Self-modification via PR (propose_config_change + nerve-workspace skill) (11/13)

[alex-clickhouse]

What

propose_config_change, plus a nerve-workspace skill that tells the agent how to use it. Under lockdown the agent cannot write tracked config directly, so it opens a pull request against the workspace repo instead: branch, commit, push, PR. Unlocked installs keep editing directly.

Proposals are confined to the reviewed-config surface and classified by effect rather than by file extension, and the destination path is resolved before containment is checked.

Why

Lockdown removes the agent's ability to change its own configuration, which is the intent — but with nothing in its place, the agent's only recourse is to ask a human to make the edit, and the useful half of self-modification is lost along with the dangerous half. A pull request keeps the capability and puts a review in front of it.

Classifying by effect rather than extension is the security-relevant part. A gate plugin is executable code regardless of what it is called, so a proposal touching one is a different kind of change from a schedule edit, and deciding that from the filename would be trivially avoidable.

Resolving the destination before checking containment is the ordering that makes traversal detectable: checking a path that still contains .. tests the string rather than the location it names.

Added in review

Proposals targeted the wrong branch. propose_config_change always used the
remote's default branch, while sync fetches origin/<workspace_sync.branch>, so
an instance following staging opened its PR against main. This PR's own
earlier commit stated the invariant the code broke: "the proposal has to target
the branch sync pulls from."

Worse than useless, because the agent submits the full content of a file it
read in the synced tree. Staged over a different branch's revision, that reverts
whatever the other branch holds and the synced one does not — as a deletion in
the diff, under a title saying the change adds a setting.

base is now threaded through the fetch, the worktree and gh pr create --base
as one resolved name. An empty setting still falls back to origin's default
rather than the local checkout, since a detached HEAD — what sync leaves behind
while validating a revision — has no business choosing what a PR targets.

Validation ran with the machine-local layers overlaid, so a local value
masked an invalid proposed one; the suite already pinned that masking in
test_machine_override_masks_a_shared_error_by_default. A proposal changes the
shared layer and is now judged as one. The comment explaining the lenient choice
covered --strict-keys only and never the layer question. portable_only also
makes an empty portable bundle an error, which is right for a CI gate and wrong
here — a proposal touching only skills/ cannot satisfy it — so that one error is
tolerated, with a test pinning its wording.

The skill now tells the agent to route reviewed-surface changes through a PR on
any box with a remote, not just a locked one. It said "prefer a PR. Nothing
forces it," which reads oddly to an agent holding a skill_create tool that
writes the file directly. Sync refuses to merge while the reviewed surface has
uncommitted local state, so a direct write stops config reaching the instance
until it is committed or dropped, whereas propose_config_change stages in an
isolated worktree and leaves the tree clean. Still a divergence argument, not a
permission one.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Adds a “self-modification via PR” path so the agent can propose reviewed workspace-config changes (skills/cron/settings/instruction files) by staging them in an isolated git worktree, validating, pushing a branch, and opening a PR via gh. This supports lockdown mode where direct edits to tracked config are blocked.

Changes:

• Introduces nerve.config_pr.propose_config_change with path-surface allowlisting, traversal/symlink containment guards, validation-before-PR, and executable-effect announcements.
• Adds an agent tool (propose_config_change) with schema + handler, and registers it in the default tool registry.
• Adds extensive unit + integration tests and a new nerve-workspace skill documenting the workflow (plus a pointer from nerve-dev).

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
tests/test_config_pr.py	Comprehensive tests for PR-based config proposals, including real-git integration cases and safety/effect announcements.
nerve/config_pr.py	Implements PR proposal workflow: path/scope guards, worktree staging, validation, push, and PR creation via gh.
nerve/agent/tools/handlers/config_pr.py	Tool handler + spec for propose_config_change, running the workflow off-thread and formatting agent-facing output.
nerve/agent/tools/schemas.py	Adds JSON schema for propose_config_change tool inputs.
nerve/agent/tools/handlers/__init__.py	Registers config PR tool specs into the default tool registry.
nerve/templates/skills/nerve-workspace/SKILL.md	New skill instructing the agent to always propose workspace config via PR (esp. under lockdown) and clarifying scope.
nerve/templates/skills/nerve-dev/SKILL.md	Directs “config changes” requests to the nerve-workspace skill instead of app-code development.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.