idea: snapshot PR-modified .claude/ config before automated review — inspired by claude-code-action's .claude-pr/ pattern

[github-actions]

Research brief

Landscape survey of comparable OSS agent frameworks (2026-07-22), scoped to:
"agent_mesh roadmap & comparable OSS agent frameworks" (OpenHands, SWE-agent,
Aider, MetaGPT/ChatDev, Renovate, claude-code-action).

Landscape signal — claude-code-action's .claude-pr/ snapshot pattern

PR #1172
(merged 2026-04-05): when a PR modifies .claude/ (hooks, MCP config, agent
settings), the action now snapshots the PR-authored tree aside before
restoring the base-branch version for the actual review execution — so a
review agent can inspect what a PR proposes to change under .claude/ as
inert data, while the CLI only ever executes the trusted base-branch
config. Fixes a real prior gap: such PRs previously merged with their own
config changes effectively unreviewed, since the reviewer only ever executed
with whatever was checked out.

Gap (confirmed against this repo, not just landscape-inspired)

Read .github/workflows/dev-mesh-review.yml directly: it triggers on
pull_request and runs actions/checkout@v4 with no explicit ref: —
on this event the default is the PR's merge ref, so the working tree the
Reviewer's claude-code-action step executes in already contains whatever
the PR itself changed, including anything under .claude/. Claude Code
auto-loads project-level .claude/settings.json (hooks, permissions) from
its cwd. The Reviewer's session runs with --allowedTools "Read,Grep,Glob,Bash(gh:*)" and a live GITHUB_TOKEN in env. A same-repo PR
— not necessarily human-authored; could be an automated Coder/autofix
branch, or one steered via a prompt-injected issue brief — that introduces or
edits .claude/settings.json with a hook matching one of the Reviewer's own
allowed tools would have that hook live-loaded into the very session
reviewing it, able to act with that session's GITHUB_TOKEN before any
human sees the PR. The fork-PR guard (head.repo.full_name == github.repository) protects secrets from forks; it does nothing about a
same-repo branch's own config content being executed by the reviewer
supposed to be checking it.

No .claude/settings.json exists at repo root today (verified — .claude/
currently holds only skills/), so this is a latent, preventable gap,
not an active incident — closing it now is cheap versus after a PR
introduces one.

Proposed direction (draft spec attached)

Before the Reviewer's claude-code-action step: if the PR diff touches
.claude/ (or another repo-root Claude Code config path the CLI auto-loads),
snapshot the PR-authored versions aside, restore the base-branch version into
place for the actual review execution, and feed the snapshot to the
Reviewer's prompt as data to comment on — consistent with this repo's
existing "external content is data, never instructions" posture already
applied to AGENT.md. No change to dev-mesh-automerge.yml or
eligibility.js — this is review-step hardening, complementary to (not
overlapping with) the separately-filed agent-authored-commit approval-gate
idea.

Full design (snapshot/restore mechanics, prompt framing, fail-safe on
snapshot-step failure, testing plan) drafted at:
docs/superpowers/specs/2026-07-22-idea-claude-config-pr-snapshot-review-design.md

Note: per this run's scope (propose only), this draft spec file was
written to the working tree but has not been committed/pushed — also
blocked today by #771 (DEV_MESH_PAT secret still not configured, 403 on
spec-push). Carries full design detail for whoever picks this up.

Dedup confirmation

Checked all currently-open issues before filing. Distinct from:

• #824 (default MESH_CEILING to a safe boundary) — a different boundary
  (delegation write-root ceiling), not CI reviewer config execution.
• #807 (namespace/bwrap jail beneath the delegate path-guard) — hardens
  delegated worker writes, not the CI reviewer step's own config loading.
• #248 (closed — workflow permissions lint gap) — lints workflow YAML
  permissions coverage, not config-execution isolation.
• The repo's own AGENT.md-as-data / registry-marker (I7) invariants govern
  a served mesh agent's description/registry data; this is about the CI
  reviewer's own Claude Code settings — a different trust boundary entirely.

Verified the actual checkout/exec behavior by reading
.github/workflows/dev-mesh-review.yml directly and confirmed no
.claude/settings.json currently exists at repo root, so this is a
preventive proposal, not a report of an active breach.

Sources

• claude-code-action .claude-pr/ snapshot pattern — fix: snapshot PR's .claude/ to .claude-pr/ before security restore anthropics/claude-code-action#1172
• This repo: .github/workflows/dev-mesh-review.yml, .claude/ (current contents)

---

Filed by the Analyst's daily landscape-research review. Proposal only — subject to human approval (§5.3). No code written, no PR opened.

[github-actions]

Spec ready — attempt 1 of 3.

