[Jammy2211]

The Mind half of a mobile-performance review. Companion to PyAutoLabs/PyAutoBrain#289, which is already merged — this PR's firewall change depends on it (see Merge order).

The hook that never fired

Claude Code registers project hooks from the session's project directory. A session holding several organs clones them side by side under that directory, so the project directory is their parent: not a repo, no .claude/, no hook registered.

So in exactly the sessions holding the most repos, no repo's SessionStart hook ran at all, and the session came up on the container's Python 3.11 — one minor below the floor this organism set for itself and below every CI leg, with mypy and flake8 reading the interpreter and judging code against 3.11 rules. Nothing announced it; it surfaced as local-green/CI-red.

Measured, not inferred: running the hook by hand ~40s into a live session printed building /root/.pyauto/session-py312 and rebuilt all seven uv tools. Nothing had built it.

What changed

• policy/session_start_hook.sh derives its repo from the hook's own location, not $CLAUDE_PROJECT_DIR, so session-python.txt is read from the repo that owns it rather than from a parent that has none.
• On detecting the multi-repo layout it installs a workspace-root settings.json plus a fan-out that runs each sibling repo's hook, so the next session in the container starts correctly.
• It unshallows the session's clones. A shallow clone makes git merge-base --is-ancestor report "not an ancestor" for a commit whose ancestry is merely absent, and the ship/close-out procedures act on that answer — already logged once in complete/2026/08/status-sh-repos-missing-source.md as an environment note. Observed here: PyAutoMind had 249 of 4398 commits.
• Git history and hook reachability now run before, and independently of, the interpreter legs. A container that cannot build the venv still wants honest ancestry and a hook that fires next time. PYAUTO_SESSION_SKIP_PYTHON=1 is the documented seam the tests use.
• The env file now also exports PYAUTO_ROOT.

scripts/session_bootstrap.sh is the other half — the door anything can knock on to fix the session it is already in. bin/pyauto-brain calls it before dispatch, so no /verb runs unbootstrapped. Its --check resolves each tool's shebang to report the interpreter it actually runs on, because a tool's own --version says nothing about that — and a 3.11 mypy is the whole problem.

Tenant firewall: seven entries dropped or narrowed

FIREWALL_ALLOWLIST shrinks. Each of those entries named the owner only because it hardcoded a workspace root under $HOME; PyAutoBrain#289 makes those consumers delegate to resolvers that name no absolute path.

Worth recording: the firewall check caught the first draft of that fix naming ~/Code/PyAutoLabs as a fallback — correctly, since an instance fact in organ code is precisely what caused the bug. The fallback proved redundant as well as wrong, so the list shrank instead of growing.

Merge order

Mind's firewall_gate.yml checks PyAutoBrain out pinned to main, and this PR touches scripts/repos_sync.py, so it triggers. Reproduced locally: 7 mismatches against the old Brain main, 0 against the merged one. PyAutoBrain#289 is merged, so this PR's first CI run lands against a main that satisfies it.

Also in this PR

draft/feature/pyautobrain/board_without_gh.md — the follow-up prompt for the eleven board legs that read GitHub through gh api and stay dark in a remote session, carrying the measurements so the next session need not re-derive them. Cross-linked with the board's small-nit catch-all; dashboard regenerated in the same commit.

Validation

• 224 tests pass; lifecycle.py check and repos_sync.py --check both clean.
• 8 new tests covering the layout that used to defeat the hook entirely, the fan-out's reach, and the shallow-clone lie — the last asserted against git itself, before and after. Four of them fail against the previous hook, confirmed rather than assumed.
• Fictional fixtures only, per the tests/** KEEP-copy rule.
• ruff clean on every file touched.

🤖 Generated with Claude Code

https://claude.ai/code/session_012PDoeCuecjutdnwkxsTqg7

---

Generated by Claude Code