Harden supervisor skillRoots handling for no-babysitting worker spawns

[pirajoke]

Context

A real no-babysitting test failed when the supervisor passed the project repo path as worker skillRoots. The runtime rejected it with: skill root contains no skill directories.

Local patch prepared

• Validate supervisor-requested skillRoots before bridge.spawnAgent.
• Pass only directories that contain SKILL.md or immediate child skill directories with SKILL.md.
• Ignore invalid skill roots and record worker_skill_roots_ignored execution events instead of killing the worker spawn.
• Tighten worker_spawn tool description so the supervisor omits skillRoots for normal project work.

Local files changed

• src/server/supervisor/index.ts
• src/server/supervisor/tools.ts
• tests/supervisor/index.test.ts

Validation

• PASS: pnpm exec vitest run tests/supervisor/index.test.ts -t "skill roots"
• PASS: pnpm exec eslint src/server/supervisor/index.ts src/server/supervisor/tools.ts tests/supervisor/index.test.ts
• NOTE: full tests/supervisor/index.test.ts still has an unrelated existing failure in lets the supervisor send a generated user-visible message before ending its turn: persisted message order is supervisor,user vs expected user,supervisor.

Follow-up

Add watchdog/budget limits for worker startup and no-output loops as a separate hardening pass.

[pirajoke]

Local memory updated after creating this issue:

• Obsidian: /Users/pirajoke/ObsidianVault/30-Systems/Tools-Research/OmniHarness-ACP-Control-Plane.md now includes the 2026-05-11 no-babysitting assessment, cost note, hardening patch, validation status, and this GitHub issue link.
• Codex skill: /Users/pirajoke/.codex/skills/omniharness/SKILL.md now includes the skillRoots hardening note and narrower no-babysitting prompt guidance.
• Skill validation passed: quick_validate.py /Users/pirajoke/.codex/skills/omniharness.