Run 10608 aborted before its first edit: the agent calls ~/Notes/bin/wiki-snapshot.sh and git -C ~/Notes rev-parse/status, the rules carried only /root/Notes. Both spellings are allowed for the vault scripts and the read-only git subcommands on the vault checkout, config is denied there too, and the consolidate step derives its --allowedTools from the settings file instead of a second copy. Verified headless: rev-parse, status and wiki-delete.sh allowed, config denied. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>