realgarit/fable-baton

Review signals: 1 outside write.

Repository processes attempted these writes outside documented output/cache paths. 2 distinct locations. 1 attributed processes.

PID 8012: /usr/bin/node · npm lifecycle

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

[
  {
    "status": "PASS",
    "details": {
      "working": false,
      "argv": [
        "claude",
        "plugin",
        "list"
      ],
      "kind": "cli",
      "returncode": 0,
      "stdout": "Installed plugins:\n\n  \u276f fable-baton@fable-baton\n    Version: 1.5.3\n    Scope: user\n    Status: \u2714 enabled\n",
      "stderr": "",
      "needs_credentials": false,
      "needs_browser": false,
      "scope": "partial: install"
    },
    "check": "install",
    "optional": false
  },
  {
    "status": "PASS",
    "details": {
      "working": false,
      "argv": [
        "claude",
        "-p",
        "Reply with the word ok"
      ],
      "kind": "cli",
      "returncode": 1,
      "stdout": "Not logged in \u00b7 Please run /login",
      "stderr": "",
      "needs_credentials": true,
      "needs_browser": false,
      "scope": "partial: missing credentials"
    },
    "check": "credentials_error",
    "optional": false
  }
]

• Installing the plugin with the README command registers fable-baton as installed: Real input produced the expected result: fable-baton@fable-baton

  Source: /plugin install fable-baton@fable-baton

  Input: none (the marketplace was added from realgarit/fable-baton and the plugin installed)

  Expected: claude plugin list shows fable-baton@fable-baton

  Command: claude plugin list

  Observed: fable-baton@fable-baton Version: 1.5.3 Scope: user Status: ✔ enabled

• The SessionStart hook injects the orchestration policy into a new session: Real input produced the expected result: # Orchestration policy (fable-baton)

  Source: A SessionStart hook injects the orchestration policy into every new session.

  Input: {} on stdin with CLAUDE_PLUGIN_ROOT=.

  Expected: hook prints the orchestration policy header

  Command: env CLAUDE_PLUGIN_ROOT=. bash hooks/session-start.sh

  Observed: # Orchestration policy (fable-baton) You are the senior decision-maker in this session. Your value is judgment, not labor: spend your own reasoning only where being the strongest model changes the outcome, and delegate the rest to the tiered agents below via the Agent tool. ## You keep Intent, scope, architecture and approach, decomposition and ordering, tradeoffs (speed/quality/risk/scope), hidden-risk identification, resolving disagreement between agents, reviewing important outputs, deciding when work is good enough, and the final answer to the user. ## You delegate Work whose result i

• The per-prompt reminder prints a delegation check on each prompt: Real input produced the expected result: [fable-baton] Delegation check for this turn

  Source: Every prompt gets a short delegation reminder, and when the model does too much inline work in a row, the counter steps in:

  Input: UserPromptSubmit payload with session_id baton-cycle-check and a prompt

  Expected: hook prints the [fable-baton] delegation check

  Command: bash hooks/prompt-nudge.sh

  Observed: [fable-baton] Delegation check for this turn: searching, reading files, editing, testing, and verifying go to agents (scout, executor, architect, verifier via the Agent tool); you keep judgment, decisions, and the final answer. Tripwire: reaching for a 3rd consecutive inline Bash/Read/Grep/Edit call means that block belongs to an agent. Skills define what to do, not who does it: delegate their mechanical steps too. Exempt: conversational turns, one quick lookup, a one-line edit. No exemptions in security-context sessions.

• Whether the plugin fires inside a logged-in session cannot be tested in this guest: Requires a logged-in Claude Code session with a Fable 5 or Opus subscription or API key; the guest reports 'Not logged in' and no credentials were obtained.

  Source: Install once and every new session in every repo starts this way.

  Observed: Requires a logged-in Claude Code session with a Fable 5 or Opus subscription or API key; the guest reports 'Not logged in' and no credentials were obtained.

