Fix Phase 3 behavioral-claim verification and command-substitution rejection

[dmccoystephenson]

Summary

Three small template-rule self-audit gaps, all localized to create-dev-loop.md prose and none requiring a CLAUDE.md edit:

• Localization verification checks a symbol exists, not that the issue's behavioral claim about it is correct #92 — Phase 3's Localization verification only confirmed a named symbol exists (via grep), never that the issue's behavioral claim about it was correct. A downstream cycle (medieval-factions-dev-loop) shipped a doc claim that turned out to be wrong past the point the symbol was consulted. Added step 3: read past the point the behavior would be observable, and let the source win over the issue text.
• Phase 4/6 prescribe a command-substitution heredoc form some harness classifiers reject outright #91 — Phase 4 step 5 (self-review post) and Phase 6 (fix commit) prescribed --body "$(cat <<'EOF' ... EOF)", which at least one harness's command classifier rejects outright as Contains command_substitution before it reaches the shell — confirmed live in this very cycle (see test plan). Replaced both with a Write-tool scratch file + --body-file / -F, added a standing rule next to the existing scratch-file-handling bullet, and added a "retry transient gh network errors" Edge case.
• [self-audit] Phase 4's anchor-cannot-run guidance doesn't name session-sandbox path restriction as a trigger #90 — Phase 4's anchor-cannot-run trigger list didn't name "the session sandbox restricts filesystem/tool access to only the target repo's own working directory" (common in gardener-dispatched sessions) alongside "tool/interpreter absent or broken." Added it to both the Phase 4 paragraph and the matching Edge cases entry.

Test plan

• python3 scripts/check_docs.py — passes (every {{placeholder}} has a Step 4 row, README's "What it does" still 1:1 with Steps).
• UNVERIFIED — manual /create-dev-loop fixture regeneration not run. This PR changes template surface (Phase 3 Localization verification, Phase 4 self-review/anchor-cannot-run text, Phase 6 commit form, Edge cases) that the CLAUDE.md "Testing changes" checklist would normally exercise by regenerating a fixture skill (e.g. against dpm-dev-loop or herald-dev-loop) and diffing. This session's sandbox restricts filesystem/tool access to only this checkout — ls ~/local-skills/, mkdir (even for a path inside this checkout), and cloning an external fixture all fail with "Claude Code may only [list/create] in the allowed working directories for this session." This is exactly the gap [self-audit] Phase 4's anchor-cannot-run guidance doesn't name session-sandbox path restriction as a trigger #90 (this PR) documents, and the same gap the prior cycle's PR Document gh pr create workaround for restricted fetch refspecs #89 hit. Per the anchor-cannot-run gating this PR itself edits: template surface changed → do not auto-merge, hand to a human who can run the fixture.
• Confirmed the command-substitution rejection this PR fixes (Phase 4/6 prescribe a command-substitution heredoc form some harness classifiers reject outright #91) is live in this session too: a chained Bash command (... && echo "exit: $?") was rejected mid-cycle with the same class of classifier block the issue describes, before any template change was applied — direct evidence the prescribed heredoc form is unsafe to keep as-written.
• Read the full diff (git diff) — every changed line is one of the three issues' named surface area; no unrelated formatting/renames.

Closes #90
Closes #91
Closes #92

No RESEARCH.md finding directly covers harness command-classifier behavior or session-sandbox path restriction (#90, #91) — these are execution-environment constraints observed empirically in live sessions, not covered by the cited literature. #92 extends the existing localization-verification instruction grounded in RESEARCH.md §3 (fault localization as the dominant uncontaminated-benchmark failure mode); no new citation needed since it sharpens an already-cited finding's application rather than introducing a new claim.

---

This PR description was drafted during a Gardener session (Stephenson-Software/gardener).

[dmccoystephenson]

Self-review rubric:

