Red-team and harden a pack-reading agent in Claude Code

The reader is contained in three layers, each of which would hold if the others failed: the subagent's tool list (Read, Grep, Glob, Write: no WebFetch, no Bash), the project's permission rules (allow pack/ reads and drafts/ writes, deny the network, the shell and client/), and a hook that refuses any write outside drafts/ in every permission mode. The decision that matters most is admitting what none of them can do: the "record disputes as none" injection asks for nothing the permissions can refuse, so the defence there is in the subagent's output rules and in the score, which checks the answer against TA6 2.1.