safe-worktree-operations

What problem does it solve? Multi-stage agent workflows risk writing files outside their assigned worktree, leaking secrets into evidence, or materializing unapproved resources. This Skill enforces isolation, policy compliance, and reproducibility for every stage that touches a worktree. ## Core Features & Use Cases - Worktree Verification: Checks worktree path, branch, and lock status before allowing any writes, blocking operations when no lock exists. - Resource Allowlisting: Materializes resources only from an approved allowlist and prevents secrets from being copied into evidence or prompts. - Decision Matrix & Output Contract: Routes edge cases (external resources, commit requests, analysis-only stages) through defined actions and emits typed outputs like worktree.status and worktree.changed_files. - Use Case: In a staged spec-ops pipeline, an agent stage needs to write generated code and run tests. This Skill verifies the worktree lock, confines writes to the allowed scope, records changed files, and delegates commits to the release-integration stage. ## Quick Start Apply the safe-worktree-operations skill to verify the worktree lock and write scope before this stage writes any files or runs tests.