• Scope: PASS — every changed line falls under [self-audit] Phase 4's anchor-cannot-run guidance doesn't name session-sandbox path restriction as a trigger #90, Phase 4/6 prescribe a command-substitution heredoc form some harness classifiers reject outright #91, or Localization verification checks a symbol exists, not that the issue's behavioral claim about it is correct #92's named surface area (git diff shows only Phase 3 Localization verification, the scratch-file-handling bullet list, Phase 4 self-review/anchor-cannot-run text, Phase 6 commit form, and Edge cases). No unrelated formatting or renames.
• Tests-new: N/A for this repo — no automated test suite; manual /create-dev-loop fixture regeneration is the anchor (see below).
• Tests-fix (empirical, not judged): PARTIAL. For Phase 4/6 prescribe a command-substitution heredoc form some harness classifiers reject outright #91, the defect is directly demonstrated: this same session hit an equivalent classifier rejection (Contains simple_expansion on a for loop, and a chained &&/echo "$?" block was rejected) before any fix was applied — live evidence the old heredoc form is unsafe. For [self-audit] Phase 4's anchor-cannot-run guidance doesn't name session-sandbox path restriction as a trigger #90 and Localization verification checks a symbol exists, not that the issue's behavioral claim about it is correct #92, no stash-and-revalidate was possible since these are prose-only template edits with no automated check that fails/passes; the manual fixture-regeneration check that would exercise them is UNVERIFIED (see next item).
• Sibling structure: PASS — the new Phase 3 step 3 follows the existing numbered-list pattern of steps 1–2; the new "Avoid command substitution" bullet matches the existing scratch-file-handling bullet's structure (bold lead-in, then justification).
• Sibling renames: N/A — no renames in this PR.
• Docs: PASS — python3 scripts/check_docs.py passes; README and RESEARCH.md required no changes since no Step was added/removed and no new finding was introduced.
• Issue resolution: PASS — Localization verification checks a symbol exists, not that the issue's behavioral claim about it is correct #92's Phase 3 step 3 addition, Phase 4/6 prescribe a command-substitution heredoc form some harness classifiers reject outright #91's Phase 4/Phase 6 heredoc replacement + scratch-file-handling bullet + Edge case, and [self-audit] Phase 4's anchor-cannot-run guidance doesn't name session-sandbox path restriction as a trigger #90's Phase 4/Edge-cases trigger addition are each fully present in the diff, not partial.
• Manual validation (external anchor): UNVERIFIED. This PR changes template surface the CLAUDE.md checklist requires regenerating a fixture skill against. This session's sandbox restricts filesystem/tool access to only this checkout (ls ~/local-skills/, and even mkdir for a path inside this checkout, both blocked) — the exact scenario [self-audit] Phase 4's anchor-cannot-run guidance doesn't name session-sandbox path restriction as a trigger #90 documents. Per Phase 4's own anchor-cannot-run gating (which this PR edits): template surface changed → do not auto-merge, hand to a human who can run the fixture regeneration.
• Placeholder-consistency: PASS — no new {{placeholder}} was introduced; check_docs.py confirms existing placeholders/table rows stay matched.
• Escaping: PASS — no new fenced code blocks were added inside the template's embedded markdown fence; existing \``` escapes are untouched.
• Research-grounding: PASS — stated explicitly in the PR body that [self-audit] Phase 4's anchor-cannot-run guidance doesn't name session-sandbox path restriction as a trigger #90/Phase 4/6 prescribe a command-substitution heredoc form some harness classifiers reject outright #91 (harness/sandbox execution-environment constraints) have no corresponding RESEARCH.md finding, and Localization verification checks a symbol exists, not that the issue's behavioral claim about it is correct #92 extends the already-cited RESEARCH.md §3 finding rather than introducing a new claim.

Summary: mechanically small, well-scoped fix for three self-audit gaps. The one real gap is that manual fixture-regeneration validation could not run in this sandboxed session — flagged UNVERIFIED and this PR is left open for a human (or a future cycle with fixture access) to run that check before merge, per this PR's own anchor-cannot-run rule.

[dmccoystephenson]

Skip reasons for the remaining open issues not picked for this cycle (triage recorded 2026-08-01):

• CLAUDE.md's documentation sources-of-truth table omits .github/ISSUE_TEMPLATE/*.md #81 (CLAUDE.md doc-sources-of-truth table omits .github/ISSUE_TEMPLATE/*.md) — requires editing CLAUDE.md, agent-loaded config that needs explicit, separate human authorization per this skill's own triage rule. Not attempted; needs a human to approve the edit.
• README and CLAUDE.md link gardener as an open-source companion, but the repo is private #79 (README/CLAUDE.md link a private gardener repo as "open source") — requires a maintainer decision between two valid resolutions (make the repo public, or edit CLAUDE.md + README.md to soften the wording); the latter also touches CLAUDE.md, which needs human authorization the same as CLAUDE.md's documentation sources-of-truth table omits .github/ISSUE_TEMPLATE/*.md #81. Not attempted.
• [self-audit] create-dev-loop-dev-loop's configured self-audit tracker repo doesn't exist #87 (create-dev-loop-dev-loop tracker repo doesn't exist) — meta-issue about a sibling repo/skill outside this repo's own PR scope; resolving it means either creating a new GitHub repo or editing a generated skill file that lives outside this checkout, neither of which is a create-dev-loop.md template change. Confirmed still unresolved this cycle (gh repo view dmccoystephenson/create-dev-loop-dev-loop still fails) — this is also why this cycle's Phase 9 self-audit issue ([self-audit] Session-sandbox restriction can block new directory creation, not just reads outside the allowed root #94) was filed against create-dev-loop itself rather than the configured tracker.