fix(sdd): guard worktree commits in prompts and review-package (#2050)

[stantheman0128]

Who is submitting this PR? (required)

Field	Value
Your model + version	Grok (via Cursor Agent)
Harness + version	Cursor IDE agent
All plugins installed	OSS factory workspace; superpowers skills read from upstream clone
Human partner who reviewed this diff	Stan Shih (stantheman0128) reviewed the complete diff before publish

AI-assisted contribution. Evidence and eval notes below are from a real Windows 11 session.

What problem are you trying to solve?

Issue #2050: during subagent-driven-development (SDD), a dispatched implementer ran git add / git commit from the main repository checkout instead of the isolated worktree branch. The worktree was meant to isolate the work, but the subagent cwd was not enforced, so main received an out-of-context commit and the review package still looked plausible.

Failure mode: implementer reports a commit SHA; review-package builds a diff from BASE..HEAD even when HEAD lives on another branch or working tree, so the controller reviews unrelated history as if it were the task.

What does this PR change?

1. implementer-prompt.md: require verifying git rev-parse --show-toplevel and git branch --show-current before every git add / git commit; STOP with BLOCKED if they do not match the dispatched worktree.
2. review-package: exit 3 when HEAD is not reachable from the checked-out branch, or when BASE..HEAD is empty (commit landed elsewhere).
3. test-sdd-workspace.sh: four regression cases for stray-tree HEAD, empty range, happy path, and amend orphaning FIX_BASE.

Deliberately not changing SKILL.md prose (#1588 was closed for blast radius on that file; obra asked for the smallest surface, likely implementer-prompt.md only). The mechanical guard lives in review-package, which every task review already calls.

Is this change appropriate for the core library?

Yes. Any SDD user with multiple working trees of the same repo hits this; it is not project-specific.

What alternatives did you consider?

• Broad SKILL.md guardrails (rejected: fix: keep SDD writes inside active worktree #1588 closed for touching behavior-shaping prose without evals).
• Controller-only cwd checks (insufficient: subagents do not inherit cwd reliably per subagent-driven-development: dispatched subagent committed to main instead of the worktree (isolation not enforced) #2050).
• Only prompt text without review-package enforcement (insufficient: prompts alone did not stop the reported failure).

Does this PR contain multiple unrelated changes?

No. All three files serve the same worktree isolation failure mode.

Existing PRs

• I have reviewed all open AND closed PRs for duplicates or prior art
• Related PRs: fix: keep SDD writes inside active worktree #1588 (closed, SKILL.md blast radius), fix: guard EnterWorktree core.bare parent checkout #1589 (closed, EnterWorktree bare-parent guard)

#1588/#1589 addressed adjacent git-worktree hazards. This PR targets the SDD implementer dispatch path described in #2050: subagent commits on the wrong branch/tree and review-package still packages plausible output.

Environment tested

Harness (e.g. Claude Code, Cursor)	Harness version	Model	Model version/ID
Cursor Agent	current (2026-08)	Grok	via Cursor

Evaluation

• Initial prompt: factory scout on obra/superpowers subagent-driven-development: dispatched subagent committed to main instead of the worktree (isolation not enforced) #2050 after maintainer discussion on worktree isolation.
• Eval sessions after the change: multiple local A/B runs on Git Bash (Windows 11).
• Before: stray-commit scenarios produced exit 0 review packages with unrelated history (2 commits / hundreds of bytes of wrong diff in one repro).
• After: both stray-commit cases exit 3 with git branch --contains guidance; in-worktree commits and amend orphan case still exit 0.

Rigor

• If this is a skills change: I used superpowers:writing-skills and completed adversarial pressure testing (paste results below)
• This change was tested adversarially, not just on the happy path
• I did not modify carefully-tuned content (Red Flags table, rationalizations, "human partner" language) without extensive evals showing the change is an improvement

Human review

• A human has reviewed the COMPLETE proposed diff before submission

Verification / Evidence

# Git Bash on Windows 11, from repo root:
bash tests/claude-code/test-sdd-workspace.sh

# #2050-related cases (all PASS):
#   review-package rejects a HEAD committed in another working tree
#   review-package rejects an empty range: nothing landed on this branch
#   review-package accepts commits made in this worktree
#   review-package accepts a FIX_BASE orphaned by an amend

# Four pre-existing workspace-path assertions still fail on this Windows host
# (prints <repo-root>/.superpowers/sdd/<plan-basename>, linked worktree workspace).
# Those failures reproduce on origin/dev without this branch; not introduced here.

Linked-worktree live repro: commit on branch A while review runs in worktree B -> exit 3 before writing a misleading package.

What was not tested

• Full Claude Code EnterWorktree dispatch on macOS/Linux (mechanism is plain git ancestry checks; platform-agnostic).
• End-to-end multi-subagent SDD session in Claude Code harness (local script regression + manual linked-worktree repro only).

Fixes #2050