worktree-isolation verifier refuses literal-path sourcing and ${VAR:-default} interpolated execution for repo-tracked scripts

Summary

The worktree-isolation verifier (the layer that vets an isolated subagent's top-level Bash commands, isolation: worktree) refuses two invocation forms that multi-agent pipelines naturally standardize on for repo-tracked helper scripts, forcing repos to converge on literal-path execution only. Requesting that (at minimum) literal-path sourcing, and ideally single-variable-interpolated execution, be verifiable.

Observed behavior (reproduced in two independent sessions, 2026-07-30)

With a script tracked inside the repo/worktree, an isolated subagent's top-level commands resolve as:

| Form | Result |
|---|---|
| . ./plugins/my-plugin/skills/x/scripts/step.sh (literal-path source) | refused — "runs a string through ., which can't be verified to stay inside the worktree" |
| . "$VAR/step.sh" (interpolated source) | refused, same wording |
| bash "${PLUGIN_ROOT:-plugins/my-plugin}/skills/x/scripts/step.sh" (interpolated execution with literal default) | refused — "too complex to verify" |
| bash ./plugins/my-plugin/skills/x/scripts/step.sh (literal-path execution) | executes |

Why it matters

• Sourcing is refused per se, even with a fully literal path that is statically inside the worktree — so any script class designed to set state in the caller's shell can't run as designed under isolation.
• The "${VAR:-literal-default}" execution idiom is the natural shape for plugin-shipped scripts that need a root-dir override (the same pattern as CLAUDE_PLUGIN_ROOT); refusing it forces repos to hardcode literal paths and give up plugin portability.

Our project absorbed this by converting ~61 sourced scripts to executed scripts with a stdout contract and rewriting the documented idiom to literal paths (decision record: https://github.com/kamp-us/phoenix/issues/4546; tracking: https://github.com/kamp-us/phoenix/issues/4558). Not blocking us — filing so the constraint is visible upstream.

Ask

1. Accept a literal-path source (. ./relative/tracked/path.sh) when the path is statically resolvable inside the worktree — same verifiability as the literal-path execution already accepted.
2. Ideally, accept single-interpolation execution "${VAR:-literal-default}/…" where the default is a literal worktree-relative path.

Happy to provide fuller repro details.