Examples

• Repository's own offline hook test (run by CI) passes: command completed successfully

  Source: AGENTS.md

  Input: tests/packaged-hooks.py

  Expected: PASS line for installed hooks with stripped modes

  Command: python3 tests/packaged-hooks.py

  Observed: PASS: all registered hooks work with mode 644 and spaces in the installed path

Cycles

• The per-prompt reminder runs on every user prompt: Triggered one cycle by hand (run-once: the UserPromptSubmit hook command fired by hand with a prompt payload on stdin; no real Claude Code session; normal trigger: UserPromptSubmit event, once per user prompt): [fable-baton] Delegation check for this turn: searching, reading files, editing, testing, and verifying go to agents (scout, executor, architect, verifier via the Agent tool); you keep judgment, decisions, and the final answer. Tripwire: reaching for a 3rd consecutive inline Bash/Read/Grep/Edit call means that block belongs to an agent. Skills define what to do, not who does it: delegate their mechanical steps too. Exempt: conversational turns, one quick lookup, a one-line edit. No exemptions in security-context sessions.

  Source: hooks/hooks.json

  Input: {"session_id":"baton-cycle-check","prompt":"hello"}

  Expected: reminder printed once for the prompt

  Command: bash hooks/prompt-nudge.sh

  Observed: [fable-baton] Delegation check for this turn: searching, reading files, editing, testing, and verifying go to agents (scout, executor, architect, verifier via the Agent tool); you keep judgment, decisions, and the final answer. Tripwire: reaching for a 3rd consecutive inline Bash/Read/Grep/Edit call means that block belongs to an agent. Skills define what to do, not who does it: delegate their mechanical steps too. Exempt: conversational turns, one quick lookup, a one-line edit. No exemptions in security-context sessions.

Install the fable-baton Claude Code plugin from the README and run its hooks (policy at session start, per-prompt delegation reminder, inline-call counter).

