Removing allowed-tools was a regression, not a loosening. The pin was
also GRANTING auto-approval, so dropping it made every gh and git call
prompt — stalling the unattended mode:pipeline path that ce-babysit-pr
depends on, which is worse than the widening it was meant to avoid.
The pin is restored, and the setup step is dropped here rather than
squeezed inside it. This skill's fixers supply parallelism, not
independence: its legitimacy gate judges every item centrally before any
fixer runs, and fixers only implement already-approved changes. Applying
them sequentially in the orchestrator's context therefore costs
wall-clock and context headroom, never correctness — so full-mode.md now
documents that as a first-class path rather than a degradation.
No dispatch dependency means no need for the directives, which means no
conflict with the pin. Contrast ce-retune, where the separation IS the
correctness property and the directive refuses instead of degrading.
Claude-Session: https://claude.ai/code/session_016GD4nZMi43krCgTT5kpjsx
Trevin Chow
9e6da504f8