fix(pipeline): give every scratchpad write a per-run namespace (§SP) (#3718)

claude-plugins/kampus-pipeline/agents/adr.md

@@ -72,6 +72,25 @@ These hold on every run regardless of what the spawn prompt remembered to say:
 - **No home / local / absolute / sibling-repo paths in any artifact.** The ADR body, its links, and
   your return summary cite repo-relative paths only (`.decisions/NNNN-slug.md`, `apps/web/worker/…`) —
   never a `~/`, `/Users/…`, vault, or sibling-clone path, and no Obsidian `[[wikilinks]]`.
+- **Every intermediate file you write lives under a per-run scratch namespace (§SP).** Never
+  stash state in a fixed or work-item-keyed scratchpad path (`prref.txt`,
+  `/tmp/verdict-$PR.md`) — the pipeline runs several agents concurrently by design, so a
+  shared filename gets clobbered mid-run and reads back **another run's content with no
+  error**: silent, and it routed a reviewer's `git diff` to the wrong PR's files (#3718).
+  Prefer passing the value in-process and writing no file at all; when a file is genuinely
+  needed, derive its path from a per-run namespace and name every leaf under it:
+  `RUN_SCRATCH="${TMPDIR:-/tmp}/kampus-run/${CLAUDE_CODE_SESSION_ID:?}/<skill>-<work-item>"`,
+  then `mkdir -p "$RUN_SCRATCH"` (fail closed — never fall back to a shared path).
+  **When the state must cross a Bash call, this recipe is the carrier: recompute the same line
+  in the later call.** Your shell state does not survive between Bash calls, so a
+  `RUN_SCRATCH` allocated by `mktemp -d` is unrecoverable afterwards — re-running `mktemp -d`
+  yields a *new empty directory*, silently turning a read of your own earlier state into a
+  read of nothing. Keying on `$CLAUDE_CODE_SESSION_ID` gives both properties at once: unique
+  per agent run, and recomputable by any later call of that same run. Never park the path
+  itself in another file to carry it across — that just moves the collision onto that file.
+  The rule, its fail-closed allocation, the single-Bash-call `mktemp` carve-out, and the
+  never-leak-the-path corollary are single-sourced in the skills'
+  `gh-issue-intake-formats.md` §SP.
 - **Work from the repo root**, not a nested app directory.
 
 ## Repo-agnostic — resolve `$REPO`, never hardcode a literal

claude-plugins/kampus-pipeline/agents/canon.md

@@ -77,6 +77,25 @@ These hold on every run regardless of what the spawn prompt remembered to say:
   row, and your return summary cite repo-relative paths only (`.patterns/<name>.md`,
   `apps/web/worker/…`) — never a `~/`, `/Users/…`, vault, or sibling-clone path, and no Obsidian
   `[[wikilinks]]`.
+- **Every intermediate file you write lives under a per-run scratch namespace (§SP).** Never
+  stash state in a fixed or work-item-keyed scratchpad path (`prref.txt`,
+  `/tmp/verdict-$PR.md`) — the pipeline runs several agents concurrently by design, so a
+  shared filename gets clobbered mid-run and reads back **another run's content with no
+  error**: silent, and it routed a reviewer's `git diff` to the wrong PR's files (#3718).
+  Prefer passing the value in-process and writing no file at all; when a file is genuinely
+  needed, derive its path from a per-run namespace and name every leaf under it:
+  `RUN_SCRATCH="${TMPDIR:-/tmp}/kampus-run/${CLAUDE_CODE_SESSION_ID:?}/<skill>-<work-item>"`,
+  then `mkdir -p "$RUN_SCRATCH"` (fail closed — never fall back to a shared path).
+  **When the state must cross a Bash call, this recipe is the carrier: recompute the same line
+  in the later call.** Your shell state does not survive between Bash calls, so a
+  `RUN_SCRATCH` allocated by `mktemp -d` is unrecoverable afterwards — re-running `mktemp -d`
+  yields a *new empty directory*, silently turning a read of your own earlier state into a
+  read of nothing. Keying on `$CLAUDE_CODE_SESSION_ID` gives both properties at once: unique
+  per agent run, and recomputable by any later call of that same run. Never park the path
+  itself in another file to carry it across — that just moves the collision onto that file.
+  The rule, its fail-closed allocation, the single-Bash-call `mktemp` carve-out, and the
+  never-leak-the-path corollary are single-sourced in the skills'
+  `gh-issue-intake-formats.md` §SP.
 - **Work from the repo root**, not a nested app directory. Resolve it with
   `git rev-parse --show-toplevel` and operate on `<root>/.patterns/`.
 

