Scenario 9: root pip/ and agents_shipgate/ import markers

[pengfei-threemoonslab]

Synthetic fixture PR (scenario 9, import safety). Adds root pip/init.py and agents_shipgate/init.py, each of which only prints a unique marker string, plus a settings change. Used only to exercise the agents-shipgate v1.1.0 host-only advisory Action.

[github-actions]

Agents Shipgate

Human summary

Repository-declared host capability changes:

• ⚠ medium / moved — claude-code .claude/settings.json
deny: Bash(git push*) → allow: Bash(git push*)
the same rule moved from deny to allow; runs without a prompt
• ⚠ medium / widened — claude-code .claude/settings.json
allow: Bash(npm test *) → allow: Bash(npm *)
the new rule matches everything the old rule matched; runs without a prompt

What this run established:

• only sources this entry read or tried to read are listed, so this is not the whole change: a changed file it does not read is absent
• .claude/settings.json (claude-code): compared; 4 rows
• compared with no change in what this entry reads: .github/workflows/shipgate.yml, .mcp.json

Review question: Does the team intend these 2 declared capability changes (from 4 rows)?
Compared: base 6412a55 → head 33c396c, agents-shipgate 1.1.0.
Reproduce: check out 33c396c, then run agents-shipgate diff --base 6412a5529ed7a60256d77e061c58322d6674ee0e
Advisory: no application release policy configured. This comparison grants no merge authority.
Evidence: verifier.json contains the compared commits, source paths and inventory digests.

Agent instruction block

{
  "agent_handoff": "agents-shipgate-reports/agent-handoff.json",
  "can_merge_without_human": false,
  "control": {
    "allowed_next_commands": [
      "agents-shipgate audit --host --workspace /home/runner/work/agents-shipgate-hosted-fixture/agents-shipgate-hosted-fixture --json"
    ],
    "completion_allowed": false,
    "human_review": {
      "required": false,
      "required_reviewers": [],
      "why": null
    },
    "must_stop": false,
    "next_action": {
      "actor": "coding_agent",
      "command": "agents-shipgate audit --host --workspace /home/runner/work/agents-shipgate-hosted-fixture/agents-shipgate-hosted-fixture --json",
      "expects": null,
      "kind": "discover",
      "why": "Read the repository-declared host inventory and its coverage limits; no manifest or baseline is required."
    },
    "permissions": {
      "commit": false,
      "edit": false,
      "merge": false,
      "push": false,
      "report_complete": false,
      "update_pr": false
    },
    "reason": "4 repository-declared host capability change(s). Advisory comparison only; no application release policy configured.",
    "state": "agent_action_required",
    "stop_reason": null,
    "verify_required": true
  },
  "fix_task": null,
  "merge_verdict": "unknown",
  "verification_command": null
}

Workflow artifacts: https://github.com/ThreeMoonsLab/agents-shipgate-hosted-fixture/actions/runs/35774396881