T-OHMA-preflight-permissions-advisory-tiebreaker

Status: closed/superseded · Impact: medium · Complexity: small

Goal

task-work’s Step 3b preflight_permissions probe reads static settings files and can’t see the harness’s effective grants, so it can report npm, Write, and Edit as ungranted even when all three work at runtime — a false-positive that forces a proceed-anyway judgment call. The fix is to treat a failing probe as advisory and add an empirical write/exec smoke-test as a tiebreaker, so the gate doesn’t block on a probe that contradicts the harness’s actual capabilities. Surfaced by the post-mortem of T-4CUI-web-ui-vault-detail-findings in https://github.com/sksizer/markdown-contract.

From T-4CUI-web-ui-vault-detail-findings:

The preflight_permissions probe (Step 3b) reported npm, Write, and Edit as ungranted, but all three worked at runtime in this harness — a false-positive that forced a proceed-anyway judgment call. The probe reads static settings files and can’t see the harness’s effective grants; a note that a failing probe is advisory (and an empirical write/exec smoke-test as a tiebreaker) would reduce the friction.