Shopify operator tripwire in the fleet implementer's system prompt - #27

…onduct block's self-scoping

Adversarial review finding: the conduct text opening the same quoted string
self-scopes to human-addressed comments (documented in the SCOPE note as
model-interpreted prose), so a model could read the tripwire as inheriting
that scope and discount it on the issue rail — the one rail where store
credentials are provisioned. The lead-in is kit-side framing, not canonical
text; verbatim parity with the canonical blockquote still holds.

…rd, citations

Review ran 33 agents; 12 findings survived adversarial verification. Parity with
driver-agents docs/agent-instructions-shopify.md @ 4d63371 is byte-exact after
whitespace collapse (978 chars both sides) and holds after these edits. Two
backtick-safety findings were refuted: shell-quote is a parser, the SDK spawns
without shell:true, and the hazard character would be $, of which there are zero.

- claude.yml:416 said the tripwire lead-in matters on "the issue rail — the one
  rail where store credentials are actually provisioned". Wrong, and contradicted
  by the file 245 lines earlier: the gate at :175 excludes only /code-review, and
  :170-172 explicitly warns against restating it as the issues event. The newest
  comment in the file was inviting the exact simplification the older one forbids.

- A tripped tripwire was silent. allowedTools has no exit-code mechanism, so a
  failing Bash call fails a tool call and the job still reports green; the
  if: failure() surfacing step never fires; and a model that correctly refuses to
  call anything writes no audit line, so the artifact sink no-ops. Canonical's own
  rationale asks for a loud failure. Added one sentence to the kit-side lead-in
  (declared non-canonical at :412-416, so parity is unaffected) telling the model
  to post a SHOPIFY-TRIPWIRE comment before stopping.

- lint.yml: new step asserting claude_args holds exactly 4 single quotes and the
  system prompt contains no apostrophe or $. One apostrophe typed into canonical
  upstream silently TRUNCATES the prompt — shell-quote does not throw, every flag
  still parses, YAML stays valid, actionlint exits 0, and the wave would copy the
  truncated prompt to 18 branches green. Measured: an apostrophe mid-tripwire drops
  the exit-3 clause; one in the first sentence drops the whole tripwire. Verified
  the guard passes here and fires on an injected apostrophe.

- Citations: the tripwire is +11 at :403 and the gate-comment fix +1, so claude.yml
  is 460 -> 477 and every citation at or past the insertion shifts +12, not the +11
  the review computed before the last fix. Anchored all six by content rather than
  arithmetic: :461->:473, :463->:475, :459-465->:471-477, :454-457->:466-469,
  :450->:462, plus the counts (465->477, 296/465 63% -> 308/477 64%).
  Reverted rcs.md:41 to 460 instead of advancing it — that paragraph is the v1.9.0
  snapshot and 465+190 broke its own 650 arithmetic.

- Provenance stamps in both docs claimed verification against a54c91e only; they
  now record the v1.11.0 re-verification, since that is what makes them true.

- READMEs: the re-copy instruction now says to preserve the kit-side lead-in (it
  was already dropped once inside this PR — the READMEs landed in 267f994 and the
  lead-in in a later claude.yml-only commit), and documents the no-apostrophe
  constraint. Release order step 1 now requires re-running the parity check on any
  DRIVER_AGENTS_REF bump, with the mandatory whitespace-collapse recipe.

Deferred to a driver-agents PR (cannot be fixed here without breaking parity):
the credential enumeration misses the store credential file, "Do not retry it"
collides with the redirectNewHandle guard's own remediation text, and "extend the
allowlist with one reviewed line" is false for the argument guards.

actionlint clean. Parity re-checked after every edit.