[kinqsradio]

Summary

• A Claude crew worker can no longer read or write another session's saved Claude conversation (the lead's transcript under ~/.claude/projects), nor history.jsonl. Its own session still works.
• The deny is on the projects folder with one allowance by pattern for the worker's own session id, so a transcript created after the worker started stays denied.
• A first turn starts Claude with --session-id <uuid> chosen by the core, so the allowance names the session before it exists. A folder that does not resolve, overlaps the data folder, or a bad id refuses the worker with a plain line.
• The core makes projects and the project folder for the start folder (mode 0700) before launch, and the profile allows no create there: a prepared tree with a link inside cannot be renamed in. The worker can create only its own <id>.jsonl and <id>/. A start folder whose Claude name is uncertain (non-ASCII, 200+ characters) refuses the worker.
• A configuration folder that goes through a link, or a linked projects or history.jsonl, refuses the worker.
• A non-Claude worker (ACP) gets projects and history.jsonl closed with no allowance; an ACP adapter wrapping Claude Code may not run as a worker until it can take --session-id.
• Claim kept narrow: the Claude lead's transcript is denied to confined Claude workers; nothing about other leads. Auto memory is closed to workers. Codex's own session files (~/.codex/sessions, SQLite state and logs) are not covered, acceptable only because Codex workers stay refused (CODEX_WORKERS_ALLOWED false) until a separate probe.
• A confined Claude worker can create its own <id>.jsonl and <id>/ in any existing project folder, so one it wrote can appear in another project's resume list.
• Docs say what is not covered: other engines' conversations (Codex, ACP), Claude's other per-session files, ~/.claude.json, auto memory is closed. The answer key as a whole is not claimed protected.

Refs #441

Parity rows

none

Frames built

Frames built: none

Testing

• CI covers the rest.
• macOS tests run the real tool on a Claude-shaped folder: lead transcript unreadable and unlistable, own session and subagent files work, a transcript created after launch is denied, a prepared tree cannot be renamed in under a missing project name, over or under the prepared folder, from inside the worker's own folder, or into a missing projects; none of those tests passes if the create allowance is restored; folder and parents cannot be renamed or linked around; linked config folder refuses the worker; a non-Claude worker reads none of it.
• By hand with the real Claude 2.1.318 and an empty config folder: with the folders made beforehand and no create allowed, --session-id writes its own session, --resume of it works, --resume of another session in the same folder fails "No conversation found".
• Not tested: a signed-in turn (tool use, subagents, /clear) under the profile; Codex and ACP engines.

Co-authors

none

AI usage

• Written by hand, with no AI
• Harness and version: Claude Code 2.1.321
• Models: claude-sonnet-5-5 (implementation and tests)
• Effort: medium
• Human role: scoped the change, will review and merge
• Sources: none

Checklist

• Works on Windows and macOS (non-macOS refuses the worker as before; transcript rules are portable code, tested on macOS)
• web/src/generated with any contract change; docs/architecture.md with any rule change
• No copied source, secrets, credentials or personal data; no AI attribution in commits, title or branch