[potiuk]

Summary

• A missing vetted-ops policy no longer blocks setup. A fresh install could stop with "no vetted-ops policy for this repo". Setup runs now report it as n/a and continue, and never write a policy to get past it (golden rule 11, install Step V). Every other skill, and a policy that exists but fails to load, still stops. The dispatcher is unchanged.
• magpie-vetted-ops is always installed, but bypasses nothing without the sandbox. It joins the baseline (pre-ticked, cannot be unticked), the seeded adoption floor, and the Codex catalogue as INSTALLED_BY_DEFAULT. The pre-flight requires it even when an older lock omits it. Its read-dispatcher allow rules, sandbox exclusions and Codex native rules are wired only where the sandbox is configured, and isolated-setup-verify treats them as a failure without it.
• Isolated-setup warning, once per session, in adopted repos. magpie-setup's existing SessionStart hook warns while the machine has no isolated setup. It says trying Magpie needs no isolated setup but longer use does, explains what an injected instruction can do without the sandbox, and warns against pointing skills at untrusted PRs, issues or mail. A project opts out with isolation_warning: off in the committed .apache-magpie-overrides/project.md, which adopt now asks about; a personal layer cannot opt out. The key lives there rather than in the lock because the strict lock parser would make older clients reject the lock.

Type of change

• Skill change (.claude/skills/<name>/) — eval fixtures updated below
• Python package (tools/*/ with pyproject.toml)
• Cross-cutting (RFC, AGENTS.md, sandbox, privacy-LLM)
• Documentation (docs/, README.md, CONTRIBUTING.md)
• CI / dev loop (prek, workflows, validators)

Test plan

• prek run --all-files passes
• tools/setup-preflight: pytest, ruff, mypy pass. New tests cover the always-required plugin, configured(), the warning conditions (adopted only, opted out, personal layer cannot opt out, configured) and HOME isolation for every test.
• Hook exercised end to end against a scratch HOME and project: it warns when adopted and unconfigured, and is silent when opted out, not adopted, or configured.
• Eval suites pass: preflight-floor (22, incl. new case-22-floor-omits-vetted-ops), adopt-write-floor, step-adopt-settings-merge, verify-default-set, step-m3-baseline-pick, setup-prefill-from-floor, new step-vetted-ops-no-policy (4), new adopt-isolation-warning (4), setup-isolated-setup-install (19).
• New eval fixtures for the new behaviour: step-vetted-ops-no-policy, adopt-isolation-warning, preflight-floor/case-22.
• Known pre-existing failures, also on a clean upstream/main: about 10 cases in the full setup suite (config-local-custom-parser, step-delegate-propose, uninstall-default-set, upgrade-adoption-split, …) and 5–6 in setup-isolated-setup-verify. They are not touched here.

RFC-AI-0004 compliance

• HITL — the vetted-ops plugin install and the opt-out write are both proposed and run only on confirmation
• Sandbox — the vetted-ops permission bypass is now conditional on the sandbox being configured; nothing widens access

Linked issues

Notes for reviewers (optional)

• Specs updated by hand (adoption-and-setup, marketplace-distribution, vetted-command-surface). tools/spec-loop/.last-sync is left as is: it was already 32 commits behind main before this change, and bumping it would claim a full sync.
• For the warning, "configured" means the isolated-setup stamp, or sandbox.enabled in the project's or the user's Claude Code settings (setup_preflight.isolated.configured). The hook runs outside the sandbox, so it can read the user settings.
• The dev version is bumped in its own commit.

🤖 Generated with Claude Code