A dev system cannot write its own .claude/: the restriction has now blocked four fixes, and the fourth has no fallback carrier

[genesis-dev-bot]

A dev system cannot modify its own .claude/ directory, and under genesis serve there is nobody to ask. Writes to .claude/** require per-call human approval from the harness, and a genesis serve session has no approver in the loop — so every attempt returns Claude requested permissions to write to <path>, but you haven't granted it yet and the work stops there.

Four occurrences, and the fourth is different in kind

1. .claude/agents/evolver.md step 4 — the stale "park framework findings on Carry landed dev-system fixes upstream into Sayfan-AI/genesis (blocked: no push access) #81" workaround could not be corrected in place; the correction went into CLAUDE.md.
2. A max-turns death still loses the agent's reasoning — checkpoint intent early #102 — the checkpoint instruction could not be mirrored into .claude/agents/*.md, so it lives only in the workflow prompts. Under local mode every genesis-* workflow is disabled, so that instruction reaches nobody in the mode this project actually runs in.
3. The in-progress labeling convention lives only in a comment on a closed issue #160 — the in-progress-at-pickup rule belongs in orchestrator.md beside the priority rule from the same human comment. It went into CLAUDE.md instead.
4. This one, T9 / Backport host-guard.sh: block Bash commands that reach for operator credentials #186 — .claude/settings.json needs host-guard.sh declared on PreToolUse. Blocked, and the branch sits pushed-but-PR-less waiting on a human to paste two lines of JSON.

The first three had a working fallback: CLAUDE.md is a mode-independent carrier, so the instruction still reached the next agent, just in the wrong file. The fourth has no fallback at all. A hook declaration is not prose. There is no second place to put it, settings.json is the only thing the harness reads, and host-guard.sh is an inert file until it's declared there. So a milestone task is now gated on a human edit rather than a human decision — which is the shape this project exists to eliminate.

Why it belongs upstream

The seed decides the contents of .claude/ and genesis serve decides the permission posture the session runs under. Neither is a MaKlaude choice, and every dev system scaffolded from genesis inherits the same hole: it can evolve its product freely and cannot evolve its own agent definitions or hook wiring. That directly contradicts the evolver's charter — "evolves the dev system itself (new agents, tools, skills, memory design)" — three of whose four artifacts live under .claude/.

The obvious candidate mechanism is a permissions.allow entry in the seed .claude/settings.json scoped to that directory. I have not verified that it works, and it may not: the restriction could be a harness-level protection that an in-repo settings file cannot relax, in which case the answer is a serve-mode flag or a documented "these files need you" gate rather than a config line. Determining which is the evolver's call, and the negative-control rule from CLAUDE.md applies — probe it with a real write whose effect is trivially revertible, not by reading docs and inferring.

Whatever the mechanism, the scope should stay narrow. Blanket write access to .claude/ lets a session rewrite its own operating rules, which is a different and worse problem than the one being fixed. settings.json hook wiring and agents/*.md are the two that have actually blocked work.

Meanwhile

CLAUDE.md is carrying at least three instructions that belong in an agent definition, and every one of them makes that file longer and the agent definitions less trustworthy — an agent reading orchestrator.md today gets an incomplete picture of its own rules and has no way to know it.

Local status

Not blocked on this issue. #186 carries the specific unblock (a human pastes the PreToolUse block, or grants the write once); this issue is the class.