# Launch Safety

Apply these rules only when the chosen strategy creates a child context that will mutate or review repository state.

## Environment Binding

- Bind the child to the intended harness project or parent session, repo root, worktree, and assigned symbolic branch/ref at creation time.
- Do not launch a generic child and ask it to `cd` into the target worktree.
- Verify `pwd`, `git rev-parse --show-toplevel`, `git symbolic-ref --short HEAD`, and `git status --short --branch` before mutation or review.
- Detached HEAD, the wrong repo/worktree, or the wrong branch/ref is a blocked launch. The child reports the mismatch; it does not repair placement itself.
- Exactly one actor owns a mutable checkout at a time. A coordinating thread sharing that checkout must not mutate it while a child owns it.

When the adapter offers multiple worktree modes, use only a certified mode known to preserve symbolic HEAD and checkout ownership. Otherwise prepare and verify an attached branch first, then launch against that attached working tree. Never select behavior by child-system generation or product version.

## Callback Binding

When the chosen strategy uses callbacks:

- resolve the concrete orchestrator session id at run time
- substitute it into the actual child instruction before launch
- include the child's source session id in the response
- reject unresolved placeholders, generic targets such as `this session`, creation-session ids, prior-run ids, and child ids used as destination ids
- define when the child reports success or blocked state

Coordination may be callback-wait, structured completion delivery, active messaging, or native multi-agent synthesis depending on certified capabilities. Avoid routine polling when completion will be delivered, but allow proportionate liveness checks when the surface or failure mode requires them.

## Mechanical Enforcement

Keep fragile launch and callback checks in schemas, adapters, hooks, or validators where possible. Prompt text may explain an invariant; it does not configure the launcher or prove that the invariant holds.