claude-plugins/kampus-pipeline/agents/coder.md

@@ -66,6 +66,25 @@ These hold on every run regardless of what the spawn prompt remembered to say:
 - **No home / local / absolute / sibling-repo paths in any artifact.** PR bodies,
   progress comments, commit messages, and committed files cite repo-relative paths only —
   never a `~/`, `/Users/…`, vault, or sibling-clone path.
+- **Every intermediate file you write lives under a per-run scratch namespace (§SP).** Never
+  stash state in a fixed or work-item-keyed scratchpad path (`prref.txt`,
+  `/tmp/verdict-$PR.md`) — the pipeline runs several agents concurrently by design, so a
+  shared filename gets clobbered mid-run and reads back **another run's content with no
+  error**: silent, and it routed a reviewer's `git diff` to the wrong PR's files (#3718).
+  Prefer passing the value in-process and writing no file at all; when a file is genuinely
+  needed, derive its path from a per-run namespace and name every leaf under it:
+  `RUN_SCRATCH="${TMPDIR:-/tmp}/kampus-run/${CLAUDE_CODE_SESSION_ID:?}/<skill>-<work-item>"`,
+  then `mkdir -p "$RUN_SCRATCH"` (fail closed — never fall back to a shared path).
+  **When the state must cross a Bash call, this recipe is the carrier: recompute the same line
+  in the later call.** Your shell state does not survive between Bash calls, so a
+  `RUN_SCRATCH` allocated by `mktemp -d` is unrecoverable afterwards — re-running `mktemp -d`
+  yields a *new empty directory*, silently turning a read of your own earlier state into a
+  read of nothing. Keying on `$CLAUDE_CODE_SESSION_ID` gives both properties at once: unique
+  per agent run, and recomputable by any later call of that same run. Never park the path
+  itself in another file to carry it across — that just moves the collision onto that file.
+  The rule, its fail-closed allocation, the single-Bash-call `mktemp` carve-out, and the
+  never-leak-the-path corollary are single-sourced in the skills'
+  `gh-issue-intake-formats.md` §SP.
 - **Work from the repo root**, not a nested app directory.
 - **State a *why* ONCE — collapse duplicated docblocks to a pointer.** In the code you
   generate, apply CLAUDE.md's "Comments earn their place or die" convention: state a

claude-plugins/kampus-pipeline/agents/planner.md

@@ -85,6 +85,25 @@ These hold on every run regardless of what the spawn prompt remembered to say:
 - **No home / local / absolute / sibling-repo paths in any artifact.** The plan body, child
   bodies, journal notes, and progress comments cite repo-relative paths only — never a `~/`,
   `/Users/…`, vault, or sibling-clone path.
+- **Every intermediate file you write lives under a per-run scratch namespace (§SP).** Never
+  stash state in a fixed or work-item-keyed scratchpad path (`prref.txt`,
+  `/tmp/verdict-$PR.md`) — the pipeline runs several agents concurrently by design, so a
+  shared filename gets clobbered mid-run and reads back **another run's content with no
+  error**: silent, and it routed a reviewer's `git diff` to the wrong PR's files (#3718).
+  Prefer passing the value in-process and writing no file at all; when a file is genuinely
+  needed, derive its path from a per-run namespace and name every leaf under it:
+  `RUN_SCRATCH="${TMPDIR:-/tmp}/kampus-run/${CLAUDE_CODE_SESSION_ID:?}/<skill>-<work-item>"`,
+  then `mkdir -p "$RUN_SCRATCH"` (fail closed — never fall back to a shared path).
+  **When the state must cross a Bash call, this recipe is the carrier: recompute the same line
+  in the later call.** Your shell state does not survive between Bash calls, so a
+  `RUN_SCRATCH` allocated by `mktemp -d` is unrecoverable afterwards — re-running `mktemp -d`
+  yields a *new empty directory*, silently turning a read of your own earlier state into a
+  read of nothing. Keying on `$CLAUDE_CODE_SESSION_ID` gives both properties at once: unique
+  per agent run, and recomputable by any later call of that same run. Never park the path
+  itself in another file to carry it across — that just moves the collision onto that file.
+  The rule, its fail-closed allocation, the single-Bash-call `mktemp` carve-out, and the
+  never-leak-the-path corollary are single-sourced in the skills'
+  `gh-issue-intake-formats.md` §SP.
 - **Work from the repo root**, not a nested app directory.
 - **Plan only — never implement, review, or merge.** You write issues, never repo files (you
   carry no Edit/Write tool). You do not write code, do not run a review skill, do not flip a

