[aaronjmars]

Why

aeon-update has synced nothing on miroshark-aeon since Claude Code 2.1.301 landed there (#1234, synced Oct 17). The skill described compare, classify and apply as shell snippets: helper functions, per-file loops, redirects into /tmp files. The permission layer refuses each of those shapes. With 55 changed files and 45 held conflicts, the model wrote its own /tmp/classify.sh and ran it with bash, which is refused too. Runs 39522579447 and 39618125223 both ended green (quality score 2) with no branch and no PR. aeon-agent got through the same day, so it depends on what the model happens to do. It is not a hard break.

What changes

• scripts/aeon_update.py does the file work in two calls (Bash(python3:*) is already in the write tier, so skill_mode.sh is unchanged):
  • plan --upstream --baseline --head: diffs upstream's two trees (no 300-file compare cap), partitions OPERATOR/OWNED, 3-way classifies with git merge-file --diff3, applies the pack-registry unit rules, and writes a diff file for each conflict and operator path. It also recomputes pending_conflicts, including on an in-sync run. It mutates nothing.
  • apply, on the aeon-update/* branch:
    1. Writes the clean files with upstream's exec bit.
    2. Runs the pack-registry validator.
    3. Rescans the eyebrow lock with the binary version CI pins, checked against checksums.txt, in a scrubbed env. If that is not possible, the fail-safe carries upstream's lock entry or holds the skill.
    4. Carries new skills' glyphs and regenerates the catalogs.
    5. Runs validate-config and writes the state file in the branch.
  • Any file that would go red is put back and listed as a conflict with a reason.
• skills/aeon-update/SKILL.md: S4-S8 now call the script. S0-S3 and S9 are rewritten as single commands with <PLACEHOLDER> values, and files are written with Write/Edit. A note at the top lists the shell shapes that get refused.
• eyebrowlock.json: only aeon-update's entry is spliced (its finding moved from line 100 to 105).

Verification

• python3 scripts/tests/test_aeon_update.py (added to CI lane 1) uses real git repos. It covers every disposition, renames, exec bits, operator files, an enabled skill retired upstream, parse failures, the stale skill-packs copy, the eyebrow fail-safe (carry + hold), glyph carry, pending recompute, refusing to apply on main, in-sync and an unreachable baseline.
• Live dry run against miroshark-aeon (3a747cd..f27af14), on a scratch copy:
  • plan took 7 s: 9 add, 35 update, 4 merge, 6 conflicts, 41 pending.
  • apply took 5 s and downloaded eyebrow v0.5.6 and rescanned. eyebrow verify --ci passed on the result.
• Local gates: ci-gate, gen-agents-md, skill categories, readme catalog, test_skill_mode, skill-scan, eyebrow verify.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}