass's dispatch does not contradict branch-plan-task's "never invoke directly for anything else" scope	Simplify branch-plan-task's description and add a "## Sanctioned call sites" section to its body, following review-persona.md's own pattern. Call site 1 = the existing Step 6 task dispatch, call site 2 = Step 8's refactor/simplify pass (full accumulated diff, behavior-preserving only)	agents/branch-plan-task.md, .claude/agents/branch-plan-task.md, skills/executing-a-branch-plan/SKILL.md, skills/executing-a-branch-plan/references/execution-and-dispatch.md, skills/executing-a-branch-plan/references/refactor-and-review-gate.md	Static review + existing pytest/local-preflight green	Plugin variant carries no hooks, so the Bash exclusion stays prose-dependent (known, unchanged)
The adversarial review pass runs under a read-only tool boundary	Add a 4th entry to review-persona.md's "## Sanctioned call sites" (Step 8's adversarial review pass)	agents/review-persona.md, SKILL.md, execution-and-dispatch.md, refactor-and-review-gate.md	Static review + existing tests green	The tools allow-list enforcement is not yet live-verified (known from #1559, unchanged)
The "Findings -> verify -> fix confirmed -> validate" text states fixes happen outside the read-only dispatch	Edit refactor-and-review-gate.md's sub-step 2 text so findings are returned by the review-persona dispatch, but verification/fix/validate happen in the main thread or the refactor pass's own subagent	skills/executing-a-branch-plan/references/refactor-and-review-gate.md	Text review against review-persona.md's own tools: list (no Write/Edit)	None identified
Both dispatches' existing model/effort pins survive the change	Do not remove or alter the existing pin text in refactor-and-review-gate.md	Diff review at each edit site	Diff review confirming the pin text is unchanged before/after	Easy to miss (known risk)

Execution log

• PlanApproved{run_id: deb027a5}
• TaskStarted{run_id: deb027a5, task_id: task-1}
• TaskCompleted{run_id: deb027a5, task_id: task-1, commit_sha: 68d08580} -- Task 1 (the sole ACM task) landed all 6 planned edits, full pytest suite (7885 passed) and local-preflight (44/44 gates) green. Diff screening (screening-a-low-trust-contribution checks 2-8 via review-persona) found checks 2/4/5/6/7/8 clear; check 3 (governance-file edit) hard-flagged all 6 changed files by category -- reviewed and accepted as the expected, ACM-approved change this issue's own scope calls for (issue refactor(executing-a-branch-plan): give Step 8's refactor/adversarial-review dispatches their own agent-scope, stop implicit branch-plan-task reuse #1560's Requested outcome is precisely to edit these governance/agent-definition files), not an unexpected diff. Commit provenance scan clean after amending the task commit to drop a disallowed Claude-Session: trailer (CONTRIBUTING.md's PR-body-trailer disclosure exception does not extend to commit messages). origin/main drift check clean (up to date, 5 commits ahead).
• Step 8 (mandatory aggregate refactor + adversarial review), dispatched over the full accumulated diff (main..HEAD, 9 files): refactor/simplify pass (agentType: 'branch-plan-task') found nothing to fix -- clean pass, no commit. Adversarial review (subagent_type: 'review-persona') found one CONFIRMED correctness bug: the same commit's own new text let a confirmed adversarial-review finding be fixed by "the refactor pass's own subagent," directly contradicting that subagent's own new "Sanctioned call sites" entry restricting it to "behavior-preserving edits only" (a confirmed correctness-bug fix is behavior-affecting by definition). Fixed in the calling main thread (per this same gate's own routing rule) by dropping that option from both refactor-and-review-gate.md and SKILL.md, leaving the calling main thread as the sole fix-applier -- commit_sha: 7672cb0d. Full pytest suite (7885 passed) and local-preflight (44/44 gates) re-run clean after the fix, plus gitapex_check_skill_shape.py (61/61 checks) since the fix touched SKILL.md. origin/main drift check re-run clean between fix rounds (up to date, 6 commits ahead). Commit provenance scan clean.
• SkillAuditEvidenceRecorded{run_id: 7672cb0d, checks: [battle-testing-a-skill: WAIVED, evaluating-skill-quality: WAIVED]} -- skill-audit-disclosure CI check found the PR body did not yet contain a required ## Skill audit evidence section (diff touches skills/executing-a-branch-plan/SKILL.md). Both audits waived with reason (see that section above); decision confirmed with the operator before recording, given the narrow, non-frontmatter scope of this diff.
• IndependentReviewRecorded{run_id: 7672cb0d, outer_layer: copilot_unreachable, inner_layer: reviewing-an-artifact_clean} -- Step 8's two-layer independent review completed against head commit 7672cb0d: outer layer (Copilot, requested via request_copilot_review) posted no response past the 30-minute unreachable threshold; inner layer (reviewing-an-artifact, effort low) found 0 confirmed findings, deferring the skill/agent-definition files to their own specialist audits per its Step 0 (see the Independent review verdict section above for the full breakdown). Verdict: CLEAN, recorded above.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: 121f49e5-374e-4094-b8e4-47809a01150a

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.66%. Comparing base (f274bda) to head (7672cb0).
⚠️ Report is 10 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1699   +/-   ##
=======================================
  Coverage   99.66%   99.66%           
=======================================
  Files         152      152           
  Lines       24725    24725           
  Branches     2967     2967           
=======================================
  Hits        24643    24643           
  Misses         82       82           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.