exec-approval defaults to auto everywhere, not just Claude

[MendixMau]

Direct lane (changes to skills/, bug-logs/, bin/, project-bin/, project-tests/, pipelines)

What changed and why (one paragraph):

Per the owner's ask ("too much approval clicking … not all will have Claude"), bin/exec-approval.sh's tier-4 default flips from interview-mode-derived to auto (ask stays supported); state moves to <project>/.mxtk/exec-approval, reading the old .claude/.exec-approval path as a compat fallback (--set writes the new path and removes the old). New bin/install-harness-permissions.sh is the one entry point that wires "stop asking before every wrapper command" into every harness, not just Claude: it extends install-claude-permissions.sh's allow-lister to Copilot (chat.tools.terminal.autoApprove in .vscode/settings.json) and Aider (yes-always: true in .aider.conf.yml, merged without disturbing wire-agents.sh's stamped block); Cursor/Windsurf are user-level-settings-only, so nothing is written for them. install-claude-permissions.sh itself now splits its allow-list across .claude/settings.json (shared, relative entries) and .claude/settings.local.json (the absolute-$TOOLKIT_ROOT entries, gitignored). sync-project.sh repairs projects wired under the old prose (both the pre-2026-09-15 and the 2026-09-15 "ask (the default)" wording), rewrites the mxcli-init "execute it silently" / "Shall I go ahead?" Communication Style lines, and warns — never fetches — when the toolkit clone is stale or off master (MXTK_SYNC_SKIP_CLONE_CHECK=1 opts the toolkit's own test suite out of that one check, since it necessarily runs from a feature branch; real users never set it). init-project.sh writes Exec approval: auto into PROJECT.md, adds the matching intake question next to interview-mode, and gitignores .mxtk/ + .claude/settings.local.json. toolkit-guide.html gains a "First session on your harness" table (§9); README.md points to it.

Field evidence — which real project this ran against / was observed in, and what it measured or fixed there (CLAUDE.md → "Shipping an instrument", rule 4; required for any instrument change):

No named client/real project this round — the field run used scratch projects scaffolded through the real bin/init-project.sh under a scratchpad, twice, to verify both a fresh scaffold and an existing project migrating off the pre-2026-09-15 and 2026-09-15 prose. That run also surfaced and fixed two real bugs (not imagined-input ones): (1) bin/sync-project.sh's grep -qF "$old" broke for the "execute it silently" line specifically because it starts with a markdown bullet -, which grep read as an option flag — grep: invalid option -- ' ' — silently swallowed by the function's || return 1 guard, so the rewrite was skipped with no error surfaced; fixed by adding -- before the pattern at all three affected call sites, re-verified end-to-end (rewrite lands in one pass, second run is a true no-op). (2) The test-bug12-sync.sh T0 fixture originally grepped the new stale-clone warning text away to keep passing — caught in review and replaced with a proper MXTK_SYNC_SKIP_CLONE_CHECK=1 env override instead, so T0 is back to asserting exit 0 / zero warnings with nothing filtered.

• No client data anywhere in the diff (LEAKGUARD_ALLOW_NO_DENYLIST=1 bin/check-no-client-data.sh clean, 553 tracked files)
• For a new/changed instrument: golden input captured (not hand-written), both layouts (single-tree and .mpr-under-app/), both platforms (macOS + Git Bash/Windows) considered — partial: bin/install-harness-permissions.sh writes project-root config files with no .mpr/single-vs-two-tree dependency, so that axis doesn't apply to it; bin/check-portability.sh (Bash 3.2, no bare execFileSync, no mac-only tool assumptions) passed clean, but no Windows/Git Bash execution was actually performed this round — noted as a gap, not a claim
• CHANGELOG.md line appended in this PR, crediting the source project or person (MendixMau)
• No new ## BUG-DRAFT-<slug>: entries in this PR

Fixture counts (foreground, this tree):

• tests/wave2/test-bug12-sync.sh bin/sync-project.sh — 51/51 (coordinator-run under a watcher, log scratchpad/bug12-final2.log)
• tests/wave2/test-exec-approval.sh bin/exec-approval.sh — 43/43
• tests/wave2/test-install-claude-permissions.sh bin/install-claude-permissions.sh — 56/56

Other checks, all clean on the merged tree (843056c + the post-merge budget trim aebd39b):
bin/check-scripts.sh (79/79 shell, 20/20 Node), bin/check-portability.sh (130 files), bin/check-pr-discipline.sh origin/master, LEAKGUARD_ALLOW_NO_DENYLIST=1 bin/check-no-client-data.sh, LC_ALL=C.UTF-8 bin/render-routing.sh --check (79985/80000 words — merging origin/master's independent baseline growth from PR #84 pushed the total to 80008/80000; trimmed the exec-approval paragraph in skills/interview-protocol.md back down with no content dropped, see aebd39b), bin/check-docs-numbering.sh.

Merged origin/master (33f8a93, #82/#83/#84) into this branch; the only conflict was CHANGELOG.md's ## 2026-09-16 header (both entries kept, this PR's line first).

🤖 Generated with Claude Code

https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw

---

Generated by Claude Code