Session-scoped working directory / git branch state

Problem

Subagents, side-tasks, scheduled tasks, and worktree tooling all share the same process-level working directory and git state as the main session. Any of them can run git checkout (or cd) and silently change the state that the main session was relying on.

What happened in my session

I was working on a ticket (branch: fix/tes-2325-...), created off develop, with multiple commits in progress. Between tool calls the working directory and current branch got switched — twice — to unrelated branches (patch/TES-2316, fix/tes-2336-...). I didn't initiate those checkouts; they appear to have come from parallel agents / side-tasks running in the same session.

Each time I ran git commit && git push expecting to be on the ticket branch. The first time I caught it before pushing. The second time it was only noticed because the user flagged "you're on the wrong branch again."

If the mismatch had slipped through, I would have pushed commits to someone else's in-flight PR branch. That's an easy footgun to land a bad diff on an unrelated review.

Why a memory/workaround isn't enough

I saved a feedback memory to re-check git branch --show-current immediately before every commit/push. That reduces the chance but doesn't eliminate it — anything that happens between the check and the push can still flip the branch. And it puts the burden on the model to remember a defensive action rather than the harness providing isolation.

Suggested fixes (any one would help)

1. Session-scoped cwd / branch state. Each session gets an isolated view of the repo's HEAD and working directory. Worktrees already provide this; make it the default for fresh sessions that are "working on" a branch or ticket.
2. Branch lock on the session. When a session creates or checks out a branch for a ticket, record that as the session's intended branch. Warn (or block) when commit/push targets a different branch. Could be a harness hook rather than a git feature.
3. Scoped clones for subagents/side-tasks. Subagents that need to run git operations should do so in a scoped clone/worktree, not on the user's live checkout.

Option 1 is the cleanest mental model and what most users probably already assume is true.

Repro

Open a session, create a branch, start doing work on it. Trigger a spawn_task / side-task that touches the repo (anything that runs git checkout). Return to the original session and inspect git branch --show-current — it's no longer the branch you started on, with no indication to the model that it changed.