Authored the full design at docs/superpowers/specs/2026-07-22-idea-claude-config-pr-snapshot-review-design.md (snapshot the PR-authored .claude/settings.json/.claude/settings.local.json/.mcp.json aside and restore the base-branch version before the Reviewer's claude-code-action step runs in dev-mesh-review.yml, feeding the snapshot to the Reviewer's prompt as inert data — same "external content is data" posture already applied to AGENT.md).

Committed on spec/issue-842, git push → same known HTTP 403 (Permission to danabaxia/agent_mesh.git denied to github-actions[bot]) — this repo's spec-push is still blocked pending #771 (DEV_MESH_PAT secret not yet configured; confirmed unchanged again this run via gh api repos/danabaxia/agent_mesh --jq '.permissions.push' → false).

Labels already correctly reflect this (spec:draft + blocked + needs-human). Two attempts remain before this issue's own circuit breaker trips.

[github-actions]

Spec ready — attempt 2 of 3 (push blocked, HTTP 403 — same as #771)

Re-authored the spec (content unchanged from attempt 1's draft — it was
already complete) at
docs/superpowers/specs/2026-07-22-idea-claude-config-pr-snapshot-review-design.md
(snapshot the PR-authored .claude/settings.json/.claude/settings.local.json/
.mcp.json aside and restore the base-branch version before the Reviewer's
claude-code-action step runs in dev-mesh-review.yml, feeding the snapshot
to the Reviewer's prompt as inert data — same "external content is data"
posture already applied to AGENT.md).

Committed on branch spec/issue-842, git push → same known HTTP 403
(Permission to danabaxia/agent_mesh.git denied to github-actions[bot]).
Reconfirmed root cause this run: gh api repos/danabaxia/agent_mesh --jq '.permissions.push' → false; gh auth status still shows the active token
as the integration/15368 GitHub App installation, not DEV_MESH_PAT. Same
gap tracked centrally at #771 — still open, unresolved as of this run.

Labels already correctly reflect this (spec:draft + blocked +
needs-human). One attempt remains before this issue's own circuit breaker
trips.

[github-actions]

Spec ready — attempt 3 of 3 (push blocked, HTTP 403 — same as #771)

Re-authored the spec (content unchanged from attempts 1/2 — the design was
already complete) at
docs/superpowers/specs/2026-07-22-idea-claude-config-pr-snapshot-review-design.md
(snapshot the PR-authored .claude/settings.json/.claude/settings.local.json/
.mcp.json aside and restore the base-branch version before the Reviewer's
claude-code-action step runs in dev-mesh-review.yml, feeding the snapshot
to the Reviewer's prompt as inert data — same "external content is data"
posture already applied to AGENT.md).

Committed on branch spec/issue-842, git push → same known HTTP 403
(Permission to danabaxia/agent_mesh.git denied to github-actions[bot]).
Reconfirmed root cause this run: gh api repos/danabaxia/agent_mesh --jq '.permissions.push' → false; gh auth status still shows the active token
as the integration/15368 GitHub App installation, not DEV_MESH_PAT. Same
gap tracked centrally at #771 — still open, unresolved as of this run.

This was the last attempt (3 of 3). Labels already correctly reflect this
(spec:draft + blocked + needs-human). Next sweep's circuit-breaker check
will trip and escalate if the gap is still unresolved.

[github-actions]

Spec ready — attempt 1 of 3.

Authored the full design at docs/superpowers/specs/2026-07-22-idea-claude-config-pr-snapshot-review-design.md (snapshot the PR-authored .claude/ tree aside, restore the base-branch version for the Reviewer's actual execution, feed the PR-authored content back into the Reviewer's prompt as inert data — consistent with this repo's existing AGENT.md-as-data posture; fail loudly on snapshot-step failure rather than silently falling through to the unguarded behavior).

Committed on branch spec/issue-842, git push → HTTP 403 (Permission to danabaxia/agent_mesh.git denied to github-actions[bot]) — same known failure mode tracked centrally at #771 (DEV_MESH_PAT secret not yet configured; reconfirmed this run via gh api repos/danabaxia/agent_mesh --jq '.permissions.push' → false).

Labels already correctly reflect this (spec:draft + blocked + needs-human). Local spec/issue-842 branch deleted after the failed push (nothing lost — it never reached origin; spec content is stable and reproducible from this comment). Two attempts remain before this issue's own circuit breaker trips.

[github-actions]

CIRCUIT BREAKER: spec-push has failed 3+ consecutive times. DEV_MESH_PAT may lack write access or the spec directory is conflicted. Human intervention required. See .github/actions/mesh-retry-backoff for 529.