[potiuk]

Summary

• Why. The repository committed its own .claude/settings.json, so every contributor's agent silently inherited the maintainers' sandbox, permission and self-adoption choices; each change to them was a repository change, and a checkout could never differ from the baseline without a dirty tree.
• What. The file ships, byte for byte, as tools/agent-isolation/claude-settings.template.json, and .claude/settings.json is gitignored. Every surface that referenced the committed file is retargeted:
  • sandbox-lint lints the template by default; the workflow paths, its job name and the .asf.yaml note follow, so the baseline stays linted in CI.
  • The pre-flight fingerprint covers the template through tools/agent-isolation/ (the separate entry is gone; constant regenerated).
  • The fixer-hook exclusion for .claude/settings.json in .pre-commit-config.yaml is dropped — the file is no longer tracked.
  • Links and prose that meant this repository's file point at the template: threat model (M.14, M.29, X3, the review trigger), secure-agent setup and internals, spec-driven development, the write-skill security checklist, sandbox-lint README, and three specs.
• Contributor step. CONTRIBUTING gains Agent settings (copy or merge the template; personal additions in settings.local.json); setup-isolated-setup-install gains Step T for a framework checkout; setup-isolated-setup-verify check 1 reports a missing copy (✗) or a missing block (⚠).

Out of scope, as the issue says: the baseline's contents (unchanged), and an adopter's committed .claude/settings.json floor written by adopt.

Closes #1639.

Type of change

• Skill change (setup-isolated-setup-install, setup-isolated-setup-verify)
• Tool / bridge contract
• Python package (tools/sandbox-lint default path and test; setup-preflight fingerprint sources)
• Groovy reference impl
• Cross-cutting (sandbox baseline location, threat model)
• Documentation
• Project template
• CI / dev loop (sandbox-lint workflow, .asf.yaml, .pre-commit-config.yaml, .gitignore)

Test plan

• prek run --all-files passes
• uv run sandbox-lint — OK (tools/agent-isolation/claude-settings.template.json matches tools/sandbox-lint/expected.json)
• tools/sandbox-lint tests (270 passed, incl. the doc / allowed-domains consistency test now reading the template)
• tools/setup-preflight tests (252 passed); fingerprint constant regenerated
• Eval suites for setup-isolated-setup-install / -verify — not run (prose additions only)

Notes for reviewers

• After merge, each contributor needs a local copy once. A clone made before this PR keeps its .claude/settings.json on disk (it becomes untracked and ignored); a fresh clone has none until cp tools/agent-isolation/claude-settings.template.json .claude/settings.json. setup-isolated-setup-verify flags it.
• The template is the file the sandbox-lint baseline is compared against, so a baseline change is now a change to the template plus tools/sandbox-lint/expected.json.

---

Gen-AI disclosure: prepared with the assistance of Claude Code (Claude Opus 5); reviewed by the author.

🤖 Generated with Claude Code