[githubscum]

WO: limit 23 amendment, carried from the 2026-10-26 main session (rides the next KNOWN-LIMITS PR; no new number, same precedent as the limit-58 premise amendment). Docs only, no code, no core file touched.

What it addresses: KNOWN-LIMITS 23 said the self-mod over-gate reaches unrelated repos through src/<core>/ directory names. Field reports (five unsigned self-mod denials on read-only commands, 2026-10-26) show it is wider:

1. The npm manifest fragment in the self-mod list has no directory, so it matches every package.json on the machine. The policy source comment says this is deliberate; the amendment discloses it in the log instead of only in a code comment.
2. The bin/*.js regex and the src/<core>/ fragments match outside the install (node bin/pap-boot.js in a fresh temp clone was stopped).
3. Write/Edit over-gate the same way, not only Bash.

Also recorded: the .claude.json report does not hold against the source (no fragment matches it alone; the same command named the npm manifest), and the by-spelling observation (npm run pap:boot ran what node bin/pap-boot.js could not), filed under limit 26's class, not as a new limit.

How it was checked: each claim checked against the fragment list and both bin regexes in the self-mod matcher by Read, not taken from the report. Pin re-stamped with npm run limits-pin -- --stamp. npm test: 1379 tests, 1374 pass, 0 fail (5 skipped), matching main.

Eval served: none (disclosure debt, not v3 mechanism).

What a reviewer should doubt:

• Items 2 and 3 come from a subagent's relayed report and were not re-run by the lane; the source read makes them plausible, not proven.
• Whether item 1 belongs in limit 23 at all, given the code calls it accepted. I kept it because a disclosure log that leaves an accepted cost in a comment is the gap limit 29 warns about.
• The .claude.json verdict rests on a source read, not on the denial receipt.

🤖 Generated with Claude Code