workspaceAllows (policy.go:82) has a case "operate" (lines 90-93) granting operator/agent, but a repo-wide grep shows nothing ever calls workspaceAllows(_, "operate") — the preset-execution profile check lives only as an inline copy in JobManager.RunPreset (jobs.go). So the central policy function has a dead branch while the actual enforcement is duplicated elsewhere, exactly the divergence CLAUDE.md warns about (the two must be kept in sync by hand).
Fix: route RunPreset's profile check through workspaceAllows(ws, "operate") so there is a single source of truth, or delete the dead branch and document that preset policy is enforced in RunPreset. Cleanup-tier (0.3.0 N5).
workspaceAllows(policy.go:82) has acase "operate"(lines 90-93) granting operator/agent, but a repo-wide grep shows nothing ever callsworkspaceAllows(_, "operate")— the preset-execution profile check lives only as an inline copy inJobManager.RunPreset(jobs.go). So the central policy function has a dead branch while the actual enforcement is duplicated elsewhere, exactly the divergence CLAUDE.md warns about (the two must be kept in sync by hand).Fix: route
RunPreset's profile check throughworkspaceAllows(ws, "operate")so there is a single source of truth, or delete the dead branch and document that preset policy is enforced in RunPreset. Cleanup-tier (0.3.0 N5).