Candidate diff and change stream include Stella's own .stella/private/ SQLite sidecars

[macanderson]

Problem

In a workspace whose .gitignore does not exclude .stella/private/, Stella's own state files appear in the change stream the verifier and the deck are shown, as if they were the agent's work.

Observed in a real run — the turn diff carried three entries, two of which were Stella's own SQLite sidecars:

• .stella/private/codegraph.db-shm — modified, +2/-1, body full of binary escape bytes
• .stella/private/codegraph.db-wal — modified, +13/-0, likewise
• test_regex.py — created, the only real work

Two consequences:

1. Evidence noise. Binary escape bytes land in a verifier-facing payload. (The gather_diff path is now safe here — PR fix(stella-pipeline): let the verifier read an untracked file's content, not just its name #2034 renders untracked binaries as git's Binary files ... differ sentence — but this stream is a different channel and is not covered.)
2. Warrant classification. witness::warrant::changed_paths holds every changed path to the every-path-must-agree rules in crates/stella-pipeline/src/witness/warrant.rs. A .db-wal path is neither docs nor test, so its presence defeats a DocsOnly/TestsOnly waiver that should have applied — the agent's own bookkeeping silently deciding whether a witness is owed.

Why it does not reproduce in this repo

crates/stella-cli/src/agent/tools.rs's GitRepoStatus::untracked_fingerprints shells git ls-files --others --exclude-standard, which honours .gitignore. This repo ships a generated .stella/.gitignore excluding .stella/private/, so the sidecars are filtered here.

A fresh workspace has no such exclusion: a Terminal-Bench task image, a git init scratch dir, or any tree where that file was never generated — or was generated after the first fingerprint snapshot.

Files

• crates/stella-cli/src/agent/tools.rs — GitRepoStatus::untracked_fingerprints
• crates/stella-pipeline/src/pipeline/verify_probes.rs — gather_diff, the untracked delta
• crates/stella-tools/src/registry.rs — record_touch, the single AgentEvent::FileChange emitter
• crates/stella-pipeline/src/witness/warrant.rs — changed_paths and the path rules

Reproduce / verify

1. git init a scratch directory with no .stella/.gitignore.
2. Run a stella run task there that touches the code graph, so codegraph.db-wal is written.
3. Inspect the turn diff and the verifier prompt for .stella/private/ paths.

Definition of done

Stella's own state under .stella/private/ never appears in any verifier-facing diff, FileChange stream, or warrant path set, regardless of whether the workspace's .gitignore excludes it.

The exclusion must be a property of the code, not of a generated file that may be missing — the ignore file stays a convenience for the user's git status, never the mechanism verification depends on.

A witness test should assert the exclusion holds with no .gitignore present, since that is the failing configuration.

Constraints

• Do not widen a diff-size or budget filter to hide it; the path must be excluded by identity.
• AGENTS.md § "The .stella/ directory (per-workspace state)" documents .stella/private/ as owner-only generated local state — that is the definition to key off.
• Related: PR fix(stella-pipeline): let the verifier read an untracked file's content, not just its name #2034 (verifier reads untracked content), warrant() waives the witness as "NothingChanged" for a candidate that dispatched 10 mutating calls — a false deterministic pass on system-config tasks #1701 (warrant reads mutating_actions).