Forbid Agent/Task/Workflow fan-out tools in .claude/settings.template deny

Context

Operator directive (@tobiu, 2026-06-21): forbid the fan-out / subagent-spawn tools (Agent / Task) and Claude Workflow in the tracked .claude/settings.template.json, so the deny propagates to ALL claude repos (incl. the 2 Fable instances) via template→settings hydration.

This is a discipline-failure that is empirically not self-correcting: @neo-opus-ada reached for spawned subagents repeatedly (read/analysis work that jq/grep/Read do for almost nothing), where @neo-opus-grace and @neo-opus-vega never did. Each fan-out spins a fresh full-context agent that re-reads everything — 100k–millions of tokens for zero value over the V-B-A tools — draining the weekly limit in hours (negative-ROI). Behavioral rules are discipline-only; a config deny is mechanical.

The Problem

There is no config-level guard against Agent/Task/Workflow tool-calls. A live .claude/settings.json deny was added to one worktree as an immediate stopgap, but .claude/settings.json is gitignored (per-worktree) — it does not propagate. The durable, swarm-wide fix is the tracked template that every worktree/repo bootstraps from.

The Architectural Reality

• .claude/settings.template.json is the tracked canonical hydrated into per-worktree .claude/settings.json (via initClaudeSettings / bootstrapWorktree). A permissions.deny entry there reaches every newly-bootstrapped worktree.
• Per-worktree .claude/settings.json is gitignored (immediate but local; already denied in the active worktree).
• Cross-repo: the same template deny must land in every claude repo (incl. the 2 Fable instances).

The Fix

• Add "deny": ["Agent", "Task", "Workflow"] to the permissions block of .claude/settings.template.json.
• Verify initClaudeSettings hydration preserves permissions.deny into a fresh worktree's settings.json.
• Propagate the identical template deny to the other claude repos (incl. the 2 Fables).

Acceptance Criteria

• .claude/settings.template.json permissions.deny includes Agent, Task, Workflow.
• A freshly-bootstrapped worktree's .claude/settings.json inherits the deny (hydration preserves it).
• The identical deny is applied across all claude repos, incl. the 2 Fable instances.

Out of Scope

• The operator's global ~/.claude/settings.json deny (operator-owned; the surest machine-wide cover, applied separately).
• The behavioral rule (already saved to memory: never fan-out; use V-B-A tools).

Related

Surfaced by @tobiu (2026-06-21) after repeated fan-out token-burn by @neo-opus-ada. Immediate stopgap: the active worktree's live settings.json deny. No equivalent ticket in the live open-issue survey run this session.

Release classification: post-release (token-cost / MX hardening — but high-priority: active token-drain).

Origin Session ID: 93531a2a-e304-4dc5-a4c4-ab7280c7b3ae