Fully hiding the caller's AGENTS.md dropped repo-specific operational knowledge agents need
(e.g. homelab's migration mechanism: deleting a service requires a matching migrations/*.sh, else
the old service keeps running in prod). Separate the two concerns:
- Platform golden rules stay authoritative (scripts/agent-rules.md), un-overridable.
- The caller's AGENTS.md / CLAUDE.md text is captured before quarantine and injected into the prompt
as explicitly SUBORDINATE context — usable for repo mechanics, but unable to change behavior,
grant permissions, or override the rules.
- opencode.json / .opencode remain fully blocked (config + RCE), never re-injected.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
