# Isolated worktree workers and policy-write safety

## Worker containment gate

When a finance task authorizes a narrow worker in a separate worktree:

1. State the intended absolute worktree path in the worker prompt.
2. Before accepting any worker claim, verify its changed paths are under that worktree (`git -C <worktree> status --short` plus `git diff --name-only`).
3. If it wrote elsewhere, do not copy or credit its output. Treat the assigned ticket as unverified and implement/reassign only if the user’s worker-count constraint permits.
4. Report the worker model/session identifier and verified paths separately from unobservable internal reasoning.

## New versioned financial-policy writes

- Inspect the real `audit_log` columns on a synthetic migrated DB before coding an audit insert; do not infer a generic `details_json` shape.
- Build the Preview ID from a canonical request payload that excludes confirmation-only fields (`preview_id`, `confirm`); otherwise a valid preview cannot be confirmed idempotently.
- Confirm must be checked in a synthetic API test for: no preview writes, immutable previous version, one active version, same-request idempotency, and a minimal audit record that contains version/action but no policy contents or money details.
- Keep active-policy evaluation fail-closed when a comparable stored portfolio aggregate is absent or its quality is stale/partial/unavailable/unknown. Do not invent valuation, FX, performance, or advice.