Land the server-side half of the git-derived host-repo binding (#348)

[m2ux]

Closes #348. Both obligations #345 left in the server tree, which was outside that branch's edit surface.

1. Harness strings — point the repo binding at the derivation

The three strings the issue enumerates still told the caller the host repo comes from the user or the workspace AGENTS.md — the provenance #345 demotes to a fallback. Each now names version-control::resolve-host-repo and states the two conditions under which prose applies at all: a workspace that is not a git repo, or a host with no origin remote.

• src/tools/workflow-tools.ts:326 — inside the discover return. The urgent one: it is the first surface an orchestrator reads and sits directly above the rewritten bootstrap body, so it contradicted the new contract before any session existed. The repo_binding: required prefix is preserved — tests/multi-root-bootstrap.test.ts:68 asserts it.
• src/tools/resource-tools.ts:106 — the start_session tool description.
• src/utils/session/scope.ts:238-241 — the multi-root "repo is required" error.

Also fixed a fourth surface the issue does not list: docs/ide-setup.md:52 carried the identical claim on a user-facing page. Same defect, so leaving it would have left the contradiction standing. Flagging it as beyond the three checkboxes.

2. Submodule bump and walk re-baseline

Pointer f84fe02b → bd9c03df (#345's merge commit, 45 files), with everything that pointer invalidates refreshed in the same commit, as corpus-sha.json and scripts/stamp-corpus-baseline.ts both require.

• corpus-sha.json stamped to the new sha
• snapshot.test.ts.snap — one new step, derive-host-repo, before resolve-repo-root in all six policies. That is feat(meta): derive the host-repo binding from git instead of workspace prose #345 splitting the old step in two (findings register WC-1). Nothing else drifted.

The walk was confirmed red before stamping: the stamp guard fired with its named cause plus all six policy snapshots — exactly the failure the issue predicted.

Two further failures the pointer move surfaced

Neither is in the issue; both are corpus-driven, and both had to be fixed for CI to be green at the new pointer.

tests/reference-delivery.test.ts used work-package as its negative case for the inherited activity_rules block, premised on it declaring only orchestrator-scoped rules.workflow. #345 adds a rules.activity bucket to work-package, so start-work-package now carries that block and collapses it to an unchanged marker on a byte-identical refetch — the server behaving correctly, and what the dedicated case directly below it already asserts. Assertion and stale comment updated.

binding-fidelity gained one untriaged finding: {target_path} at substrate-node-security-audit/techniques/write-report.md:90 has no producer. Worth being precise, because this is not a behavioural regression. #345 renames the output target_path → component_path on both detect-repo-type and select-target-component, the corpus's only producers of that name. The audit workflow declares no target_path variable and binds neither technique, so its read had been resolving against those unrelated meta declarations all along. The rename removed the cover; it did not change how that run behaves. Verified new by running the guard at both shas — 0 untriaged at f84fe02b, 1 at bd9c03df.

Triaged fix-later / undeclared-seed, which describes this state verbatim ("the value is simply not state", so the agent improvises it at the point of use), per CLAUDE.md's direction to classify new findings rather than suppress them. The real repair is to declare and seed the value in the corpus — a change on the workflows lineage, not this branch — so it stays open as counted debt rather than silenced.

Verification

• tsc --noEmit clean
• 17/17 guards pass (scripts/check-all.ts)
• 742 tests pass

One red test remains: session-crypto "surfaces actionable EACCES when dir is not writable". It fails identically on unmodified main under the same sandbox (chmod does not block writes for that uid). Pre-existing and unrelated to this change.

Not included

The start_session bind-time precondition — rejecting a repo whose mapped directory is not a git work tree — is left untouched. The issue explicitly scopes it out as a separate change.

🤖 Generated with Claude Code