cd <guest-path> && pwd && ls -la && id -u && python3 --version && cat README.md 2>/dev/null | head -200
cd <guest-path> && git init -q 2>/dev/null; git remote add origin https://github.com/realgarit/fable-baton 2>&1; git fetch --depth 1 origin 4f04545450dfbda6c2698b3976f3d6c90d52a11e 2>&1 | tail -3; git reset --mixed FETCH_HEAD 2>&1 | tail -2; git log --oneline -1
cd <guest-path> && ls -la .coldpass tests hooks .github/workflows agents skills .claude-plugin && cat .github/workflows/*.yml | head -120 && ls /inputs 2>/dev/null; which node npm claude uv 2>&1
cd <guest-path> && cat AGENTS.md | head -150; echo ----; cat hooks/*.sh 2>/dev/null | head -80; ls hooks
ls -la /inputs <guest-path> 2>&1; for c in node npm claude uv bash jq; do printf "%s: " $c; command -v $c || echo missing; done; node --version 2>&1; cat <guest-path>; sed -n 1,40p <guest-path>
sudo -n true && echo SUDO_OK; . /etc/os-release; echo $VERSION_ID; (sudo -n apt-get update -qq && sudo -n DEBIAN_FRONTEND=noninteractive apt-get install -y -qq nodejs npm) 2>&1 | tail -5; node --version; npm --version
export NODE_USE_ENV_PROXY=1; mkdir -p <guest-path> && cd <guest-path> && timeout 600 sudo -n npm install -g @anthropic-ai/claude-code 2>&1 | tail -5; command -v claude && claude --version 2>&1 | head -3
cd <guest-path> && export NODE_USE_ENV_PROXY=1; timeout 120 claude plugin --help 2>&1 | head -30; echo ---; timeout 120 claude plugin marketplace add <guest-path> 2>&1 | tail -5; echo rc=$?
cd /tmp && export NODE_USE_ENV_PROXY=1; timeout 200 claude plugin marketplace add realgarit/fable-baton 2>&1 | tail -3; echo rc=$?; timeout 200 claude plugin install fable-baton@fable-baton 2>&1 | tail -5; echo rc=$?; timeout 60 claude plugin list 2>&1 | head -20
cd /tmp && export NODE_USE_ENV_PROXY=1; timeout 120 claude plugin uninstall fable-baton@fable-baton 2>&1 | tail -2; timeout 120 claude plugin marketplace remove fable-baton 2>&1 | tail -2; timeout 200 claude plugin marketplace add realgarit/fable-baton 2>&1 | tail -3; timeout 200 claude plugin install fable-baton@fable-baton 2>&1 | tail -3; timeout 60 claude plugin list 2>&1 | head -12
cd /tmp && export NODE_USE_ENV_PROXY=1; timeout 120 claude -p "Reply with the word ok" 2>&1 | tail -5; echo rc=$?; env | grep -i -E 'anthropic|claude' | sed 's/=.*/=<set>/' ; ls ~/.claude 2>&1 | head
cd <guest-path> && grep -n -E "credentials_error|\"checks\"|'checks'|stays_running|expected_file|deferred|testable|def validate|def replay|\"check\"" check.py | head -80
cd <guest-path> && sed -n 700,725p check.py; sed -n 1160,1230p check.py
cd <guest-path> && grep -n "CREDENTIALS =\|def credentials_missing\|def cycles\|stdin" check.py | head; cd <guest-path> && sed -n 1,25p hooks/prompt-nudge.sh | cut -c1-200; grep -n "tempfile\|TMP\|printf\|echo" hooks/prompt-nudge.sh | head -20
cd /tmp && timeout 60 claude plugin list 2>&1 | head -6; ls ~/.claude/plugins; P=$(find ~/.claude/plugins -name prompt-nudge.sh -path '*fable*' 2>/dev/null | head -1); echo "P=$P"; echo '{"session_id":"baton-cycle-check","prompt":"hello"}' | CLAUDE_PLUGIN_ROOT=$(dirname $(dirname $P)) bash "$P"; echo rc=$?
cd <guest-path> && python3 tests/packaged-hooks.py; echo rc=$?; CLAUDE_PLUGIN_ROOT=. bash hooks/session-start.sh | head -c 300; echo; echo '{"session_id":"baton-cycle-check","prompt":"hello"}' | CLAUDE_PLUGIN_ROOT=. bash hooks/prompt-nudge.sh | head -c 120; echo
cd <guest-path> && cat > probe.json <<'EOF'
{"checks":[
 {"check":"install","kind":"cli","argv":["claude","plugin","list"],"cwd":"<guest-path>","expected_text":"fable-baton@fable-baton"},
 {"check":"credentials_error","kind":"cli","argv":["claude","-p","Reply with the word ok"],"cwd":"<guest-path>","expected_text":"Not logged in"}
]}
EOF
cat > claims.json <<'EOF'
[
 {"kind":"claim","claim":"Installing the plugin with the README command registers fable-baton as installed","source":"/plugin install fable-baton@fable-baton","input":"none (the marketplace was added from realgarit/fable-baton and the plugin installed)","expected":"claude plugin list shows fable-baton@fable-baton","probe_kind":"cli","argv":["claude","plugin","list"],"expected_text":"fable-baton@fable-baton","cwd":"<guest-path>"},