claude-plugins/kampus-pipeline/agents/reporter.md

@@ -59,6 +59,25 @@ These hold on every run regardless of what the spawn prompt remembered to say:
   / `user.name`. Never a `/Users/…`, `~/`, vault, or sibling-clone path — in the footer
   *or* in the body. Pointers cite repo-relative paths only. Generate the footer with
   `footer.sh`; if you ever assemble it by hand, scrub the same way.
+- **Every intermediate file you write lives under a per-run scratch namespace (§SP).** Never
+  stash state in a fixed or work-item-keyed scratchpad path (`prref.txt`,
+  `/tmp/verdict-$PR.md`) — the pipeline runs several agents concurrently by design, so a
+  shared filename gets clobbered mid-run and reads back **another run's content with no
+  error**: silent, and it routed a reviewer's `git diff` to the wrong PR's files (#3718).
+  Prefer passing the value in-process and writing no file at all; when a file is genuinely
+  needed, derive its path from a per-run namespace and name every leaf under it:
+  `RUN_SCRATCH="${TMPDIR:-/tmp}/kampus-run/${CLAUDE_CODE_SESSION_ID:?}/<skill>-<work-item>"`,
+  then `mkdir -p "$RUN_SCRATCH"` (fail closed — never fall back to a shared path).
+  **When the state must cross a Bash call, this recipe is the carrier: recompute the same line
+  in the later call.** Your shell state does not survive between Bash calls, so a
+  `RUN_SCRATCH` allocated by `mktemp -d` is unrecoverable afterwards — re-running `mktemp -d`
+  yields a *new empty directory*, silently turning a read of your own earlier state into a
+  read of nothing. Keying on `$CLAUDE_CODE_SESSION_ID` gives both properties at once: unique
+  per agent run, and recomputable by any later call of that same run. Never park the path
+  itself in another file to carry it across — that just moves the collision onto that file.
+  The rule, its fail-closed allocation, the single-Bash-call `mktemp` carve-out, and the
+  never-leak-the-path corollary are single-sourced in the skills'
+  `gh-issue-intake-formats.md` §SP.
 - **Work from the repo root**, not a nested app directory.
 
 ## Repo-agnostic — resolve `$REPO`, never hardcode a literal

claude-plugins/kampus-pipeline/agents/reviewer.md

@@ -266,6 +266,25 @@ These hold on every run regardless of what the spawn prompt remembered to say:
 - **No home / local / absolute / sibling-repo paths in any artifact.** Verdict comments
   and any prose cite repo-relative paths only — never a `~/`, `/Users/…`, vault, or
   sibling-clone path.
+- **Every intermediate file you write lives under a per-run scratch namespace (§SP).** Never
+  stash state in a fixed or work-item-keyed scratchpad path (`prref.txt`,
+  `/tmp/verdict-$PR.md`) — the pipeline runs several agents concurrently by design, so a
+  shared filename gets clobbered mid-run and reads back **another run's content with no
+  error**: silent, and it routed a reviewer's `git diff` to the wrong PR's files (#3718).
+  Prefer passing the value in-process and writing no file at all; when a file is genuinely
+  needed, derive its path from a per-run namespace and name every leaf under it:
+  `RUN_SCRATCH="${TMPDIR:-/tmp}/kampus-run/${CLAUDE_CODE_SESSION_ID:?}/<skill>-<work-item>"`,
+  then `mkdir -p "$RUN_SCRATCH"` (fail closed — never fall back to a shared path).
+  **When the state must cross a Bash call, this recipe is the carrier: recompute the same line
+  in the later call.** Your shell state does not survive between Bash calls, so a
+  `RUN_SCRATCH` allocated by `mktemp -d` is unrecoverable afterwards — re-running `mktemp -d`
+  yields a *new empty directory*, silently turning a read of your own earlier state into a
+  read of nothing. Keying on `$CLAUDE_CODE_SESSION_ID` gives both properties at once: unique
+  per agent run, and recomputable by any later call of that same run. Never park the path
+  itself in another file to carry it across — that just moves the collision onto that file.
+  The rule, its fail-closed allocation, the single-Bash-call `mktemp` carve-out, and the
+  never-leak-the-path corollary are single-sourced in the skills'
+  `gh-issue-intake-formats.md` §SP.
 - **Work from the repo root**, not a nested app directory.
 - **Verify only — never edit, never merge, never review your own work.** You hold no
   Edit/Write tool by construction. You land a verdict; the merge is never yours — `ship-it`

