worker: hand off an exact test environment or keep validation with the primary

[sumitake]

Problem

A bounded codegen worker spent the end of its attempt locating dependencies and returned no source patch. A clean disposable source copy did not contain a usable test environment, and the handoff did not identify an exact interpreter or clearly choose primary-owned execution of tests.

Observed on installed 7.0.7, 2026-09-22, request 217a0f42-2d1e-4422-a29c-ac8bd3fad0e7:

• The brief owned four existing client/contract/schema paths plus one new test. It prohibited installation, asked to use existing dependencies, stated the primary owned full validation, and asked for actual partial work if blocked.
• The native trace contains 45 tool calls: 18 reads, 15 searches, 10 shell calls, one background-command stop, and one background-command result read. There were no edit tool calls; the caller independently confirmed no patch.
• A plain python3 import probe failed with ModuleNotFoundError: No module named 'pydantic'.
• The worker then searched the user home, system directories, package caches, and sibling checkouts for environments. One search moved to the background after 15 seconds and was stopped; a later search took 26.47 seconds.
• Eventually located sibling environments still failed the worker's combined import probe because jsonschema was absent.
• The caller stopped the request at 620,719 ms. Partial commentary and cleanup were retained.

A separate request, 0cd8f122-e0ac-45b0-b08c-afde0d6384ab, also searched for sibling virtual environments after extensive reading; it ended without a patch. That supports recurrence of environment discovery, but the detailed dependency-failure chain above is established for the first request only.

Root cause

The handoff supplied source isolation but left test execution implicit. “Use existing dependencies only” does not identify which interpreter contains them. The worker promoted an optional local validation prerequisite into a blocker for producing code and expanded discovery outside the intended source scope, despite the primary already owning validation.

This is a caller/worker handoff and scope-discipline defect. It does not establish broken Python packages, a network outage, or a need to install more software.

Smallest proposed fix

Update skill-specs/worker.md and the shared caller guidance:

• Pick one mode before dispatch: primary executes validation, or the worker receives an exact already-verified interpreter and focused test command.
• For primary-owned validation, the worker may author tests and return a patch with “not run” stated explicitly. Missing optional test packages must not initiate environment setup or broad discovery.
• For worker-owned validation, do one bounded import/version preflight against the named interpreter. A missing dependency produces a specific limitation and retained partial patch; any installation or expanded environment search remains a separate authorized action.
• Keep source imports bound to the disposable copy so a reused interpreter cannot accidentally test the primary checkout.
• Return a coherent first patch after the necessary source reads; do not require full local test-environment recovery before making any edit.

An interpreter path is a caller-supplied execution context, not a secret or a new environment registry.

Acceptance

Use a small synthetic Python repository:

1. With no local dependencies and primary-owned validation, the worker produces the requested bounded patch/tests and reports tests unrun.
2. With an exact usable interpreter, the focused check loads source from the disposable copy.
3. With a missing dependency, the result names the missing prerequisite and preserves actual work without installation, home-wide scanning, or recursive cache search.
4. Caller source stays unchanged and ordinary patch review, independent tests, and cleanup remain required.

No environment broker, dependency auto-installer, copied credential profile, extra worktree layer, new tool allowlist framework, or forced dependency pinning. This is a narrow follow-up to #195's final shipped disposition, which retained caller-owned isolation and patch capture.