 {"kind":"claim","claim":"The SessionStart hook injects the orchestration policy into a new session","source":"A SessionStart hook injects the orchestration policy into every new session.","input":"{} on stdin with CLAUDE_PLUGIN_ROOT=.","expected":"hook prints the orchestration policy header","probe_kind":"cli","argv":["bash","hooks/session-start.sh"],"stdin":"{}","expected_text":"# Orchestration policy (fable-baton)","cwd":"<guest-path>","env":{"CLAUDE_PLUGIN_ROOT":"."}},
 {"kind":"claim","claim":"The per-prompt reminder prints a delegation check on each prompt","source":"Every prompt gets a short delegation reminder, and when the model does too much inline work in a row, the counter steps in:","input":"UserPromptSubmit payload with session_id baton-cycle-check and a prompt","expected":"hook prints the [fable-baton] delegation check","probe_kind":"cli","argv":["bash","hooks/prompt-nudge.sh"],"stdin":"{\"session_id\":\"baton-cycle-check\",\"prompt\":\"hello\"}","expected_text":"[fable-baton] Delegation check for this turn","cwd":"<guest-path>","env":{"CLAUDE_PLUGIN_ROOT":"."}},
 {"kind":"claim","claim":"Whether the plugin fires inside a logged-in session cannot be tested in this guest","source":"Install once and every new session in every repo starts this way.","testable":false,"reason":"Requires a logged-in Claude Code session with a Fable 5 or Opus subscription or API key; the guest reports 'Not logged in' and no credentials were obtained."}
]
EOF
cat > cycles.json <<'EOF'
{"detected":true,"checks":[{"claim":"The per-prompt reminder runs on every user prompt","source":"hooks/hooks.json","quote":"\"command\": \"bash \\\"${CLAUDE_PLUGIN_ROOT}/hooks/prompt-nudge.sh\\\"\"","schedule":"UserPromptSubmit event, once per user prompt","method":"run-once: the UserPromptSubmit hook command fired by hand with a prompt payload on stdin; no real Claude Code session","input":"{\"session_id\":\"baton-cycle-check\",\"prompt\":\"hello\"}","expected":"reminder printed once for the prompt","kind":"cli","argv":["bash","hooks/prompt-nudge.sh"],"stdin":"{\"session_id\":\"baton-cycle-check\",\"prompt\":\"hello\"}","cwd":"<guest-path>","env":{"CLAUDE_PLUGIN_ROOT":"."},"expected_text":"[fable-baton] Delegation check for this turn"}]}
EOF
cat > examples.json <<'EOF'
[
 {"kind":"example","claim":"Repository's own offline hook test (run by CI) passes","source":"AGENTS.md","input":"tests/packaged-hooks.py","expected":"PASS line for installed hooks with stripped modes","argv":["python3","tests/packaged-hooks.py"],"cwd":"<guest-path>","expected_text":"PASS: all registered hooks work"}
]
EOF
for f in probe claims cycles examples; do python3 -m json.tool $f.json >/dev/null && echo "$f ok"; done
cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -60; echo rc=$?
cd <guest-path> && grep -n "CLAUDE_PLUGIN_ROOT\|policy/\|dirname" hooks/session-start.sh | head; grep -n "CLAUDE_PLUGIN_ROOT\|cat \|policy" hooks/prompt-nudge.sh | head -5; grep -n "env\b\|env=" <guest-path> | sed -n 1,12p | cut -c1-220
cd <guest-path> && sed -n 41,50p check.py | cut -c1-250; sed -n 1100,1120p check.py | cut -c1-250
cd <guest-path> && grep -n "def claims\|def claim_result\|def claim(" check.py; n=$(grep -n "def claim_result\|def claim(" check.py | head -1 | cut -d: -f1); sed -n "${n},$((n+25))p" check.py | cut -c1-220
cd <guest-path> && sed -n 935,960p check.py | cut -c1-240; grep -n "def run_claim\|def claim_outcome\|def product_claim\|def run_check" check.py
cd <guest-path> && n=$(grep -n "^def claim_verdict" check.py | cut -d: -f1); sed -n "${n},$((n+22))p" check.py | cut -c1-240
cd <guest-path> && python3 - <<'EOF'
import json
p='claims.json'
items=json.load(open(p))
items[1]['argv']=['env','CLAUDE_PLUGIN_ROOT=.','bash','hooks/session-start.sh']
items[1].pop('env',None)
json.dump(items,open(p,'w'),indent=1); open(p,'a').write('\n')
EOF
cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | python3 -c 'import json,sys; d=json.load(sys.stdin); print(d.get("valid"), d.get("problems")); r=d["replay"]; print(r["status"]); [print(c["claim"][:50], c["verdict"]) for c in r["details"]["claims"]]' 2>&1 | head -30
cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo rc=$?; python3 -I -c 'import json,sys; d=json.load(open("<guest-path>")); print("valid:",d["valid"]); print("problems:",d["problems"]); print("replay:",d["replay"]["status"], d["replay"].get("details",{}).get("evidence_strength"))' ; grep -o '"verdict": "[a-z]*"' <guest-path> | sort | uniq -c
cd <guest-path> && cat > report.json <<'EOF'
{
 "outcome": "needs_credentials",
 "fault_owner": "prerequisite",
 "operation": "Install the fable-baton Claude Code plugin from the README and run its hooks (policy at session start, per-prompt delegation reminder, inline-call counter).",
 "operation_scope": "Plugin install and hook scripts were exercised in this guest. The model-driven behaviour (orchestration inside a real Claude Code session with Fable/Opus/Sonnet/Haiku) was not run because the guest has no Claude login or API key. No credentials were obtained.",
 "steps": [
  "Installed Node 18.19.1 and npm 9.2.0 via sudo apt-get install nodejs npm (Ubuntu 24.04).",
  "NODE_USE_ENV_PROXY=1 sudo npm install -g @anthropic-ai/claude-code (installed 2.1.309; npm warned the package wants Node >=22).",
  "claude plugin marketplace add realgarit/fable-baton (README: /plugin marketplace add realgarit/fable-baton). Succeeded after removing an earlier local-path marketplace entry.",
  "claude plugin install fable-baton@fable-baton (README: /plugin install fable-baton@fable-baton). Installed v1.5.3, enabled.",
  "claude -p \"Reply with the word ok\" returned 'Not logged in · Please run /login' with exit code 1.",
  "bash hooks/session-start.sh, bash hooks/prompt-nudge.sh and the repo test python3 tests/packaged-hooks.py were run with CLAUDE_PLUGIN_ROOT=. and printed their expected text.",
  "<env-var>=<guest-path> python3 -I <guest-path> --validate --replay returned valid: true with no problems."
 ],
 "deviations": [
  "The README does not give an installer for Claude Code. Installed it with npm instead, because the README requires Claude Code with plugin support.",
  "Node 18 was used; Claude Code's npm package declares Node >=22. The CLI still ran.",
  "First tried the marketplace from the local checkout (claude plugin marketplace add <guest-path>), then removed it and re-added the README source realgarit/fable-baton so the installed copy comes from GitHub.",
  "Hooks were run by hand (bash hooks/prompt-nudge.sh with a JSON payload on stdin) because the README gives no command to fire them. This is a stand-in for Claude Code's own hook dispatch.",
  "The SessionStart claim uses 'env CLAUDE_PLUGIN_ROOT=. bash hooks/session-start.sh' as argv, because claim replay does not pass the spec-level env block.",
  "The README's end-to-end checks (baton-setup, which agents appear, the counter notice during real work) need a logged-in Claude Code session and were not run. Recorded as a testable:false claim."
 ],
 "stuck_step": "claude -p in the guest: 'Not logged in · Please run /login'. Needed for any real plugin session.",
 "main_blocker": "No Claude Code login or Anthropic API key in the disposable guest, so the orchestration behaviour cannot run end to end.",
 "plain_failure": "The plugin installs and its hook scripts print the right text, but the core job (routing work to cheaper agents inside a live session) could not be tested because the guest is not logged in to Claude.",
 "suggested_fix": "Run the same steps in a guest with a Claude Code login (or ANTHROPIC_API_KEY) and Node 22+, then start a session, run baton-setup, and check that the agents and the [fable-baton] notices appear."
}
EOF
python3 -m json.tool report.json >/dev/null && echo report ok; cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; python3 -I -c 'import json; d=json.load(open("<guest-path>")); print("valid:",d["valid"], d["problems"])'