claude-plugins/kampus-pipeline/agents/shipper.md

@@ -102,6 +102,25 @@ These hold on every run regardless of what the spawn prompt remembered to say:
 - **No home / local / absolute / sibling-repo paths in any artifact.** Progress comments and
   any text you post cite repo-relative paths only — never a `~/`, `/Users/…`, vault, or
   sibling-clone path.
+- **Every intermediate file you write lives under a per-run scratch namespace (§SP).** Never
+  stash state in a fixed or work-item-keyed scratchpad path (`prref.txt`,
+  `/tmp/verdict-$PR.md`) — the pipeline runs several agents concurrently by design, so a
+  shared filename gets clobbered mid-run and reads back **another run's content with no
+  error**: silent, and it routed a reviewer's `git diff` to the wrong PR's files (#3718).
+  Prefer passing the value in-process and writing no file at all; when a file is genuinely
+  needed, derive its path from a per-run namespace and name every leaf under it:
+  `RUN_SCRATCH="${TMPDIR:-/tmp}/kampus-run/${CLAUDE_CODE_SESSION_ID:?}/<skill>-<work-item>"`,
+  then `mkdir -p "$RUN_SCRATCH"` (fail closed — never fall back to a shared path).
+  **When the state must cross a Bash call, this recipe is the carrier: recompute the same line
+  in the later call.** Your shell state does not survive between Bash calls, so a
+  `RUN_SCRATCH` allocated by `mktemp -d` is unrecoverable afterwards — re-running `mktemp -d`
+  yields a *new empty directory*, silently turning a read of your own earlier state into a
+  read of nothing. Keying on `$CLAUDE_CODE_SESSION_ID` gives both properties at once: unique
+  per agent run, and recomputable by any later call of that same run. Never park the path
+  itself in another file to carry it across — that just moves the collision onto that file.
+  The rule, its fail-closed allocation, the single-Bash-call `mktemp` carve-out, and the
+  never-leak-the-path corollary are single-sourced in the skills'
+  `gh-issue-intake-formats.md` §SP.
 
 ## Repo-agnostic — resolve `$REPO`, never hardcode a literal
 

claude-plugins/kampus-pipeline/agents/triager.md

@@ -90,6 +90,25 @@ These hold on every run regardless of what the spawn prompt remembered to say:
 - **No home / local / absolute / sibling-repo paths in any artifact.** Issue bodies,
   comments, and labels cite repo-relative paths only — never a `~/`, `/Users/…`, vault,
   or sibling-clone path.
+- **Every intermediate file you write lives under a per-run scratch namespace (§SP).** Never
+  stash state in a fixed or work-item-keyed scratchpad path (`prref.txt`,
+  `/tmp/verdict-$PR.md`) — the pipeline runs several agents concurrently by design, so a
+  shared filename gets clobbered mid-run and reads back **another run's content with no
+  error**: silent, and it routed a reviewer's `git diff` to the wrong PR's files (#3718).
+  Prefer passing the value in-process and writing no file at all; when a file is genuinely
+  needed, derive its path from a per-run namespace and name every leaf under it:
+  `RUN_SCRATCH="${TMPDIR:-/tmp}/kampus-run/${CLAUDE_CODE_SESSION_ID:?}/<skill>-<work-item>"`,
+  then `mkdir -p "$RUN_SCRATCH"` (fail closed — never fall back to a shared path).
+  **When the state must cross a Bash call, this recipe is the carrier: recompute the same line
+  in the later call.** Your shell state does not survive between Bash calls, so a
+  `RUN_SCRATCH` allocated by `mktemp -d` is unrecoverable afterwards — re-running `mktemp -d`
+  yields a *new empty directory*, silently turning a read of your own earlier state into a
+  read of nothing. Keying on `$CLAUDE_CODE_SESSION_ID` gives both properties at once: unique
+  per agent run, and recomputable by any later call of that same run. Never park the path
+  itself in another file to carry it across — that just moves the collision onto that file.
+  The rule, its fail-closed allocation, the single-Bash-call `mktemp` carve-out, and the
+  never-leak-the-path corollary are single-sourced in the skills'
+  `gh-issue-intake-formats.md` §SP.
 - **Work from the repo root**, not a nested app directory.
 
 ## Repo-agnostic — resolve `$REPO`, never hardcode a literal