[finding] plugins/uberdev/commands/testers.md — The rewritten read-only contract names Write as the only unc #769

@TheFJK — /premerge flagged a blocker finding on PR #768.

Origin: 2c6db44177351a84156c12e838aceecd76f8713b
Agent: premerge.review.code_review
File: plugins/uberdev/commands/testers.md:22
Severity: blocker (Phase premerge)
Disposition: DEFERRED (premerge-repair-budget-exhausted)
Tier: BLOCKER
Blocks: #768

Findings (1)

1. plugins/uberdev/commands/testers.md:22 — blocker / BLOCKER / DEFERRED (premerge-repair-budget-exhausted) — The rewritten read-only contract names Write as the only unconfined grant, but every persona also carries Bash(curl*) /

Lenses: premerge.review.code_review

The PR's own premise (agent cards, RFC 0006, tests/testers-agent-contract.test.sh C5 header, tests/model-routing.test.sh) is that a tools: entry filters tool NAMES and the text inside the parentheses binds nothing. Applied consistently, Bash(curl*) grants the Bash tool with no pattern restriction, so a persona can run sed -i, python3 -c open(...,'w'), or a shell redirect against any app file. testers.md:22 and all eight card Rules blocks say only that the personas keep a Write no card confines to a directory, implying Bash is confined. lib/rl-curl's own new header is the one surface that gets it right. An operator reading testers.md concludes the tool boundary constrains everything but Write; in fact it constrains nothing that matters for writing app code.

To resolve: address the findings above in code and close this issue. Closing resolves exactly the findings listed in this body and the findings added by a later comment on it — one index records both, and closing resolves that recorded set and nothing else. A finding in this file that this issue never recorded is filed as a NEW issue rather than suppressed, so closing never mutes the file. Before closing, apply finding:true-positive if it was a real defect or finding:false-positive if it was not — that label is the eval ground truth (RFC 0018).