[zheng-weihao]

Why

An agent ran orbit prune from inside a workspace: it deleted a sibling workspace, read the self-protection skip message (you are currently in this workspace) as instructions, cd'd out, and pruned the workspace it was working in. The protection checked state the agent controls (shell CWD) and its refusal message doubled as a bypass guide. git worktree remove --force also destroyed uncommitted changes with no check at all.

What

Prune — four guards, all on state an agent cannot change by cd-ing (spec: docs/spec-lifecycle.md → Prune Safety Guards)

• Runs only from the project root — refuses inside any workspace (cross-scope destructive ops belong to the scope above)
• Skips a workspace the session is rooted in, detected by walking the process ancestry (/proc on Linux, lsof on macOS; physical-path normalization so symlinked roots still match) — best-effort, announces its blind spot, orbit doctor reports the facility
• Skips candidates with uncommitted changes, non-pool git repos (objects live nowhere else), or unmerged jots — all reasons reported together; --force overrides data guards only, never the scope guards
• Refusal messages name no bypass — new refusal/skip class registered in docs/spec-warnings.md
• Removed from the skill's action surface — the skill's only reader is the one role prune refuses to serve; documenting the guards to that reader was handing over a bypass map. Enforcement replaces documentation (skills/CONSTRAINTS.md → "Prune is out of scope for the skill")

sync — --force / --branch are root-level only (they destroy/re-point shared pool state); --branch retires only the replaced branch's fetch refspec and rolls back on failure. Bare sync unaffected.

branch prefix — moved from ORBIT_BRANCH_PREFIX env to orbit config branch.prefix (default ws): the value names every branch orbit creates and selects which branches prune deletes, so it must be durable. Validated on write; refused while branches still carry the current prefix. BREAKING.

Repo names validated as pool basenames across sync/add/info/memo/clone --name — a traversing name (sync ../<ws>/<repo> --force) previously aimed git reset --hard at a worktree's checked-out branch. Clone basename outside the contract points at --name.

jot queue stored as [jot "<repo>"] subsections — names plain git-config keys can't hold (my_repo, 2048) now round-trip.

auto-approve hooks match destructive flags on normalized tokens — '--force', --force'', \-\-force no longer slip past (both hooks/auto-approve.sh and the OpenCode plugin); sync --branch joins the prompt tier.

inference — workspace/repo inference compares physical paths (commands work through symlinked cwds, e.g. /tmp → /private/tmp).

CHANGELOG rewritten CNCF-style (Urgent Upgrade Notes + Changes by Kind, PR-attributed), complete for v0.1.0..HEAD — release-ready: flipping Unreleased → 0.2.0 (+ ORBIT_VERSION bump + filling this PR's number in the Security entries) is all the release needs.

Test plan

• CI bats suite (27 files, incl. new tests/24_auto_approve.bats; 09_prune +20 cases covering root-only/session/data guards, 14_config branch.prefix suite, 18_sync root-guard + refspec retention, 20_jot subsection round-trip)
• OpenCode plugin tests (node --test .opencode-plugin/plugin.test.ts — 16/16 locally)
• Local spot-checks: 263/263 bats + 16/16 plugin passed pre-PR; full suite re-run delegated to CI