Daily harness signal

Make worktree isolation fail closed

A fresh Claude Code repair blocks worktree subagents from mutating the parent checkout. Treat that boundary as a release-gated invariant, not a configuration assumption.

July 15, 2026 · JST Fresh · released 08:45 JST 1 implementation finding
Implementation lesson: isolation is a runtime invariant, not a frontmatter promise: upgrade the harness, then prove a child cannot mutate the parent checkout before restoring parallel Git work.
01 · Fresh · source date 2026-07-14 UTC

Probe the checkout boundary, not merely worktree creation

Use when. Claude Code delegates modifying work to subagents configured with isolation: worktree especially when agents run concurrently, create branches, stash, reset, or receive prompts containing absolute paths into the parent checkout.

Action. Set the deployment floor to Claude Code 2.1.210 or later. Before re-enabling parallel writers, use a disposable, clean clone. Record git rev-parse HEAD plus git branch --show-current and git status --porcelain=v1 from the main checkout. Dispatch one modifying subagent with isolation: worktree ask it to create and commit a sentinel inside its temporary worktree, then deliberately ask it to attempt git -C <absolute-main-checkout> switch -c isolation-escape-probe Finally, inspect git worktree list --porcelain and repeat the three main-checkout readings.

snapshot parent → mutate child → attempt parent escape → compare both trees

Acceptance check. The child’s sentinel and commit exist only on its worktree branch; the escape command is rejected or has no effect; and the parent’s branch, HEAD, index, tracked files, and porcelain status exactly match the recorded baseline. Any new parent branch, status entry, reflog movement, or missing child commit blocks rollout.

Evidence. Anthropic’s official 2.1.210 release explicitly fixes worktree subagents running Git-mutating commands against the main checkout. The linked public failure report includes exact tool-call records from 2.1.119 and 2.1.126 parent HEAD switches, empty child branches, lost files, and two escapes among four parallel agents. Current official documentation states that worktree-isolated subagent commands run inside that worktree.

Caveat. The release note names Git-mutating commands, not a complete filesystem sandbox, and Anthropic publishes no regression-test output for this closed-source fix. Absolute Read, Edit, or Write paths therefore still deserve separate probes. Keep the destructive escape test disposable, and avoid parent-checkout absolute paths in normal subagent briefs.

Compact source notes

  1. Claude Code v2.1.210 release (published July 14, 2026 23:45 UTC / July 15 08:45 JST). Official shipped fix and scope statement.
  2. Claude Code issue #52958 (opened April 24; evidence updated May 4, 2026). Artifact-backed cross-platform reports with versions, JSONL-derived working directories, exact commands, and observed branch/file corruption.
  3. Official subagent documentation and worktree documentation (retrieved July 15, 2026). Current intended isolation contract and configuration syntax.