open/linkedin-studio
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity Actions

fix(linkedin-studio): S24 harden create — drop orphan Glob grant from routing front-door

Browse source 
create is the Create-journey routing front-door (v4.1): guided "what to make?"
-> routes to the command that owns the format; delegates only, never drafts.
Routing axis is clean — all 8 emitted targets (post/quick/react/carousel/video/
multiplatform/batch/newsletter) resolve to commands/Y.md. Delegates-only holds:
every "draft" mention is the no-draft promise (:7/:22, long-form lock :66) or a
target-description (:38), no leak. The one finding was grant-hygiene: Glob was
declared (:14) but never used — the only file access is a fixed-path Read of the
state file (:26), which needs no pattern-matching. Same orphan-grant pattern as
S17-S22.

1 edit, commands/create.md only:
- allowed-tools :14: drop orphan Glob; net = {Read, AskUserQuestion}.

Verify: re-grep final — Glob NONE, allowed-tools = Read + AskUserQuestion;
git diff --stat = 1 file -1; test-runner 81/0/0 exit 0; counts 29/19 unchanged
(.md-only). FIXED, 0 deferrals. Scope note: Glob-orphan may recur in sibling
front-doors (measure S25, linkedin S26) — not expanded; each catches its own.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016qgzo6rxthw7KuxHjn5vyE
This commit is contained in:
Kjell Tore Guttormsen 2026-06-19 21:25:00 +02:00
commit d783f261dd
2 changed files with 33 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

1
commands/create.md
View file

@ -11,7 +11,6 @@ description: |
"new content", "help me create", "i want to post something", "linkedin create".
allowed-tools:
- Read
- Glob
- AskUserQuestion
---

33
docs/hardening/log.md
View file

@ -1690,3 +1690,36 @@ read, pattern greps) from a tool, never by reasoning.
fixture needed (pure prose, no state).
---
### /linkedin:create — content-creation front-door (guided "what to make?" → routes to the owning creation command); delegates only, no drafting (S24)
**CLASS: routing front-door** (Create-journey, v4.1). Predicate: every emitted `/linkedin:Y` resolves to
`commands/Y.md`; bidirectional grant-hygiene; "delegates only" (never drafts).
**TEST (tool-grounded).**
- Routing (main axis): **8/8 targets resolve** — `commands/{post,quick,react,carousel,video,multiplatform,
batch,newsletter}.md` all present (menu `:38-45` / table `:54-63`).
- Grant-hygiene (bidirectional): `Read` (`:13`) used at `:26` (fixed-path state read); `AskUserQuestion`
(`:15`) used at `:36`; **`Glob` (`:14`) ORPHAN** — zero body usage, only file access is the fixed-path
Read (`:26`; Read handles the "if exists" itself — no pattern-matching). No missing grants (routing =
narrative handoff, no tool).
- Delegates-only: all 4 "draft" hits are the no-draft promise (`:7/:22`, long-form lock `:66`) or
target-description (`:38` = what `/linkedin:post` does); no drafting leak.
- Persona (ICP author, no format named): Step 0 `:24-28` state glance → Step 1 `:30-45` AskUserQuestion
(8 opts) → Step 2 `:47-63` route into target workflow, steps not inlined; URL fast-path `:32-34` →
`/linkedin:react`. ✓
**HARDEN (1 edit, 1 file — `commands/create.md`).**
1. [REWORK · grant-hygiene] dropped orphan `Glob` from `allowed-tools` (`:14`); net = {Read, AskUserQuestion}.
**VERIFY.**
- Re-grep final: `Glob` → **NONE**; `allowed-tools` = Read + AskUserQuestion (`:13-14`).
- `git diff --stat` = 1 file, **−1**.
- `bash scripts/test-runner.sh` → `Passed: 81 · Failed: 0 · Warnings: 0`, **exit 0**; counts **29/19**
unchanged (.md-only edit).
- Disposition: **FIXED** (1 edit, 1 file) · 0 deferrals · routing axis **PASS**, delegates-only **PASS**,
grant-hygiene **FIXED** · no fixture (pure routing prose).
- Scope note: `Glob`-orphan may be systemic in sibling front-doors (`measure` S25, `linkedin` S26) — not
expanded (one command per session); each catches its own.
---