From 677a6f02f06a18b9dc122c6c245a3533e7d60c9c Mon Sep 17 00:00:00 2001
From: "clagentic-builder[bot]"
 <290147524+clagentic-builder[bot]@users.noreply.github.com>
Date: Sat, 4 Jul 2026 10:52:12 -0400
Subject: [PATCH 1/2] chore(crew): switch AMoS scope to allow_all posture
 (lr-3ec5)

Replace the explicit allowed_paths ladder with the crew-canonical
allow_all + empty blocklist form. Widens AMoS write scope for this
repo; unblocks lr-8a08 (release.config.js and .github/workflows edits
were previously out of the allowlist). schema_version stays 1.
---
 .crew/amos.yaml | 14 ++------------
 1 file changed, 2 insertions(+), 12 deletions(-)

diff --git a/.crew/amos.yaml b/.crew/amos.yaml
index 06f2deec..df60f0db 100644
--- a/.crew/amos.yaml
+++ b/.crew/amos.yaml
@@ -16,18 +16,8 @@ branch_conventions:
   # include_task_id: true
 
 scope:
-  allowed_paths:
-    - bin/**
-    - lib/**
-    - .crew/**
-    - test/**
-    - deploy/**
-    - scripts/**
-    - docs/**
-    - package.json
-    - README.md
-    - CHANGELOG.md
-    - .gitignore
+  allow_all: true
+  blocked_paths: []
 
 focus:
   - "Product name in user-facing text: 'Clagentic: Console' (capital C, colon, space, capital C)"

From defc5e474ea4ce2c3bb18e8fde958153ab073f19 Mon Sep 17 00:00:00 2001
From: "clagentic-builder[bot]"
 <290147524+clagentic-builder[bot]@users.noreply.github.com>
Date: Sat, 4 Jul 2026 11:12:37 -0400
Subject: [PATCH 2/2] chore(crew): revert AMoS scope to enumerated allowlist
 (lr-3ec5)

allow_all + empty blocked_paths could not express 'existing workflows
editable, new workflow files denied until approved' -- guard-scope.py
Rule 0 ignores allowed_paths under allow_all, and blocked_paths cannot
gate files that do not exist yet. Reverts to an explicit allowed_paths
ladder: prior paths + release.config.js (unblocks lr-8a08) + the two
existing workflow files enumerated individually (pr-checks.yml,
release.yml) -- not a .github/workflows/** glob. New workflow files
remain denied until added to allowed_paths via a reviewed .crew change.

Resolves BOBBIE blocking finding (review 4629787115) on PR #307:
allow_all gave AMoS unbounded write to .github/workflows/** (CI-
injection surface). schema_version unchanged at 1.
---
 .crew/amos.yaml | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/.crew/amos.yaml b/.crew/amos.yaml
index df60f0db..dff5501d 100644
--- a/.crew/amos.yaml
+++ b/.crew/amos.yaml
@@ -16,8 +16,21 @@ branch_conventions:
   # include_task_id: true
 
 scope:
-  allow_all: true
-  blocked_paths: []
+  allowed_paths:
+    - "bin/**"
+    - "lib/**"
+    - ".crew/**"
+    - "test/**"
+    - "deploy/**"
+    - "scripts/**"
+    - "docs/**"
+    - "package.json"
+    - "README.md"
+    - "CHANGELOG.md"
+    - ".gitignore"
+    - "release.config.js"
+    - ".github/workflows/pr-checks.yml"
+    - ".github/workflows/release.yml"
 
 focus:
   - "Product name in user-facing text: 'Clagentic: Console' (capital C, colon, space, capital C)"